Vulnerability in OpenSSL CVE-2013-4353

A carefully crafted invalid TLS handshake could crash OpenSSL with a NULL pointer exception. A malicious server could use this flaw to crash a connecting client. This issue only affected OpenSSL 1.0.1 versions...

IBM Content Manager OnDemand for Multiplatform SSLv2会话恢复处理远程拒绝服务漏

CVE ID:CVE-2013-6329 IBM Content Manager OnDemand是一款内容管理解决方案。 IBM Content Manager OnDemand for Multiplatform处理SSL/TLS握手过程中处理SSlv2会话恢复存在安全漏洞，允许远程攻击者利用漏洞提交特殊的请求使应用程序崩溃，造成拒绝服务攻击。 0 IBM Content Manager OnDemand for Multiplatform 8.5 IBM Content Manager OnDemand for Multiplatform 9.0 厂商补丁： IBM -----...

OpenJDK: CPU consumption DoS via repeated SSL ClientHello packets (JSSE, 7192393)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.240 and earlier, and OpenJDK 7, allows remote attackers to affect availability via vectors related to JSSE. NOTE: the previous...

MGASA-2013-0290 Updated polarssl package fixes security vulnerabilities

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in PolarSSL before 1.2.6, does not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and...

Updated polarssl package fixes security vulnerabilities

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in PolarSSL before 1.2.6, does not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and...

OpenJDK: CPU consumption DoS via repeated SSL ClientHello packets (JSSE, 7192393)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.240 and earlier, and OpenJDK 7, allows remote attackers to affect availability via vectors related to JSSE. NOTE: the previous...

IBM Tivoli Directory Server TLS NULL Cipher (uncredentialed check)

The IBM Tivoli Directory Server hosted on the remote host supports TLS NULL-MD5 or NULLSHA ciphers. This allows remote, unauthenticated attackers to trigger unencrypted communication via the TLS handshake protocol. Note that this version of Directory Server likely has other vulnerabilities i.e.,...

IBM WebSphere Application Server远程拒绝服务漏洞

BUGTRAQ ID: 55185 CVE ID: CVE-2012-2190 IBM WebSphere Application Server WAS是由IBM遵照开放标准开发并发行的一种应用服务器。 IBM WebSphere Application Server WAS 6.1.0.45之前的6.1.x、7.0.0.25之前的7.0.x、8.0.0.4之前的8.0.x、8.5.0.1之前的8.5.x中，IBM HTTP Server内使用的IBM Global Security Kit...

CVE-2012-2190

IBM Global Security Kit aka GSKit, as used in IBM HTTP Server in IBM WebSphere Application Server WAS 6.1.x before 6.1.0.45, 7.0.x before 7.0.0.25, 8.0.x before 8.0.0.4, and 8.5.x before 8.5.0.1, allows remote attackers to cause a denial of service daemon crash via a crafted ClientHello message i...

Design/Logic Flaw

IBM Global Security Kit aka GSKit, as used in IBM HTTP Server in IBM WebSphere Application Server WAS 6.1.x before 6.1.0.45, 7.0.x before 7.0.0.25, 8.0.x before 8.0.0.4, and 8.5.x before 8.5.0.1, allows remote attackers to cause a denial of service daemon crash via a crafted ClientHello message i...

CVE-2012-2190

The provided connected sources confirm CVE-2012-2190 (TLS ClientHello crafted message causing DoS/daemon crash), CVE-2012-2191 (Vaudenay SSL CBC timing issue), and CVE-2012-2203 (PKCS#12 without integrity) involve IBM GSKit in multiple IBM products (WebSphere Application Server/IBM HTTP Server, I...

CVE-2012-2190

IBM Global Security Kit aka GSKit, as used in IBM HTTP Server in IBM WebSphere Application Server WAS 6.1.x before 6.1.0.45, 7.0.x before 7.0.0.25, 8.0.x before 8.0.0.4, and 8.5.x before 8.5.0.1, allows remote attackers to cause a denial of service daemon crash via a crafted ClientHello message i...

CVE-2012-2190: Undefined Security Weakness

IBM Global Security Kit aka GSKit, as used in IBM HTTP Server in IBM WebSphere Application Server WAS 6.1.x before 6.1.0.45, 7.0.x before 7.0.0.25, 8.0.x before 8.0.0.4, and 8.5.x before 8.5.0.1, allows remote attackers to cause a denial of service daemon crash via a crafted ClientHello message i...

Scientific Linux Security Update : openssl on SL4.x i386/x86_64 (20120201)

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocols, as well as a full-strength, general purpose cryptography library. An information leak flaw was found in the SSL 3.0 protocol implementation in OpenSSL. Incorrect initialization o...

Scientific Linux Security Update : jdk (java) on SL5.x i386/x86_64

A flaw in the applet caching mechanism of the Java Runtime Environment JRE did not correctly process the creation of network connections. A remote attacker could use this flaw to create connections to services on machines other than the one that the applet was downloaded from. CVE-2007-5232...

Default configuration

The default configuration of TLS in IBM Tivoli Directory Server TDS 6.3 and earlier supports the 1 NULL-MD5 and 2 NULL-SHA ciphers, which allows remote attackers to trigger unencrypted communication via the TLS Handshake Protocol...

CVE-2012-0726: Undefined Security Weakness

The default configuration of TLS in IBM Tivoli Directory Server TDS 6.3 and earlier supports the 1 NULL-MD5 and 2 NULL-SHA ciphers, which allows remote attackers to trigger unencrypted communication via the TLS Handshake Protocol...

OpenSSL < 0.9.6m / 0.9.7d Denial of Service

According to its banner, the remote server is running a version of OpenSSL that is earlier than 0.9.6m or 0.9.7d. A remote attacker can crash the server by sending an overly long Kerberos ticket or a crafted SSL/TLS handshake. C Tenable Network Security, Inc. include"compat.inc"; if description...

OpenSSL 0.9.8f < 0.9.8h Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 0.9.8h. It is, therefore, affected by multiple vulnerabilities as referenced in the 0.9.8h advisory. - OpenSSL 0.9.8f and 0.9.8g allows remote attackers to cause a denial of service crash via a TLS handshake that omits the Server Key...

Moderate: Red Hat Security Advisory: openssl security, bug fix, and enhancement update

Updated openssl packages that fix one security issue, two bugs, and add two enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which give...