CVE-2016-3739

The 1 mbedconnectstep1 function in lib/vtls/mbedtls.c and 2 polarsslconnectstep1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote attackers to spoof servers via an arbitrary valid...

CVE-2016-3739

The 1 mbedconnectstep1 function in lib/vtls/mbedtls.c and 2 polarsslconnectstep1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote attackers to spoof servers via an arbitrary valid...

CVE-2016-3739

CVE-2016-3739 affects curl/libcurl prior to 7.49.0. The flaw exists in the mbed_connect_step1 (mbedtls.c) and polarssl_connect_step1 (polarssl.c) code paths when using SSLv3 or TLS for a URL that resolves to a numerical IP address. This can enable remote attackers to spoof the TLS/SSL server by p...

CURL-CVE-2016-3739 TLS certificate check bypass with mbedTLS/PolarSSL

libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, or when explicitly asked to use SSLv3. This flaw only exists when libcurl is built to use mbedTLS or PolarSSL as the TLS backend. The documentation for mbedTLS and PolarSSL wrongly says that...

Google Set to Kill SSLv3, RC4 in SMTP, Gmail in June

Google clarified this week exactly when it plans to disable support for the RC4 stream cipher and the SSLv3 protocol on the company’s SMTP servers and Gmail’s web servers. It turns out the end will come sooner than later; the company announced it will begin to disable both a month from now, on Ju...

IBM Domino SSLv3 Padding Oracle On Downgraded Legacy Encryption Vulnerability (POODLE)

The version of IBM Domino formerly Lotus Domino installed on the remote host is affected by a man-in-the-middle MitM information disclosure vulnerability, known as POODLE, due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining...

RedHat Update for openssl098e RHSA-2016:0372-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-3489-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 3489-1 (lighttpd - security update)

lighttpd, a small webserver, is vulnerable to the POODLE attack via the use of SSLv3. This protocol is now disabled by default. OpenVAS Vulnerability Test $Id: deb3489.nasl 6608 2017-07-07 12:05:05Z cfischer $ Auto-generated from advisory DSA 3489-1 using nvtgen 1.0 Script version: 1.0 Author:...

CentOS 5 : openssl (CESA-2016:0302) (DROWN)

Updated openssl packages that fix three security issues are now available for Red Hat Enterprise Linux 5 Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available fo...

Important: Red Hat Security Advisory: openssl security update

Updated openssl packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 Extended Lifecycle Support. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

AIX 7.1 TL 3 : bos.net.tcp.server (U867669) (Bar Mitzvah)

The remote host is missing AIX PTF U867669, which is related to the security of the package bos.net.tcp.server. Product could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a...

AIX 7.1 TL 3 : bos.net.tcp.client (U867672)

The remote host is missing AIX PTF U867672, which is related to the security of the package bos.net.tcp.client. Product could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a...

[SECURITY] [DSA 3489-1] lighttpd security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3489-1 [email protected] https://www.debian.org/security/ Sebastien Delafond February 23, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3489-1] lighttpd security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3489-1 [email protected] https://www.debian.org/security/ Sebastien Delafond February 23, 2016 https://www.debian.org/security/faq -...

DSA-3489-1 lighttpd - security update

Bulletin has no description...

Gratipay: The POODLE attack (SSLv3 supported) for https://grtp.co/

Websites that support SSLv3 and CBC-mode ciphers are potentially vulnerable to an active MITM Man-in-the-middle attack. This attack, called POODLE, is similar to the BEAST attack and also allows a network attacker to extract the plaintext of targeted parts of an SSL connection, usually cookie dat...

Ubuntu 14.04 LTS : CUPS update (USN-2839-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2839-1 advisory. As a security improvement against the POODLE attack, this update disables SSLv3 support in the CUPS web interface. For legacy environments where SSLv3 support is...

Ubuntu: Security Advisory (USN-2839-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-2839-1: CUPS update

As a security improvement against the POODLE attack, this update disables SSLv3 support in the CUPS web interface. For legacy environments where SSLv3 support is still required, it can be re-enabled by adding "SSLOptions AllowSSL3" to /etc/cups/cupsd.conf...