CVE-2014-1295

Secure Transport in Apple iOS before 7.1.1, Apple OS X 10.8.x and 10.9.x through 10.9.2, and Apple TV before 6.1.1 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which allows man-in-the-middle attackers to obtain sensitive...

Design/Logic Flaw

Secure Transport in Apple iOS before 7.1.1, Apple OS X 10.8.x and 10.9.x through 10.9.2, and Apple TV before 6.1.1 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which allows man-in-the-middle attackers to obtain sensitive...

CVE-2014-1295

Technical details about CVE-2014-1295 are not publicly available in the provided documents. Monitor for updates.

Mac OS X Multiple Vulnerabilities (Security Update 2014-002)

The remote host is running a version of Mac OS X 10.7, 10.8, or 10.9 that does not have Security Update 2014-002 applied. This update contains several security-related fixes for the following components : - CFNetwork HTTPProtocl - CoreServicesUIAgent - FontParser - Heimdal Kerberos - ImageIO -...

not verifying certs for TLS to IP address / Secure Transport

When asked to do a TLS connection HTTPS, FTPS, IMAPS, etc to a URL specified with an IP address instead of a name, libcurl would wrongly not verify the server's name in the certificate. The signature whether it was signed by a trusted CA and validity whether the date was within the certificate's...

CURL-CVE-2014-1263 not verifying certs for TLS to IP address / Secure Transport

When asked to do a TLS connection HTTPS, FTPS, IMAPS, etc to a URL specified with an IP address instead of a name, libcurl would wrongly not verify the server's name in the certificate. The signature whether it was signed by a trusted CA and validity whether the date was within the certificate's...

Apple Products SSLVerifySignedServerKeyExchange Security Feature Bypass (CVE-2014-1266)

There exists a security feature bypass vulnerability in Apple products. The vulnerability is due to the SSLVerifySignedServerKeyExchange function in the Secure Transport feature not checking the signature in a TLS Server Key Exchange message. This vulnerability allows man-in-the-middle attackers ...

APPLE-SA-2014-02-21-3 Apple TV 6.0.2

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-02-21-3 Apple TV 6.0.2 Apple TV 6.0.2 is now available and addresses the following: Apple TV Available for: Apple TV 2nd generation and later Impact: An attacker with a privileged network position may capture or modify data in sessions...

APPLE-SA-2014-02-21-1 iOS 6.1.6

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-02-21-1 iOS 6.1.6 iOS 6.1.6 is now available and addresses the following: Data Security Available for: iPhone 3GS, iPod touch 4th generation Impact: An attacker with a privileged network position may capture or modify data in sessions...

APPLE-SA-2014-02-21-2 iOS 7.0.6

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-02-21-1 iOS 6.1.6 iOS 6.1.6 is now available and addresses the following: Data Security Available for: iPhone 3GS, iPod touch 4th generation Impact: An attacker with a privileged network position may capture or modify data in sessions...

Mac OS X Multiple Vulnerabilities (Security Update 2014-001) (BEAST)

The remote host is running a version of Mac OS X 10.7 or 10.8 that does not have Security Update 2014-001 applied. This update contains several security-related fixes for the following components : - Apache - App Sandbox - ATS - Certificate Trust Policy - CFNetwork Cookies - CoreAnimation - Date...

CVE-2014-1266

The SSLVerifySignedServerKeyExchange function in libsecurityssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a...

Design/Logic Flaw

The SSLVerifySignedServerKeyExchange function in libsecurityssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a...

CVE-2014-1266

The SSLVerifySignedServerKeyExchange function in libsecurityssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a...

CVE-2014-1266

CVE-2014-1266 affects Apple iOS (6.x before 6.1.6, 7.x before 7.0.6), Apple TV (6.x before 6.0.2), and OS X (10.9.x before 10.9.2). The Secure Transport SSLVerifySignedServerKeyExchange function fails to properly verify the TLS Server Key Exchange signature, allowing MITM attackers to spoof an SS...

Apple's iOS vulnerable to Man-in-the-middle Attack, Install iOS 7.0.6 to Patch

Apple's latest 35.4 MB update of iOS 7.0.6 doesn't seem important at first, but it contains a critical security patch that addresses a flaw with SSL encryption. Yes, a very critical security vulnerability that could allow hackers to intercept email and other communications that are meant to be...

Apple Fixes Certificate Validation Flaw in iOS

Apple on Friday quietly pushed out a security update to iOS that restores some certificate-validation checks that had apparently been missing from the operating system for an unspecified amount of time. Apple released iOS 7.06 on Friday and the only content in the update was a small security fix...

Path Traversal Vulnerability on Secure Transport versions 5.1 SP2 and earlier

Secure Transport Path Traversal Vulnerability Public Disclosure Date: November 11, 2012 Vendors Affected: Axway http://www.axway.com Systems Affected: Secure Transport Problem: A path traversal vulnerability was identified in SecureTransport versions 5.1 SP2 and earlier on the Microsoft Windows...

Axway Secure Transport 5.1 SP2 - Directory Traversal

Secure Transport Path Traversal Vulnerability Public Disclosure Date: November 11, 2012 Vendors Affected: Axway http://www.axway.com Systems Affected: Secure Transport Problem: A path traversal vulnerability was identified in SecureTransport versions 5.1 SP2 and earlier on the Microsoft Windows...

Fedora Update for gnutls FEDORA-2012-4569

Check for the Version of gnutls OpenVAS Vulnerability Test Fedora Update for gnutls FEDORA-2012-4569 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...