PSF-2013-2 ssl: NULL in subjectAltNames

The ssl.matchhostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate...

DSA-2738-1 ruby1.9.1 - several

Bulletin has no description...

Updated ruby packages fix CVE-2013-4073

A vulnerability in Ruby's SSL client that could allow man-in-the-middle attackers to spoof SSL servers via valid certificate issued by a trusted certification authority CVE-2013-4073...

FISA Court renews NSA surveillance programs exposed by Snowden

The secret Foreign Intelligence Surveillance Court FISA gave the green light to the Obama administration by renewing the government's authority Friday to continue the collection of millions of Americans' telephone records. The order by the Foreign Intelligence Surveillance Court has been in place...

AIX 6.1 TL 8 : infiniband (IV43580)

Both 'ibstat' and .arp.ib. commands have security vulnerabilities that can allow a non-privileged user to run malicious code with privileged authority. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text in the description was extracted from AIX Security Advisory infinibandadvisory.asc...

AIX 7.1 TL 0 : infiniband (IV43562)

Both 'ibstat' and .arp.ib. commands have security vulnerabilities that can allow a non-privileged user to run malicious code with privileged authority. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text in the description was extracted from AIX Security Advisory infinibandadvisory.asc...

AIX 7.1 TL 1 : infiniband (IV43756)

Both 'ibstat' and .arp.ib. commands have security vulnerabilities that can allow a non-privileged user to run malicious code with privileged authority. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text in the description was extracted from AIX Security Advisory infinibandadvisory.asc...

Oracle Linux 6 : nspr / nss / nss-util (ELSA-2012-0973)

From Red Hat Security Advisory 2012:0973 : Updated nss, nss-util, and nspr packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact...

Oracle Linux 5 : nspr / nss (ELSA-2013-0214)

From Red Hat Security Advisory 2013:0214 : Updated nss and nspr packages that fix one security issue, various bugs, and add enhancements are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Network Security...

Oracle Linux 4 : openldap (ELSA-2010-0543)

From Red Hat Security Advisory 2010:0543 : Updated openldap packages that fix two security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores,...

Oracle Linux 4 / 6 : thunderbird (ELSA-2011-1267)

From Red Hat Security Advisory 2011:1267 : An updated thunderbird package that fixes one security issue is now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having important security impact. Mozilla Thunderbird is a standalone mail...

Oracle Linux 4 : sendmail (ELSA-2011-0262)

From Red Hat Security Advisory 2011:0262 : Updated sendmail packages that fix one security issue and three bugs are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base...

Fedora 17 : ruby-1.9.3.448-31.fc17 (2013-12062)

A vulnerability was found in Ruby's SSL client that could allow man-in-the-middle attackers to spoof SSL servers via valid certificate issued by a trusted certification authority. This vulnerability has been assigned the CVE identifier CVE-2013-4073. This new update should solve this issue. Note...

Fedora 18 : ruby-1.9.3.448-31.fc18 (2013-12123)

A vulnerability was found in Ruby's SSL client that could allow man-in-the-middle attackers to spoof SSL servers via valid certificate issued by a trusted certification authority. This vulnerability has been assigned the CVE identifier CVE-2013-4073. This new update should solve this issue. Note...

Windows 7 SP1 Local Access SYSTEM Compromise

No description provided by source. Discovered by: Anastasios Monachos secuid0 - anastasiosmatgmaildotcom Vendor: Microsoft Affected Software: Windows 7 SP1 and probably other Title: Owning Windows 7 - From Recovery to "nt authority\system" - Physical Access Required See also:...

CentOS 5 : nss (CESA-2013:0214)

Updated nss and nspr packages that fix one security issue, various bugs, and add enhancements are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Network Security Services NSS is a set of libraries designe...

Windows 7 SP1 Local Access SYSTEM Compromise

Discovered by: Anastasios Monachos secuid0 - anastasiosmatgmaildotcom Vendor: Microsoft Affected Software: Windows 7 SP1 and probably other Title: Owning Windows 7 - From Recovery to "nt authority\system" - Physical Access Required See also:...

CVE-2013-4073 ruby: hostname check bypassing vulnerability in SSL client

The OpenSSL::SSL.verifycertificateidentity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows...

California issued cease and desist order against Bitcoin Foundation

The Bitcoin Foundation has received a cease-and-desist letter from the California Department of Financial Institutions, which oversees banks, credit unions, and other financial organizations operating in the state. Jon Matonis, who is a board member at the Foundation, revealed the letter on Forbe...

CVE-2013-3970

Juniper Junos Pulse Secure Access Service aka SSL VPN with IVE OS 7.0r2 through 7.0r8 and 7.1r1 through 7.1r5 and Junos Pulse Access Control Service aka UAC with UAC OS 4.1r1 through 4.1r5 include a test Certification Authority CA certificate in the Trusted Server CAs list, which makes it easier...