CURL-CVE-2011-3389 SSL CBC IV vulnerability

curl is vulnerable to a SSL CBC IV vulnerability when built to use OpenSSL for the SSL/TLS layer. This vulnerability has been identified CVE-2011-3389 aka the "BEAST" attack and is addressed by OpenSSL already as they have made a workaround to mitigate the problem. When doing so, they figured out...

SuSE 10 Security Update : IBM Java (ZYPP Patch Number 7926) (BEAST)

IBM Java 1.6.0 SR10 has been released fixing the following CVE's : - CVE-2011-3389 - CVE-2011-3516 - CVE-2011-3521 - CVE-2011-3544 - CVE-2011-3545 - CVE-2011-3546 - CVE-2011-3547 - CVE-2011-3548 - CVE-2011-3549 - CVE-2011-3550 - CVE-2011-3551 - CVE-2011-3552 - CVE-2011-3553 - CVE-2011-3554 -...

RHEL 6 : java-1.6.0-ibm (RHSA-2012:0034)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0034 advisory. The IBM Java SE version 6 release includes the IBM Java 6 Runtime Environment and the IBM Java 6 Software Development Kit. This update fixes...

HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HT...

Debian DSA-2358-1 : openjdk-6 - several vulnerabilities (BEAST)

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Java platform. This combines the two previous openjdk-6 advisories, DSA-2311-1 and DSA-2356-1. - CVE-2011-0862 Integer overflow errors in the JPEG and font parser allow untrusted code including applets to elevate it...

Debian DSA-2368-1 : lighttpd - multiple vulnerabilities (BEAST)

Several vulnerabilities have been discovered in lighttpd, a small and fast webserver with minimal memory footprint. - CVE-2011-4362 Xi Wang discovered that the base64 decoding routine which is used to decode user input during an HTTP authentication, suffers of a signedness issue when processing...

Microsoft Fixes BEAST SSL Bug in January Patch Tuesday

Microsoft on Tuesday patched the vulnerability in Windows that was exploited by the BEAST SSL attack tool developed by Juliano Rizzo and Thai Duong last year. The patch is one of several rated important that was issued by Microsoft in January’s Patch Tuesday release, and there also was a critical...

RHEL 5 : java-1.4.2-ibm (RHSA-2012:0006)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0006 advisory. - HTTPS: block-wise chosen-plaintext attack against SSL/TLS BEAST CVE-2011-3389 - Oracle/IBM JDK: unspecified vulnerability fixed in 6u29...

MS12-006: Vulnerability in SSL/TLS Could Allow Information Disclosure (2643584)

The remote host is affected by an information disclosure vulnerability, known as BEAST, in the SSL 3.0 and TLS 1.0 protocols due to a flaw in the way the initialization vector IV is selected when operating in cipher-block chaining CBC modes. A man-in-the-middle attacker can exploit this to obtain...

HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HT...

Next Microsoft Patch Tuesday include BEAST SSL fix

Next Microsoft Patch Tuesday include BEAST SSL fix Microsoft's first batch of patches for 2012 will include fixes for security vulnerabilities in the Windows operating system and Microsoft Developer Tools and Software. The patches will be released next Tuesday Jan 10, 2012 at approximately 1:00 P...

[SECURITY] [DSA 2381-] lighttpd security update

--------------------------------------------------------------------------- Debian Security Advisory DSA-2368-1 [email protected] http://www.debian.org/security/ Nico Golde Dec 20th, 2011 http://www.debian.org/security/faq -...

Microsoft Previews Massive December Security Updates: 14 Patches, Including Fixes for Duqu, BEAST

UPDATE: Microsoft will release 14 security patches next Tuesday, including fixes for security vulnerabilities exploited by the Duqu and BEAST malware. The company released its monthly Advanced Notification for the December Security Bulletin, previewing 14 separate bulletins, three of them rated...

Opera < 11.60 Multiple Vulnerabilities

Binary data 800845.prm...

Opera < 11.60 Multiple Vulnerabilities

Binary data 6105.prm...

Opera < 11.60 Multiple Vulnerabilities (BEAST)

The version of Opera installed on the remote Windows host is prior to 11.60. It is, therefore, affected by multiple vulnerabilities : - An unspecified error exists that can allow URL spoofing in the address bar. CVE-2011-4010 - Top level domain separation rules are not honored for two-letter top...

Fedora 16 : proftpd-1.3.4-1.fc16 (2011-15765)

"This update, to the current upstream stable release, includes a pair of security fixes : - Enable OpenSSL countermeasure against SSLv3/TLSv1 BEAST attacks upstream bug 3704 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

Fedora 15 : proftpd-1.3.4-1.fc15 (2011-15740)

"This update, to the current upstream stable release, includes a pair of security fixes : - Enable OpenSSL countermeasure against SSLv3/TLSv1 BEAST attacks upstream bug 3704 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

CVE-2011-3389

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HT...

GLSA-201111-02 : Oracle JRE/JDK: Multiple vulnerabilities (BEAST)

The remote host is affected by the vulnerability described in GLSA-201111-02 Oracle JRE/JDK: Multiple vulnerabilities Multiple vulnerabilities have been reported in the Oracle Java implementation. Please review the CVE identifiers referenced below and the associated Oracle Critical Patch Update...