Decentralized P2P Websites: ZeroNet

Decentralized P2P websites using Bitcoin crypto and the BitTorrent network ZeroNet uses Bitcoin cryptography and BitTorrent technology to build a decentralized censorship-resistant network. Users can publish static or dynamic websites into ZeroNet and visitors can choose to also serve the website...

RHEL 6 : rhevm-spice-client (RHSA-2015:0197)

Updated rhevm-spice-client packages that fix two security issues and several bugs are now available for Red Hat Enterprise Virtualization Manager 3. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

AIX 7.1 TL 3 : ntp (IV74261)

The remote AIX host has a version of Network Time Protocol NTP installed that is affected by a denial of service vulnerability due to a flaw in the symmetric-key feature in the receive function in file ntpproto.c when receiving certain invalid packets, which causes state-variable updates to be...

Moderate: Red Hat Bug Fix Advisory: 389-ds-base bug fix update

Updated 389-ds-base packages that fix several bugs are now available for Red Hat Enterprise Linux 7. The 389 Directory Server is an LDAPv3 compliant server. The base packages include the LDAP server and command-line utilities for server administration. This update fixes the following bugs:...

ntp: authentication doesn't protect symmetric associations against DoS attacks

A denial of service flaw was found in the way NTP hosts that were peering with each other authenticated themselves before updating their internal state variables. An attacker could send packets to one peer host, which could cascade to other peers, and stop the synchronization process among the...

Moderate: Red Hat Security Advisory: ntp security, bug fix, and enhancement update

Updated ntp packages that fix multiple security issues, several bugs, and add two enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

The vulnerability of the Cisco IOS operating system, which allows a intruder to trigger a service failure

The vulnerability of the PRE module in the Cisco IOS operating system arises due to synchronization errors when using a shared resource. Exploiting this vulnerability allows a malicious actor to cause service failure by initiating frequent connections to devices via the IPv6 protocol...

The vulnerability of the Cisco IOS operating system, which allows a intruder to trigger a service failure

The vulnerability of the PRE module in the Cisco IOS operating system arises due to synchronization errors when using a shared resource. Exploiting this vulnerability allows a malicious actor to cause service failure by sending specially crafted MPLS 6VPE packets remotely...

Network Time Protocol Daemon (ntpd) 3.x / 4.x < 4.2.8p2 Multiple Vulnerabilities

The version of the remote NTP server is 3.x or 4.x prior to 4.2.8p2. It is, therefore, affected by the following vulnerabilities : - The symmetric-key feature in the receive function requires a correct message authentication code MAC only if the MAC field has a nonzero length. A man-in-the-middle...

SUSE SLED12 / SLES12 Security Update : postgresql93 (SUSE-SU-2015:0478-1)

postgresql93 was updated to version 9.3.6 to fix four security issues. These security issues were fixed : - CVE-2015-0241: Fix buffer overruns in tochar bnc916953. - CVE-2015-0243: Fix buffer overruns in contrib/pgcrypto bnc916953. - CVE-2015-0244: Fix possible loss of frontend/backend protocol...

Possible Issues With Cloud Storages After Restore

Challenge After restoring a machine that was using cloud synchronization software OneDrive, Dropbox, Google Drive, etc., issues are possible when that software attempts synchronization with its service. Those cloud sync solutions may see the restored files as updated changes that need to be...

[SECURITY] Fedora 21 Update: ntp-4.2.6p5-30.fc21

The Network Time Protocol NTP is used to synchronize a computer's time with another reference time source. This package includes ntpd a daemon which continuously adjusts system time and utilities used to query and configure the ntpd daemon. Perl scripts ntp-wait and ntptrace are in the ntp-perl...

MGASA-2015-0163 Updated chrony packages fix security vulnerabilities

Updated chrony package fixes security vulnerabilities: Using particular address/subnet pairs when configuring access control would cause an invalid memory write. This could allow attackers to cause a denial of service crash or execute arbitrary code CVE-2015-1821. When allocating memory to save...

[SECURITY] Fedora 22 Update: ntp-4.2.6p5-30.fc22

The Network Time Protocol NTP is used to synchronize a computer's time with another reference time source. This package includes ntpd a daemon which continuously adjusts system time and utilities used to query and configure the ntpd daemon. Perl scripts ntp-wait and ntptrace are in the ntp-perl...

postgresql: loss of frontend/backend protocol synchronization after an error

A flaw was found in the way PostgreSQL handled certain errors that were generated during protocol synchronization. An authenticated database user could use this flaw to inject queries into an existing connection...

Updated ntp packages fix security vulnerabilities

Updated ntp packages fix security vulnerabilities: The symmetric-key feature in the receive function in ntpproto.c in ntpd in NTP before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting th...

Medium: postgresql8

Issue Overview: An information leak flaw was found in the way the PostgreSQL database server handled certain error messages. An authenticated database user could possibly obtain the results of a query they did not have privileges to execute by observing the constraint violation error messages...

Debian Security Advisory DSA 3222-1 (chrony - security update)

Miroslav Lichvar of Red Hat discovered multiple vulnerabilities in chrony, an alternative NTP client and server: CVE-2015-1821 Using particular address/subnet pairs when configuring access control would cause an invalid memory write. This could allow attackers to cause a denial of service crash o...

NTP Symmetric Key Authentication Security Vulnerabilities Patched

NTP, the much maligned protocol abused in a number of high volume DDoS attacks a year ago, is suffering from newly patched vulnerabilities that could allow an attacker to send unauthenticated packets to a client that would be executed. The Department of Homeland Security and CERT at the Software...

CVE-2015-1799

The symmetric-key feature in the receive function in ntpproto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2 performs state-variable updates upon receiving certain invalid packets, which makes it easier for man-in-the-middle attackers to cause a denial of service synchronization loss by spoofing the...