CVE-2009-0025

BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL DSAverify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077...

Vulnerability in OpenSSL CVE-2008-5077

The Google Security Team discovered several functions inside OpenSSL incorrectly checked the result after calling the EVPVerifyFinal function, allowing a malformed signature to be treated as a good signature rather than as an error. This issue affected the signature checks on DSA and ECDSA keys...

SSL Service Requests Client Certificate

The remote service encrypts communications using SSL/TLS, requests a client certificate, and may require a valid certificate in order to establish a connection to the underlying service. TRUSTED...

FTP Supports Cleartext Authentication

The remote FTP server allows the user's name and password to be transmitted in cleartext, which could be intercepted by a network sniffer or a man-in-the-middle attack. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid34324; scriptversion"1.28";...

FreeBSD Security Advisory (FreeBSD-SA-04:05.openssl.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-04:05.openssl.asc ADV FreeBSD-SA-04:05.openssl.asc OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008...

Re: MicroWorld MailScan - Multiple Vulnerabilities within Admin-Webinterface

MicroWorld MailScan - Multiple Vulnerabilities within Admin-Webinterface ======================================================================== Affected Products - MailScan for Mail Servers Version: 5.6.a with espatch1 Win32 Platform Other Mailscan Products, Versions, also, if available for oth...

PCI DSS compliance

Binary data pcicompliance.nbin...

Fedora 9 : filezilla-3.1.0.1-1.fc9 (2008-6865)

According to the NEWS in this release: ---------------- ! Do not report success on SSL/TLS transfers if server did not perform orderly SSL/TLS shutdown. Previously, an attacker could cause truncated files with FileZilla thinking the transfer was successful. All versions prior to this were affecte...

Fedora 8 : filezilla-3.1.0.1-1.fc8 (2008-6812)

According to the NEWS in this release: ---------------- ! Do not report success on SSL/TLS transfers if server did not perform orderly SSL/TLS shutdown. Previously, an attacker could cause truncated files with FileZilla thinking the transfer was successful. All versions prior to this were affecte...

JVN#88676089 Safari installed in iPod touch and iPhone vulnerable in handling server certificates

Safari is a web browser provided by Apple. Safari installed in iPod touch and iPhone accepts a self-signed or invalid server cerficate without the user's explicit concent when connecting via SSL/TLS. According to Apple, "When Safari accesses a website that uses a self-signed or invalid certificat...

USN-612-9: openssl-blacklist update

USN-612-3 addressed a weakness in OpenSSL certificate and key generation in OpenVPN by introducing openssl-blacklist to aid in detecting vulnerable private keys. This update enhances the openssl-vulnkey tool to check Certificate Signing Requests, accept input from STDIN, and check moduli without ...

Debian Security Advisory DSA 1571-1 (openssl)

The remote host is missing an update to openssl announced via advisory DSA 1571-1. OpenVAS Vulnerability Test $Id: deb15711.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1571-1 openssl Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Debian Security Advisory DSA 1581-1 (gnutls13)

The remote host is missing an update to gnutls13 announced via advisory DSA 1581-1. OpenVAS Vulnerability Test $Id: deb15811.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1581-1 gnutls13 Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : openssl-blacklist update (USN-612-8)

USN-612-3 addressed a weakness in OpenSSL certificate and key generation in OpenVPN by introducing openssl-blacklist to aid in detecting vulnerable private keys. This update enhances the openssl-vulnkey tool to check X.509 certificates as well, and provides the corresponding update for Ubuntu 6.0...

Debian DSA-1581-1 : gnutls13 - several vulnerabilities

Several remote vulnerabilities have been discovered in GNUTLS, an implementation of the SSL/TLS protocol suite. NOTE: The libgnutls13 package, which provides the GNUTLS library, does not contain logic to automatically restart potentially affected services. You must restart affected services...

USN-612-8: openssl-blacklist update

USN-612-3 addressed a weakness in OpenSSL certificate and key generation in OpenVPN by introducing openssl-blacklist to aid in detecting vulnerable private keys. This update enhances the openssl-vulnkey tool to check X.509 certificates as well, and provides the corresponding update for Ubuntu 6.0...

[SECURITY] [DSA 1581-1] New gnutls13 packages fix potential code execution

------------------------------------------------------------------------ Debian Security Advisory DSA-1581-1 [email protected] http://www.debian.org/security/ Florian Weimer May 20, 2008 http://www.debian.org/security/faq -...

DSA-1581-1 gnutls13 - potential code execution

Bulletin has no description...

Ubuntu 7.04 / 7.10 / 8.04 LTS : openvpn vulnerability (USN-612-3)

A weakness has been discovered in the random number generator used by OpenSSL on Debian and Ubuntu systems. As a result of this weakness, certain encryption keys are much more common than they should be, such that an attacker could guess the key through a brute-force attack given minimal knowledg...

Debian and Ubuntu OpenSSL packages contain a predictable random number generator

Overview A vulnerability in the OpenSSL package included with the Debian GNU/Linux operating system and its derivatives may cause weak cryptographic keys to be generated. Description A weakness exists in the random number generator used by the OpenSSL package included with the Debian GNU/Linux...