Microsoft Windows SSL/TLS信息泄露漏洞

CVE ID: CVE-2011-3389 Microsoft Windows是微软发布的非常流行的操作系统。 Microsoft Windows在SSL/TLS协议的实现上存在信息泄露漏洞，远程攻击者可利用此漏洞泄露敏感信息并劫持用户会话。 此漏洞源于在CBC模式中结合对称密码套件使用Secure Sockets Layer 3.0 SSL和Transport Layer Security 1.0 TLS 协议时出现的设计错误，通过中间人攻击加密HTTPS会话。 Microsoft Windows Microsoft Windows XP Home Microsoft Windows ...

SSL/TLS Protocol Vulnerability

US-CERT is aware of a vulnerability affecting the Secure Socket Layer SSL and Transport Layer Security TLS protocols. Exploitation of this vulnerability may allow an attacker to decrypt encrypted SSL/TLS traffic and obtain sensitive information. Microsoft has released Security Advisory 2588513 to...

CVE-2011-3389 HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HT...

Automated HTTPS Vulnerability Testing by Qualys SSL Labs

Automated HTTPS Vulnerability Testing by Qualys SSL Labs One of main problem in HTTP protocol is encrypting traffic and verifying data security, securing the web application against any threat is very important especially that if hackers conduct a Man-in the middle attack he can get all users...

Surge-FTP 23b6 Cross Site Scripting

Exploit Title : Surge-FTP v23b6 Admin multiple reflected XSS Vulnerabilities Authored by : Houssam Sahli = backtronuxgmailcom Date : 16/08/2011 Vendor: NetWin Product web page: http://netwinsite.com download link : http://netwinsite.com/ftp/surgeftp/surgeftp23b6windows.exe Affected version: v23b6...

CentOS Update for openssl CESA-2010:0978 centos5 i386

Check for the Version of openssl OpenVAS Vulnerability Test CentOS Update for openssl CESA-2010:0978 centos5 i386 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Apple Releases iOS 4.3.5 and iOS 4.2.10

Apple has released iOS 4.3.5 for the iPhone GSM model, iPod touch, and iPad, and iOS 4.2.10 for the iPhone CDMA model to address a vulnerability. This vulnerability may allow an attacker with a privileged network position to capture or modify data in SSL/TLS sessions. US-CERT encourages users and...

APPLE-SA-2011-07-25-1 iOS 4.3.5 Software Update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2011-07-25-1 iOS 4.3.5 Software Update iOS 4.3.5 Software Update is now available and addresses the following: Data Security Available for: iOS 3.0 through 4.3.4 for iPhone 3GS and iPhone 4 GSM, iOS 3.1 through 4.3.4 for iPod touch 3rd...

APPLE-SA-2011-07-25-2 iOS 4.2.10 Software Update for iPhone

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2011-07-25-2 iOS 4.2.10 Software Update for iPhone iOS 4.2.10 Software Update for iPhone is now available and addresses the following: Data Security Available for: iOS 4.2.5 through 4.2.9 for iPhone 4 CDMA Impact: An attacker with a privilege...

[SECURITY] Fedora 14 Update: pure-ftpd-1.0.32-1.fc14

Pure-FTPd is a fast, production-quality, standard-comformant FTP server, based upon Troll-FTPd. Unlike other popular FTP servers, it has no known security flaw, it is really trivial to set up and it is especially designed for modern Linux and FreeBSD kernels setfsuid, sendfile, capabilities...

FTPRush v1.1.3 - Stack Buffer Overflow Vulnerability

Document Title: =============== FTPRush v1.1.3 - Stack Buffer Overflow Vulnerability References Source: ==================== http://www.youtube.com/watch?v=Fxr35RAcaUA Release Date: ============= 2011-06-16 Vulnerability Laboratory ID VL-ID: ==================================== 54 Product & Servi...

FreeBSD : fetchmail -- STARTTLS denial of service (f7d838f2-9039-11e0-a051-080027ef73ec)

Matthias Andree reports : Fetchmail version 5.9.9 introduced STLS support for POP3, version 6.0.0 added STARTTLS for IMAP. However, the actual STARTTLS-initiated in-band SSL/TLS negotiation was not guarded by a timeout. Depending on the operating system defaults as to TCP stream keepalive mode,...

Nmap NSE net: ssl-enum-ciphers

This script repeatedly initiates SSL/TLS connections, each time trying a new cipher or compressor while recording whether a host accepts or rejects it. The end result is a list of all the ciphers and compressors that a server accepts. SSLv3/TLSv1 requires more effort to determine which ciphers an...

RHEL 6 : openssl (RHSA-2011:0677)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0677 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocols, as well as a full-strength,...

ArpON 2.2 released - ARP handler inspection !

ArpON 2.2 released - ARP handler inspection ! ArpON ARP handler inspection is a portable handler daemon that make ARP secure in order to avoid the Man In The Middle MITM through ARP Spoofing/Poisoning attacks. It detects and blocks also derived attacks by it for more complex attacks, as: DHCP...

fetchmail -- STARTTLS denial of service

Matthias Andree reports: Fetchmail version 5.9.9 introduced STLS support for POP3, version 6.0.0 added STARTTLS for IMAP. However, the actual STARTTLS-initiated in-band SSL/TLS negotiation was not guarded by a timeout. Depending on the operating system defaults as to TCP stream keepalive mode,...

SSL/TLS: Certificate - Self-Signed Certificate Detection

The SSL/TLS certificate on this port is self-signed. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SSL/TLS: Certificate - Subject Common Name Does Not Match Server FQDN

The SSL/TLS certificate contains a common name CN that does not match the hostname. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...

Fedora Update for pure-ftpd FEDORA-2011-3349

Check for the Version of pure-ftpd OpenVAS Vulnerability Test Fedora Update for pure-ftpd FEDORA-2011-3349 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under th...

[SECURITY] Fedora 15 Update: nss-3.12.9-14.fc15

Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security...