Oracle Solaris Third-Party Patch Update : nss (cve_2013_1620_lucky_thirteen)

The remote Solaris system is missing necessary patches to address security updates : - The TLS implementation in Mozilla Network Security Services NSS does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which...

IBM Tivoli Directory Server < 6.0.0.72 / 6.1.0.55 / 6.2.0.30 / 6.3.0.22 with GSKit < 7.0.4.45 / 8.0.14.27 TLS Side-Channel Timing Information Disclosure

The remote host is running a version of IBM Tivoli Directory Server and a version of IBM Global Security Kit GSKit that is affected by an information disclosure vulnerability. The Transport Layer Security TLS protocol does not properly consider timing side-channel attacks, which allows remote...

DLA-93-1 libgcrypt11 - security update

Bulletin has no description...

Paper: NetFlow Data De-Anonymizes Tor Users

Tor Project leaders are trying to rein in concerns about an academic paper describing an end-to-end traffic correlation attack that could be used by a well-funded attacker such as a nation state to de-anonymize traffic on Tor. Executive director Roger Dingledine points out that the researchers...

Debian DSA-3073-1 : libgcrypt11 - security update

Daniel Genkin, Itamar Pipman and Eran Tromer discovered that Elgamal encryption subkeys in applications using the libgcrypt11 library, for example GnuPG 2.x, could be leaked via a side-channel attack. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

[SECURITY] [DSA 3073-1] libgcrypt11 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3073-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso November 16, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3073-1] libgcrypt11 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3073-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso November 16, 2014 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 3073-1 (libgcrypt11 - security update)

Daniel Genkin, Itamar Pipman and Eran Tromer discovered that Elgamal encryption subkeys in applications using the libgcrypt11 library, for example GnuPG 2.x, could be leaked via a side-channel attack. OpenVAS Vulnerability Test $Id: deb3073.nasl 6759 2017-07-19 09:56:33Z teissa $ Auto-generated...

RHEL 4 : JBoss EWP (RHSA-2013:0197)

Updated JBoss Enterprise Web Platform 5.2.0 packages that fix multiple security issues, various bugs, and add several enhancements are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability...

WP API: Cryptographic Side Channel in OAuth Library

Because hashes and tokens are compared with the !== and === operators, these checks may be susceptible to timing attacks. More info: http://codahale.com/a-lesson-in-timing-attacks/ Affected code:...

joola.io: Timing Attack Side-Channel on API Token Verification

https://github.com/joola/joola/blob/develop/lib/dispatch/users.jsL514 Because tokens are compared with the === operator, this may be susceptible to timing attacks. More info: http://codahale.com/a-lesson-in-timing-attacks/ This is probably not the lowest hanging fruit for an attacker, but it's...

F5 Networks BIG-IP : SSL acceleration card timing vulnerability (K15500)

SSL virtual servers in F5 BIG-IP systems 10.x before 10.2.4 HF9, 11.x before 11.2.1 HF12, 11.3.0 before HF10, 11.4.0 before HF8, 11.4.1 before HF5, 11.5.0 before HF5, and 11.5.1 before HF5, when used with third-party Secure Sockets Layer SSL accelerator cards, might allow remote attackers to have...

Mandriva Linux Security Advisory : gnupg (MDVSA-2014:180)

Updated gnupg packages fix security vulnerability : The gnupg program before version 1.4.16 is vulnerable to an ELGAMAL side-channel attack CVE-2014-5270. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandriva Linux...

Updated gnupg packages fix CVE-2014-5270

Updated gnupg packages fix security vulnerability: The gnupg program before version 1.4.16 is vulnerable to an ELGAMAL side-channel attack CVE-2014-5270...

GnuPG / libcrypt information leakage

ElGamal subkeys can be leaked via side-channel...

[SECURITY] [DLA 53-1] gnupg security update

Package : gnupg Version : 1.4.10-4+squeeze6 CVE ID : CVE-2014-5270 Genkin, Pipman and Tromer discovered a side-channel attack on Elgamal encryption subkeys CVE-2014-5270. In addition, this update hardens GnuPGs behaviour when treating keyserver responses; GnuPG now filters keyserver responses to...

Debian DSA-3024-1 : gnupg - security update

Genkin, Pipman and Tromer discovered a side-channel attack on Elgamal encryption subkeys CVE-2014-5270 . In addition, this update hardens GnuPG's behaviour when treating keyserver responses; GnuPG now filters keyserver responses to only accepts those keyid's actually requested by the user...

DLA-54-1 gnupg - security-update

Bulletin has no description...

Mandriva Linux Security Advisory : libgcrypt (MDVSA-2014:176)

Updated libgcrypt packages fix security vulnerability : The libgcrypt library before version 1.5.4 is vulnerable to an ELGAMAL side-channel attack CVE-2014-5270. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandriv...

[SECURITY] [DSA 3024-1] gnupg security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3024-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst September 11, 2014 http://www.debian.org/security/faq -...