CVE-2010-3074

SSLCipher.cpp in EncFS before 1.7.0 uses an improper combination of an AES cipher and a CBC cipher mode for encrypted filesystems, which allows local users to obtain sensitive information via a watermark attack...

Fedora 11 : krb5-1.6.3-23.fc11 (2010-0515)

This update incorporates fixes from upstream which correct integer underflow problems in the AES and RC4 decryption routines CVE-2009-4212. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

Adobe Flash Reader - Live Malware

Adobe Flash Reader - Live Malware Exploit-DB Note - Live POC originally found at http://qoop.org/security/poc/cve-2010-1297/ File is malicious! Taken from the wild! Beware! To decrypt the file: openssl aes-256-cbc -d -a -in adobe-0day-2010-1297.tar.enc -out adobe-0day-2010-1297.tar Password is...

RSA 2010: Experts Expect Several Ciphers to Be Cracked Soon

Cryptographers are expecting several of the major cryptographic systems in use today to be broken in the near future. In the Cryptographers Panel session at the RSA Conference Tuesday, Adi Shamir said that he is working with a team of researchers who have put together a paper that describes an...

Debian DSA-1969-1 : krb5 - integer underflow

It was discovered that krb5, a system for authenticating users and services on a network, is prone to integer underflow in the AES and RC4 decryption operations of the crypto library. A remote attacker can cause crashes, heap corruption, or, under extraordinarily unlikely conditions, arbitrary co...

JDownloader Remote Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Product JDownloader1 is an open source download manager for One-Click- Filehoster like Rapidshare or Megaupload. The Click'n'Load2 interface allows external applications and websites to send URLs to the local running JDownloader. With Click'n'Loa...

JDownloader Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Product JDownloader1 is an open source download manager for One-Click- Filehoster like Rapidshare or Megaupload. The Click'n'Load2 interface allows external applications and websites to send URLs to the local running JDownloader. With Click'n'Loa...

SuSE Update for krb5 SUSE-SA:2010:006

Check for the Version of krb5 OpenVAS Vulnerability Test SuSE Update for krb5 SUSE-SA:2010:006 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of t...

openSUSE Security Update : krb5 (krb5-1792)

Specially crafted ticket requests could crash the kerberos server CVE-2009-3295. Specially crafted AES and RC4 packets could allow unauthenticated remote attackers to trigger an integer underflow that leads to heap memory corruption CVE-2009-4212. %NASLMINLEVEL 70300 C Tenable Network Security,...

openSUSE Security Update : krb5 (krb5-1795)

Specially crafted AES and RC4 packets could allow unauthenticated remote attackers to trigger an integer overflow leads to heap memory corruption CVE-2009-4212. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...

SuSE 10 Security Update : Kerberos 5 (ZYPP Patch Number 6775)

Specially crafted AES and RC4 packets could allow unauthenticated remote attackers to trigger an integer overflow leads to heap memory corruption CVE-2009-4212. This has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

Mandriva Update for krb5 MDVSA-2010:006 (krb5)

Check for the Version of krb5 OpenVAS Vulnerability Test Mandriva Update for krb5 MDVSA-2010:006 krb5 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

CentOS Update for krb5-devel CESA-2010:0029 centos3 i386

Check for the Version of krb5-devel OpenVAS Vulnerability Test CentOS Update for krb5-devel CESA-2010:0029 centos3 i386 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modif...

MIT's Kerberos 5 Patched

A patch for the MIT’s Kerberos 5 implementation is to fix integer underflows in the functions for decrypting AES and RC4 ciphertexts. Read the full article. The H Security...

MIT Kerberos 5 integer overflows

Integer overflows on RC4 and AES decription...

MITKRB5-SA-2009-004 [CVE-2009-4212] integer underflow in AES and RC4 decryption

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 MITKRB5-SA-2009-004 MIT krb5 Security Advisory 2009-004 Original release: 2010-01-12 Topic: integer underflow in AES and RC4 decryption CVE-2009-4212 integer underflow in AES and RC4 decryption CVSSv2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:...

CVE-2009-4212

Multiple integer underflows in the 1 AES and 2 RC4 decryption functionality in the crypto library in MIT Kerberos 5 aka krb5 1.3 through 1.6.3, and 1.7 before 1.7.1, allow remote attackers to cause a denial of service daemon crash or possibly execute arbitrary code by providing ciphertext with a...

Integer overflow

Multiple integer underflows in the 1 AES and 2 RC4 decryption functionality in the crypto library in MIT Kerberos 5 aka krb5 1.3 through 1.6.3, and 1.7 before 1.7.1, allow remote attackers to cause a denial of service daemon crash or possibly execute arbitrary code by providing ciphertext with a...

CVE-2009-4212

Multiple integer underflows in the 1 AES and 2 RC4 decryption functionality in the crypto library in MIT Kerberos 5 aka krb5 1.3 through 1.6.3, and 1.7 before 1.7.1, allow remote attackers to cause a denial of service daemon crash or possibly execute arbitrary code by providing ciphertext with a...

CVE-2009-4212

CVE-2009-4212 affects MIT Kerberos 5 (krb5) crypto library, impacting the AES and RC4 decryption paths. Versions 1.3–1.6.3 and 1.7 before 1.7.1 are vulnerable to multiple integer underflows when processing ciphertext that is too short to be valid. This can cause a daemon crash (DoS) and, in some ...