TLS certificates can be used to execute arbitrary code – Opera Security Advisories

TLS certificates can be used to execute arbitrary code – Opera Security Advisories OPCOM Team | February 13, 2009 Severity Highly Severe Problem Description When connecting to a TLS-protected website, Opera parses the X.509 certificate. If a site uses a specially crafted Subject Alternative Name ...

kernel: sctp: Fix oops when INIT-ACK indicates that peer doesn't support AUTH

sctp in Linux kernel before 2.6.25.18 allows remote attackers to cause a denial of service OOPS via an INIT-ACK that states the peer does not support AUTH, which causes the sctpprocessinit function to clean up active transports and triggers the OOPS when the T1-Init timer expires...

[SECURITY] Fedora 10 Update: gnutls-2.4.2-3.fc10

GnuTLS is a project that aims to develop a library which provides a secure layer, over a reliable transport layer. Currently the GnuTLS library implem ents the proposed standards by the IETF's TLS working group...

CVE-2008-5179

Unspecified vulnerability in Microsoft Office Communications Server OCS, Office Communicator, and Windows Live Messenger allows remote attackers to cause a denial of service crash via a crafted Real-time Transport Control Protocol RTCP receiver report packet...

CVE-2008-5179

Unspecified vulnerability in Microsoft Office Communications Server OCS, Office Communicator, and Windows Live Messenger allows remote attackers to cause a denial of service crash via a crafted Real-time Transport Control Protocol RTCP receiver report packet...

MS Windows Server Service Code Execution Exploit (MS08-067) (2k/2k3)

No description provided by source. !/usr/bin/env python MS08-067 Exploit by Debasis Mohanty aka Tr0y/nopsled www.hackingspirits.com www.coffeeandsecurity.com Email: d3basis.m0hanty @ gmail.com import struct import sys from threading import Thread Thread is imported incase you would like to modify...

[SECURITY] Fedora 8 Update: gnutls-1.6.3-5.fc8

GnuTLS is a project that aims to develop a library which provides a secure layer, over a reliable transport layer. Currently the GnuTLS library implem ents the proposed standards by the IETF's TLS working group...

IBM WebSphere应用服务器拒绝服务及绕过安全限制漏洞

BUGTRAQ ID: 31839 CVECAN ID: CVE-2008-4678,CVE-2008-4679 IBM Websphere应用服务器以Java和Servlet引擎为基础，支持多种HTTP服务，可帮助用户完成从开发、发布到维护交互式的动态网站的所有工作。 IBM WebSphere应用服务器的HTTP Transport组件中的HTTPRequestParser方式没有正确地验证用户所提交的HTTP请求。如果远程攻击者在请求中包含有超长的HTTP Host头的话，就可能导致拒绝服务（0C4控制器异常结束和应用程序挂起）。 如果将Certificate Store...

CVE-2008-4678

The HTTPRequestParser method in the HTTP Transport component in IBM WebSphere Application Server WAS 6.0.2 before 6.0.2.31 allows remote attackers to cause a denial of service controller 0C4 abend and application hang via a long HTTP Host header, related to "storage overlay" on the stack and a...

[SECURITY] Fedora 9 Update: postfix-2.5.5-1.fc9

Postfix is a Mail Transport Agent MTA, supporting LDAP, SMTP AUTH SASL, TLS...

FreeBSD Security Advisory (FreeBSD-SA-05:21.openssl.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-05:21.openssl.asc ADV FreeBSD-SA-05:21.openssl.asc OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008...

libxine -- multiple buffer overflows in RTSP

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

tomcat5 SSO cookie login information disclosure

The SingleSignOn Valve org.apache.catalina.authenticator.SingleSignOn in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

CA-ArcServe

CA ArcServe is prone to a remote buffer overflow because it fails to perform adequate boundary-checks on user-supplied data. Successfully exploiting will allow an attacker to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a...

Design/Logic Flaw

Cisco Adaptive Security Appliance ASA and Cisco PIX security appliance 8.0.x before 8.039 and 8.1.x before 8.111 allows remote attackers to cause a denial of service device reload via a crafted Transport Layer Security TLS packet to the device interface...

PT-2008-3573 · Cisco · Cisco Pix Security Appliance +1

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA and Cisco PIX security appliance versions 8.0.x through 8.038 Cisco Adaptive Security Appliance ASA and Cisco PIX security appliance versions 8.1.x through 8.110 Description: The issue allows remote...

DEBIAN-CVE-2008-1672

OpenSSL 0.9.8f and 0.9.8g allows remote attackers to cause a denial of service crash via a TLS handshake that omits the Server Key Exchange message and uses "particular cipher suites," which triggers a NULL pointer dereference...

[SECURITY] Fedora 7 Update: gnutls-1.6.3-3.fc7

GnuTLS is a project that aims to develop a library which provides a secure layer, over a reliable transport layer. Currently the GnuTLS library implem ents the proposed standards by the IETF's TLS working group...

[SECURITY] Fedora 8 Update: gnutls-1.6.3-3.fc8

GnuTLS is a project that aims to develop a library which provides a secure layer, over a reliable transport layer. Currently the GnuTLS library implem ents the proposed standards by the IETF's TLS working group...

GNUTLS-SA-2008-1-2 GnuTLS null-pointer dereference

The gnutlsrecvclientkxmessage function in lib/gnutlskx.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to process Client Hello messages within a TLS message after one has already been processed, which allows remote attackers to cause a denial of service NULL dereference and crash v...