Code injection

The SSLSocket implementation in the 1 JSAFE and 2 JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to cause a denial of service memory consumption by triggering application-data processing during the TLS handshake, a time at which the data is internal...

Design/Logic Flaw

The 1 JSAFE and 2 JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 make it easier for remote attackers to bypass intended cryptographic protection mechanisms by triggering application-data processing during the TLS handshake, a time at which the data is both unencrypted and...

CVE-2014-0625

The SSLSocket implementation in the 1 JSAFE and 2 JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to cause a denial of service memory consumption by triggering application-data processing during the TLS handshake, a time at which the data is internal...

CVE-2014-0626

The 1 JSAFE and 2 JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 make it easier for remote attackers to bypass intended cryptographic protection mechanisms by triggering application-data processing during the TLS handshake, a time at which the data is both unencrypted and...

CVE-2014-0627

The SSLEngine API implementation in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to trigger the selection of a weak cipher suite by using the wrap method during a certain incomplete-handshake state...

CVE-2014-0625

The CVE-2014-0625 issue affects RSA BSAFE SSL-J (JSAFE/JSSE) 5.x before 5.1.3 and 6.x before 6.0.2, where SSLSocket processing during TLS handshakes can buffer application data, leading to memory-based DoS. The SUSE/Security advisory and ESA-2014-009 describe a memory-denial vulnerability in the ...

CVE-2014-0626

The RSA BSAFE SSL-J vulnerability CVE-2014-0626 affects SSL-J 5.x (before 5.1.3) and 6.x (before 6.0.2). The JSAFE and JSSE APIs can process application data during the TLS handshake, exposing data unencrypted and unauthenticated and enabling potential information disclosure at handshake time. Ac...

CVE-2014-0627

Summary: CVE-2014-0627 affects EMC RSA BSAFE SSL-J (SSL-J) 5.x before 5.1.3 and 6.x before 6.0.2. The SSLEngine API can reveal information by using the wrap method after the Finished message in an incomplete handshake, potentially allowing an attacker to trigger a weak cipher suite. Impact: Infor...

PT-2014-3722

Name of the Vulnerable Software and Affected Versions EMC RSA BSAFE SSL-J versions 5.x before 5.1.3 EMC RSA BSAFE SSL-J versions 6.x before 6.0.2 Description The issue makes it easier for remote attackers to bypass intended cryptographic protection mechanisms by triggering application-data...

PT-2014-3721

Name of the Vulnerable Software and Affected Versions EMC RSA BSAFE SSL-J versions 5.x before 5.1.3 EMC RSA BSAFE SSL-J versions 6.x before 6.0.2 Description The issue allows remote attackers to cause a denial of service, specifically memory consumption, by triggering application-data processing...

PT-2014-3723

Name of the Vulnerable Software and Affected Versions EMC RSA BSAFE SSL-J versions 5.x before 5.1.3 EMC RSA BSAFE SSL-J versions 6.x before 6.0.2 Description The issue allows remote attackers to trigger the selection of a weak cipher suite by using the wrap method during a certain...

CVE-2014-0625: Undefined Security Weakness

The SSLSocket implementation in the 1 JSAFE and 2 JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to cause a denial of service memory consumption by triggering application-data processing during the TLS handshake, a time at which the data is internal...

CVE-2014-0626: Undefined Security Weakness

The 1 JSAFE and 2 JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 make it easier for remote attackers to bypass intended cryptographic protection mechanisms by triggering application-data processing during the TLS handshake, a time at which the data is both unencrypted and...

CVE-2014-0627: Undefined Security Weakness

The SSLEngine API implementation in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to trigger the selection of a weak cipher suite by using the wrap method during a certain incomplete-handshake state...

Boasting Better Encryption, Bug Fixes, OpenSSH 6.5 Released

The OpenBSD Project pushed out a new build on Thursday of the OpenSSH security suite, adding a new private key format, a new transport cipher and fixing 15 bugs in the Secure Shell. OpenSSH version 6.5 adds support for the key exchange using elliptic-curve Diffie Hellman within cryptographer Dani...

RSA Denies NSA Backdoor Payment Allegations, But Questions Linger

The accumulation of hundreds of leaked documents and formerly secret operational methods used by the NSA in the last six months has led to a bit of a numbing effect, with some new leaks being met with a shrug of indifference. But the latest and most explosive entry in that ledger–the report that...

EMC RSA BSAFE multiple security vulnerabilities

SSL-related attacks...

ESA-2013-032 RSA BSAFE® Micro Edition Suite Security Update for SSL/TLS Plaintext Recovery (aka “Lucky Thirteen”) Vulnerability

ESA-2013-032.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-032: RSA BSAFE® Micro Edition Suite Security Update for SSL/TLS Plaintext Recovery aka “Lucky Thirteen” Vulnerability EMC Identifier: ESA-2013-032 CVE Identifier: CVE-2013-0169 Severity Rating: CVSS v2 Base Score: 2.6...

ESA-2013-039: RSA BSAFE® SSL-J Multiple Vulnerabilities

ESA-2013-039.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-039: RSA BSAFE® SSL-J Multiple Vulnerabilities EMC Identifier: ESA-2013-039 CVE Identifier: CVE-2011-3389, CVE-2013-0169 Severity Rating: CVSS v2 Base Score: Refer NVD http://nvd.nist.gov/ for individual scores for each CVE...

ESA-2013-045: RSA BSAFE® SSL-C Security Update for SSL/TLS Plaintext Recovery (aka “Lucky Thirteen”) Vulnerability

ESA-2013-045.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-045: RSA BSAFE® SSL-C Security Update for SSL/TLS Plaintext Recovery aka “Lucky Thirteen” Vulnerability EMC Identifier: ESA-2013-045 CVE Identifier: CVE-2013-0169 Severity Rating: CVSS v2 Base Score: 2.6...