*.com accepted as wildcard match in SSL/TLS name matching

Certificate authorities are expected to vet all certificate registrations, but may fail to prevent fraudulent or erroneous registrations. Certificates which use a wild card immediately before the top level domain, or nulls in the domain name, may pass validation checks in Opera. Sites using such...

Mozilla Foundation Security Advisory 2009-42

Mozilla Foundation Security Advisory 2009-42 Title: Compromise of SSL-protected communication Impact: Critical Announced: August 1, 2009 Reporter: Dan Kaminsky Products: Firefox, Thunderbird, SeaMonkey, NSS Fixed in: Firefox 3.5 NSS 3.12.3 Description IOActive security researcher Dan Kaminsky...

Compromise of SSL-protected communication — Mozilla

IOActive security researcher Dan Kaminsky reported a mismatch in the treatment of domain names in SSL certificates between SSL clients and the Certificate Authorities CA which issue server certificates. In particular, if a malicious person requested a certificate for a host name with an invalid...

Sensitive DHS platform hacked

From Federal Computer Week Ben Bain Attackers have penetrated a network that the Department of Homeland Security uses to share sensitive information with state and local authorities, gaining access to important, but unclassified, data. The attack began in March and occurred again a few weeks late...

MD5 vulnerable to collision attacks

Overview Weaknesses in the MD5 algorithm allow for collisions in output. As a result, attackers can generate cryptographic tokens or other data that illegitimately appear to be authentic. Description A secure cryptographic hash algorithm is one that generates a unique identifier of a fixed size...

CVE-2003-1437

BEA WebLogic Express and WebLogic Server 7.0 and 7.0.0.1, stores passwords in plaintext when a keystore is used to store a private key or trust certificate authorities, which allows local users to gain access...

PMB Services <= 3.0.13 Multiple Remote File Inclusion Vulnerability

No description provided by source. \ /\ / | \ | / // / | | \ \ Y / | / / \ /\| /\ / / / / / .OR.ID ECHOADV68$2007 ----------------------------------------------------------------------------------------- ECHOADV68$2007 PMB Services = 3.0.13 Multiple Remote File Inclusion Vulnerability...

PMB Services 3.0.13 - Multiple Remote File Inclusions

PMB Services 3.0.13 - Multiple Remote File Inclusions \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV68$2007 ----------------------------------------------------------------------------------------- ECHOADV68$2007 PMB Services = 3.0.13 Multiple Remote File...

PMB Services 3.0.13 - Multiple Remote File Inclusions

\ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV68$2007 ----------------------------------------------------------------------------------------- ECHOADV68$2007 PMB Services = 3.0.13 Multiple Remote File Inclusion Vulnerability...

GLSA-200610-06 : Mozilla Network Security Service (NSS): RSA signature forgery

The remote host is affected by the vulnerability described in GLSA-200610-06 Mozilla Network Security Service NSS: RSA signature forgery Daniel Bleichenbacher discovered that it might be possible to forge signatures signed by RSA keys with the exponent of 3. This affects a number of RSA signature...

Mozilla Network Security Service (NSS): RSA signature forgery

Background The Mozilla Network Security Service is a library implementing security features like SSL v.2/v.3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME and X.509 certificates. Description Daniel Bleichenbacher discovered that it might be possible to forge signatures signed by RSA keys with th...

seamonkey security update

CentOS Errata and Security Advisory CESA-2006:0676-01 Updated seamonkey packages that fix several security bugs are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open...

OpenSSL RSA Signature Forgery Vulnerability

OpenSSL versions 0.9.7j and prior and 0.9.8b and prior contain a vulnerability that could allow an unauthenticated, remote attacker to successfully pass a forged X.509 certificate. The vulnerability could allow an unauthenticated, remote attacker to pass a forged Public-Key Cryptography Standards...

CVE-2006-3417

Tor client before 0.1.1.20 prefers entry points based on isfast or isstable flags, which could allow remote attackers to be preferred over nodes that are identified as more trustworthy "entry guard" isguard systems by directory authorities...

CVE-2006-3417

Tor client before 0.1.1.20 is vulnerable: the client may prefer directory entry points based on is_fast or is_stable flags instead of more trustworthy entry guards identified by authorities. Affected product: Tor client (pre-0.1.1.20). Root cause: selection bias in entry point ranking due to the ...

CVE-2006-3417

Tor client before 0.1.1.20 prefers entry points based on isfast or isstable flags, which could allow remote attackers to be preferred over nodes that are identified as more trustworthy "entry guard" isguard systems by directory authorities...

CVE-2006-3417

Tor client before 0.1.1.20 prefers entry points based on isfast or isstable flags, which could allow remote attackers to be preferred over nodes that are identified as more trustworthy "entry guard" isguard systems by directory authorities...

Full Disclosure: Windows File Protection Arbitrary Certificate Chain Vulnerability

============================================================================ == SECURITY ALERT Windows File Protection Arbitrary Certificate Chain Vulnerability December 26, 2002 Full Disclosure, [email protected] and others December 24, 2002 Private Disclosure Jason Coombs [email protected]...

Shaft Trojan Detection

The remote host appears to be running Shaft, which is a trojan that can be used to control your system or make it attack another network this is actually called a distributed denial of service attack tool. It is very likely that this host has been compromised %NASLMINLEVEL 70300 C Tenable Network...