EUVD-2015-5908

Malware in sbrugna...

X (Formerly Twitter): HTTPS is not validating TLS mac codes

https://twitterflightschool.com is prone to POODLE and also a stronger variant of POODLE which allows a MITM attacker to actively decrypt bytes from an HTTPS request. This attack is possible because the device terminating this TLS connection responds differently to a bad record mac when the last...

CVE-2015-5965: Improper Input Validation

The SSL-VPN feature in Fortinet FortiOS before 4.3.13 only checks the first byte of the TLS MAC in finished messages, which makes it easier for remote attackers to spoof encrypted content via a crafted MAC field...

SOL16961 - TLS MAC error vulnerability

Vulnerability Recommended Actions None Acknowledgements F5 would like to acknowledge Yngve N. Pettersen of TLS Prober Labs for bringing this issue to our attention, and for following the highest standards of responsible disclosure. Supplemental Information SOL9970: Subscribing to email...

PT-2015-3365

Name of the Vulnerable Software and Affected Versions FortiOS versions prior to 4.3.13 Description The issue is related to the SSL-VPN feature, which only checks the first byte of the TLS MAC in finished messages. This makes it easier for remote attackers to spoof encrypted content via a crafted...