deprecate MD2 in SSL cert validation (Kaminsky)

The Network Security Services NSS library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash...

deprecate MD2 in SSL cert validation (Kaminsky)

The Network Security Services NSS library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash...

Ubuntu USN-805-1 (ruby1.9)

The remote host is missing an update to ruby1.9 announced via advisory USN-805-1. OpenVAS Vulnerability Test $Id: ubuntu8051.nasl 7969 2017-12-01 09:23:16Z santu $ $Id: ubuntu8051.nasl 7969 2017-12-01 09:23:16Z santu $ Description: Auto-generated from advisory USN-805-1 ruby1.9 Authors: Thomas...

Ubuntu: Security Advisory (USN-805-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

VMSA-2009-0004 : ESX Service Console updates for openssl, bind, and vim

a. Updated OpenSSL package for the Service Console fixes a security issue. OpenSSL 0.9.7a-33.24 and earlier does not properly check the return value from the EVPVerifyFinal function, which could allow a remote attacker to bypass validation of the certificate chain via a malformed SSL/TLS signatur...

Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : ruby1.8, ruby1.9 vulnerabilities (USN-805-1)

It was discovered that Ruby did not properly validate certificates. An attacker could exploit this and present invalid or revoked X.509 certificates. CVE-2009-0642 It was discovered that Ruby did not properly handle string arguments that represent large numbers. An attacker could exploit this and...

openSUSE Security Update : gnutls (gnutls-858)

This update of gnutls immproves the certificate validation process of gnutls-cli, prior gnutls-cli allowed man-in-the-middle attacks only Gnus seems to use this tool. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Gizmo5 <= 3.1.0.79 SSL Certificate Validation Security Bypass Vulnerability - Linux

Gizmo5 is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MySQL Connector/NET缺少SSL证书验证漏洞

BUGTRAQ ID: 35514 MySQL Connector/Net是MySQL数据库的ADO.NET驱动。 MySQL Connector/Net在使用加密的时候没有对服务器的证书执行验证。在NativeDriver.cs文件中，StartSSL函数依赖于名为 NoServerCheckValidation的验证函数，而该函数没有执行任何验证。此外还有另一个名为ServerCheckValidation 的函数，而该函数被标注掉。 能够对连接执行中间人攻击的攻击者可以通过利用这个漏洞绕过加密验证，从而破坏SSL所提供的安全性。 MySQL AB MySQL Connector/N...

CVE-2009-1682

CVE-2009-1682 affects Apple Safari before 4.0. The issue is that EV certificate revocation checks are not performed properly, making it easier for remote attackers to trick users into accepting an invalid certificate. Connected sources corroborate the vulnerability in Safari/WebKit and note a ven...

Mandrake Security Advisory MDVSA-2009:116 (gnutls)

The remote host is missing an update to gnutls announced via advisory MDVSA-2009:116. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

gnutls multiple security vulnerabilities

DoS, certificate validation vulnerabilities...

CVE-2009-0161

CVE-2009-0161 affects Apple Mac OS X 10.5 before 10.5.7, specifically the Ruby OpenSSL OCSP module. The issue stems from incomplete error checking in OpenSSL’s OCSP handling, which may cause an invalid OCSP response to be treated as valid, potentially allowing certificate spoofing via a revoked c...

CVE-2009-1417

CVE-2009-1417 concerns gnutls-cli in GnuTLS prior to 2.6.6, where the time checks for X.509 certificates are not performed in _gnutls_x509_verify_certificate. This allows a remote attacker to present a certificate that is not yet valid or has expired, with downstream impact on affected apps (Exim...

Mandriva Linux Security Advisory : openssl (MDVSA-2009:001)

A vulnerability was found by the Google Security Team with how OpenSSL checked the verification of certificates. An attacker in control of a malicious server or able to effect a man-in-the-middle attack, could present a malformed SSL/TLS signature from a certificate chain to a vulnerable client,...

Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : gnutls12, gnutls13, gnutls26 regression (USN-678-2)

USN-678-1 fixed a vulnerability in GnuTLS. The upstream patch introduced a regression when validating certain certificate chains that would report valid certificates as untrusted. This update fixes the problem. We apologize for the inconvenience. Martin von Gagern discovered that GnuTLS did not...

CentOS 4 : ruby (CESA-2007:0961)

Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ruby is an interpreted scripting language for object-oriented programming. A flaw was...

Mandriva Linux Security Advisory : ntp (MDVSA-2009:007)

A flaw was found in how NTP checked the return value of signature verification. A remote attacker could use this to bypass certificate validation by using a malformed SSL/TLS signature CVE-2009-0021. The updated packages have been patched to prevent this issue. %NASLMINLEVEL 70300 C Tenable Netwo...

Microsoft WinHTTP服务证书验证漏洞（MS09-013）

BUGTRAQ ID: 34437 CVECAN ID: CVE-2009-0089 Microsoft Windows是微软发布的非常流行的操作系统。 当应用程序调用Windows HTTP服务与远程Web服务器创建连接时，WinHTTP仅对主机试图连接的原始站点的证书验证URL是否为完全合格的域名，特定的DNS欺骗攻击可能将连接转发到拥有该特定主机有效证书但不是WinHTTP初始化连接所到页面有效证书的不同Web服务器上，这可能导致WinHTTP错误的认为远程 Web服务器的证书为可接受。由于WinHTTP的用户交互依赖于应用程序，因此用户可能不会得到上述差异的警告。 Microso...

PT-2009-2789 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the fixed version Description: A spoofing issue exists due to incomplete validation of the distinguished name in a digital certificate. This can be combined with other attacks, such as DNS spoofing, allowin...