openSUSE Security Update : openSUSE-2014- (openSUSE-2014--1)

MozillaFirefox was updated to version 31 to fix various security issues and bugs : - MFSA 2014-56/CVE-2014-1547/CVE-2014-1548 Miscellaneous memory safety hazards - MFSA 2014-57/CVE-2014-1549 bmo1020205 Buffer overflow during Web Audio buffering for playback - MFSA 2014-58/CVE-2014-1550 bmo1020411...

Mac OSX Server DirectoryService Buffer Overflow

No description provided by source. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Mac OSX Server DirectoryService buffer overflow 1. Advisory Information Title: Mac OSX Server DirectoryService buffer overflow Advisory ID: CORE-2013-0103 Advisory URL:...

Student Decrypts Simplocker Android Ransomware that Encrypts Files

In a previous story, I reported about a new ransomware threat known as Simplocker discovered by researchers at the security firm ESET, targeting Android users in the UK, Switzerland, Germany, India and Russia, for ransom. Simplocker Android/Simplocker.A is the latest Android ransomware that has...

openSUSE Security Update : openssh (openSUSE-SU-2013:1726-1)

openssh was updated to fix a memory corruption when AES-GCM is used which could lead to remote code execution after successful authentication. CVE-2013-4548 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...

openSUSE Security Update : mozilla-nss (openSUSE-SU-2013:1539-1)

Mozilla NSS was updated to 3.15.2 bnc842979 - Support for AES-GCM ciphersuites that use the SHA-256 PRF - MD2, MD4, and MD5 signatures are no longer accepted for OCSP or CRLs - Add PK11CipherFinal macro - sizeof used incorrectly - nssutilReadSecmodDB leaks memory - Allow...

openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2013:0377-1)

java-170-openjdk was updated to icedtea-2.3.6 bnc803379 containing various security and bugfixes : - Security fixes - S6563318, CVE-2013-0424: RMI data sanitization - S6664509, CVE-2013-0425: Add logging context - S6664528, CVE-2013-0426: Find log level matching its name or value given at...

Android Ransomware First to Encrypt Data on Mobile Devices

A strain of ransomware that encrypts data on Android mobile devices, the first of its kind, has spread to 13 countries since it was first spotted less than a month ago. Researchers at Kaspersky Lab today disclosed details on Pletor, an expensive Trojan that popped up on an underground forum selli...

New Ransomware Malware takes Advantage of Windows PowerShell

Ransomware is one of the most blatant and obvious money making schemes for cybercriminals and it was most likely to be known when last year Cryptolocker ransomware targeted millions of computers worldwide. Recently, security researchers at the Antivirus firm TrendLabs have unearthed another...

Ruby OpenSSL CA private key forgery vulnerability-vulnerability warning-the black bar safety net

The Ruby OpenSSL CA private key forgery vulnerability require ‘rubygems’ require ‘openssl’ require 'digest/md5' key = OpenSSL::PKey::RSA. new2 0 4 8 cipher = OpenSSL::Cipher::AES. new2 5 6, :CBC ctx = OpenSSL::SSL::SSLContext. new puts “Spoof must be in DER format and saved as root. cer” raw =...

mRemote Offline Password Decrypt

mRemote Offline Password Decrypt Based on Metasploit Module enummremotepwds.rb from David Maloney Autor: Adriano Marcio Monteiro E-mail: [email protected] Blog: adrianomarciomonteiro.blogspot.com.br Usage: ruby mRemoteOffPwdsDecrypt.rb confCons.xml require 'rexml/document' require...

Ruby OpenSSL CA私钥伪造漏洞

Bugtraq ID:66956 CVE ID:CVE-2014-2734 Yukihiro Matsumoto Ruby是一款功能强大的面向对象的脚本语言。 Yukihiro Matsumoto Ruby OpenSSL存在一个安全漏洞，允许攻击者利用漏洞伪造CA私钥。 0 Ruby 目前没有详细解决方案： http://www.ruby-lang.org/ require 'rubygems' require 'openssl' require 'digest/md5' key = OpenSSL::PKey::RSA.new2048 cipher =...

BlackBerry Z10 qconnDoor服务报文AES加密处理远程缓冲区溢出漏洞

CVE ID:CVE-2014-2389 BlackBerry Z10是黑莓智能手机运行的操作系统。 BlackBerry Z10 qconnDoor服务存在溢出漏洞，当用户提交的特制报文中，包含对数据负载进行AES加密的命令代码时，通过指定非法的加解密负载长度时可触发该漏洞，允许攻击者利用漏洞使应用程序崩溃或可执行任意代码。 0 BlackBerry Z10 10.1.0.2312 目前厂商已经发布了升级补丁以修复漏洞，请下载使用： http://www.blackberry.com/btsc/KB35816...

BlackBerry Z 10 Buffer Overflow Vulnerability

BlackBerry Z 10 suffers from a remotely exploitable buffer overflow in qconnDoor. BlackBerry Z 10 Buffer Overflow Vulnerability 1. Timeline --------------------------------------------------------------------- 2013-06-23: Vendor has been contacted. 2013-06-24: Vendor response. 2013-06-27: Vendor...

OpenSSL Heartbeat (Heartbleed) Client Memory Exposure

This module provides a fake SSL service that is intended to leak memory from client systems as they connect. This module is hardcoded for using the AES-128-CBC-SHA1 cipher. Module Options msf use auxiliary/server/openssl/heartbeatclientmemory msf undefinedheartbeatclientmemory show actions...

PowerArchiver 14.02.03 Incorrect PKZIP Encryption Usage

The remote host has PowerArchiver version 14.02.03 installed. It is, therefore, affected by a flaw with the encryption usage. A flaw exists in the application where the insecure PKZIP encryption method is used when a user attempts to encrypt files with AES 256-bit encryption. Note that Nessus has...

AIX OpenSSH Vulnerability : openssh_advisory3.asc

The mmnewkeysfromblob function in monitorwrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a MAC context data structure, which allows remote authenticated users to bypass intended ForceCommand and login-shell restrictions via packet dat...

PowerArchiver: Uses insecure legacy PKZIP encryption when AES is selected (CVE-2014-2319)

PowerArchiver: Uses insecure legacy PKZIP encryption when AES is selected CVE-2014-2319 References https://vulners.com/cve/CVE-2014-2319 http://int21.de/cve/CVE-2014-2319-powerarchiver.html http://www.powerarchiver.com/2014/03/12/powerarchiver-2013-14-02-05-released/ Background...

ConeXware PowerArchiver弱加密漏洞

Bugtraq ID:66174 CVE ID:CVE-2014-2319 ConeXware PowerArchiver是一款压缩工具。 如果在GUI中用户选择AES加密，ConeXware PowerArchiver会以不安全加密方法来创建文件。如选择"AES 256-bit"进行加密软件会使用PKZIP加密来代替。 0 ConeXware PowerArchiver 14.02.03 ConeXware PowerArchiver 14.02.05已经修复该漏洞，建议用户下载更新： http://www.powerarchiver.com...

CVE-2014-2319

The Encrypt Files feature in ConeXware PowerArchiver before 14.02.05 uses legacy ZIP encryption even if the AES 256-bit selection is chosen, which makes it easier for context-dependent attackers to obtain sensitive information via a known-plaintext attack...

CVE-2014-2319

The Encrypt Files feature in ConeXware PowerArchiver before 14.02.05 uses legacy ZIP encryption even if the AES 256-bit selection is chosen, which makes it easier for context-dependent attackers to obtain sensitive information via a known-plaintext attack...