7962 matches found
Mandrake Security Advisory MDVSA-2009:116 (gnutls)
The remote host is missing an update to gnutls announced via advisory MDVSA-2009:116. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...
gnutls multiple security vulnerabilities
DoS, certificate validation vulnerabilities...
CVE-2009-0161
CVE-2009-0161 affects Apple Mac OS X 10.5 before 10.5.7, specifically the Ruby OpenSSL OCSP module. The issue stems from incomplete error checking in OpenSSL’s OCSP handling, which may cause an invalid OCSP response to be treated as valid, potentially allowing certificate spoofing via a revoked c...
CVE-2009-1417
CVE-2009-1417 concerns gnutls-cli in GnuTLS prior to 2.6.6, where the time checks for X.509 certificates are not performed in _gnutls_x509_verify_certificate. This allows a remote attacker to present a certificate that is not yet valid or has expired, with downstream impact on affected apps (Exim...
Mandriva Linux Security Advisory : openssl (MDVSA-2009:001)
A vulnerability was found by the Google Security Team with how OpenSSL checked the verification of certificates. An attacker in control of a malicious server or able to effect a man-in-the-middle attack, could present a malformed SSL/TLS signature from a certificate chain to a vulnerable client,...
Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : gnutls12, gnutls13, gnutls26 regression (USN-678-2)
USN-678-1 fixed a vulnerability in GnuTLS. The upstream patch introduced a regression when validating certain certificate chains that would report valid certificates as untrusted. This update fixes the problem. We apologize for the inconvenience. Martin von Gagern discovered that GnuTLS did not...
CentOS 4 : ruby (CESA-2007:0961)
Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ruby is an interpreted scripting language for object-oriented programming. A flaw was...
Mandriva Linux Security Advisory : ntp (MDVSA-2009:007)
A flaw was found in how NTP checked the return value of signature verification. A remote attacker could use this to bypass certificate validation by using a malformed SSL/TLS signature CVE-2009-0021. The updated packages have been patched to prevent this issue. %NASLMINLEVEL 70300 C Tenable Netwo...
Microsoft WinHTTP服务证书验证漏洞（MS09-013）
BUGTRAQ ID: 34437 CVECAN ID: CVE-2009-0089 Microsoft Windows是微软发布的非常流行的操作系统。 当应用程序调用Windows HTTP服务与远程Web服务器创建连接时，WinHTTP仅对主机试图连接的原始站点的证书验证URL是否为完全合格的域名，特定的DNS欺骗攻击可能将连接转发到拥有该特定主机有效证书但不是WinHTTP初始化连接所到页面有效证书的不同Web服务器上，这可能导致WinHTTP错误的认为远程 Web服务器的证书为可接受。由于WinHTTP的用户交互依赖于应用程序，因此用户可能不会得到上述差异的警告。 Microso...
PT-2009-2789 · Microsoft · Windows
Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the fixed version Description: A spoofing issue exists due to incomplete validation of the distinguished name in a digital certificate. This can be combined with other attacks, such as DNS spoofing, allowin...
Microsoft WinHTTP Server Name Mismatch Certificate Validation Security Bypass Vulnerability
Description Microsoft Windows HTTP Services WinHTTP is prone to a security-bypass vulnerability because of an error in verifying website certificates. Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further...
GLSA-200904-05 : ntp: Certificate validation error
The remote host is affected by the vulnerability described in GLSA-200904-05 ntp: Certificate validation error It has been reported that ntp incorrectly checks the return value of the EVPVerifyFinal, a vulnerability related to CVE-2008-5077 GLSA 200902-02. Impact : A remote attacker could exploit...
Gentoo Security Advisory GLSA 200904-05 (ntp)
The remote host is missing updates announced in advisory GLSA 200904-05. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...
ntp: Certificate validation error
Background ntp contains the client and daemon implementations for the Network Time Protocol. Description It has been reported that ntp incorrectly checks the return value of the EVPVerifyFinal, a vulnerability related to CVE-2008-5077 GLSA 200902-02. Impact A remote attacker could exploit this...
Ubuntu: Security Advisory (USN-675-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Gentoo Security Advisory GLSA 200902-02 (openssl)
The remote host is missing updates announced in advisory GLSA 200902-02. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...
GLSA-200902-02 : OpenSSL: Certificate validation error
The remote host is affected by the vulnerability described in GLSA-200902-02 OpenSSL: Certificate validation error The Google Security Team reported that several functions incorrectly check the result after calling the EVPVerifyFinal function, allowing a malformed signature to be treated as a goo...
OpenSSL: Certificate validation error
Background OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 as well as a general purpose cryptography library. Description The Google Security Team reported that several functions incorrectly check the result after calling the...
[SECURITY] [DSA 1719-1] New gnutls13 packages fix certificate validation
------------------------------------------------------------------------ Debian Security Advisory DSA-1719-1 [email protected] http://www.debian.org/security/ Florian Weimer February 10, 2009 http://www.debian.org/security/faq -...
