Scientific Linux Security Update : openssl on SL3.x i386/x86_64

A flaw was found in the SSLgetsharedciphers utility function. An attacker could send a list of ciphers to an application that used this function and overrun a buffer with a single byte CVE-2007-5135. Few applications make use of this vulnerable function and generally it is used only when...

SuSE 10 Security Update : GnuTLS (ZYPP Patch Number 8066)

This update of GnuTLS fixes multiple vulnerabilities : - remote attackers could cause a denial of service heap memory corruption and application crash via an issue in the asn1getlengthder function. CVE-2012-1569 - crafted GenericBlockCipher structures allow remote attackers to cause a denial of...

CVE-2012-0390

The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which makes it easier for remote attackers to recover partial plaintext via a timing side-channel attack, a related...

CVE-2012-0390

The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which makes it easier for remote attackers to recover partial plaintext via a timing side-channel attack, a related...

CVE-2012-0390

The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which makes it easier for remote attackers to recover partial plaintext via a timing side-channel attack, a related...

Sql injection

The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which makes it easier for remote attackers to recover partial plaintext via a timing side-channel attack, a related...

CVE-2012-0390

Technical details about CVE-2012-0390 (DTLS timing side-channel in GnuTLS

CVE-2012-0390

The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which makes it easier for remote attackers to recover partial plaintext via a timing side-channel attack, a related...

CVE-2012-0390

The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which makes it easier for remote attackers to recover partial plaintext via a timing side-channel attack, a related...

German Researchers Break RFID Smartcard Encryption

German Researchers Break RFID Smartcard Encryption Scientists have found a way to circumvent the encryption used to protect a smartcard used to restrict access to buildings and to process public transit system payments. A team of German scientists have demonstrated a hack that lets them make a...

German Researchers Break RFID Smartcard Encryption

German Researchers Break RFID Smartcard Encryption Scientists have found a way to circumvent the encryption used to protect a smartcard used to restrict access to buildings and to process public transit system payments. A team of German scientists have demonstrated a hack that lets them make a...

OpenSSL leaks ECDSA private key through a remote timing attack

Overview The OpenSSL ladder implementation for scalar multiplication of points on elliptic curves over binary fields is susceptible to a timing attack vulnerability. This vulnerability can be used to steal the private key of a TLS server that authenticates with ECDSA signatures and binary curves...

Experts: OpenBSD Backdoor Allegations 'Almost Certainly False'

The incredible allegations that developers working under the auspices of the FBI and Justice Department planted a backdoor in the IPSec stack of the OpenBSD operating system are likely just that, experts say: not credible. “There is no way that the FBI paid anyone to create backdoors in OpenBSD a...

Microsoft ASP.NET - Padding Oracle File Download (MS10-070)

Microsoft ASP.NET - Padding Oracle File Download MS10-070 !/usr/bin/ruby -w aspxpochotextattack.rb Copyright c 2010 AmpliaSECURITY. All rights reserved http://www.ampliasecurity.com Agustin Azubel - [email protected] MS10-070 ASPX proof of concept Decrypt data using Vaudenay's...

[SECURITY] CVE-2008-2370: Apache CouchDB Timing Attack Vulnerability

CVE-2008-2370: Apache CouchDB Timing Attack Vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache CouchDB 0.8.0 to 0.10.1 Description: Apache CouchDB versions prior to version 0.11.0 are vulnerable to timing attacks, also known as side-channel...

MiTM Attacks Can Help Steal Data from SaaS

Researchers from Indiana University and Microsoft were able to infer sensitive data by analyzing the distinct size and other attributes of each exchange between a user and a website interaction. Using man-in-the-middle attacks, they could glean the information even when transactions were encrypte...

CentOS 5 : openssl (CESA-2007:0964)

Updated OpenSSL packages that correct several security issues are now available for Red Hat Enterprise 5. This update has been rated as having important security impact by the Red Hat Security Response Team. OpenSSL is a toolkit that implements Secure Sockets Layer SSL v2/v3 and Transport Layer...

Attachmate Reflection for Secure IT UNIX Server < 7.0 SP1 Multiple Vulnerabilities

Binary data 4632.prm...

Attachmate Reflection for Secure IT UNIX server < 7.0 SP1 Multiple Vulnerabilities

The version of Attachmate Reflection for Secure IT UNIX server installed on the remote host is less than 7.0 SP1 and thus reportedly affected by several issues : - There is an inherited vulnerability in OpenSSL when parsing malformed ASN.1 structures leading to a denial of service vulnerability...

Debian DSA-1571-1 : openssl - predictable random number generator

Luciano Bello discovered that the random number generator in Debian's openssl package is predictable. This is caused by an incorrect Debian-specific change to the openssl package CVE-2008-0166 . As a result, cryptographic key material may be guessable. This is a Debian-specific vulnerability whic...