openSUSE Security Update : gnutls (gnutls-858)

This update of gnutls immproves the certificate validation process of gnutls-cli, prior gnutls-cli allowed man-in-the-middle attacks only Gnus seems to use this tool. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Gizmo5 <= 3.1.0.79 SSL Certificate Validation Security Bypass Vulnerability - Linux

Gizmo5 is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MySQL Connector/NET缺少SSL证书验证漏洞

BUGTRAQ ID: 35514 MySQL Connector/Net是MySQL数据库的ADO.NET驱动。 MySQL Connector/Net在使用加密的时候没有对服务器的证书执行验证。在NativeDriver.cs文件中，StartSSL函数依赖于名为 NoServerCheckValidation的验证函数，而该函数没有执行任何验证。此外还有另一个名为ServerCheckValidation 的函数，而该函数被标注掉。 能够对连接执行中间人攻击的攻击者可以通过利用这个漏洞绕过加密验证，从而破坏SSL所提供的安全性。 MySQL AB MySQL Connector/N...

CVE-2009-1682

CVE-2009-1682 affects Apple Safari before 4.0. The issue is that EV certificate revocation checks are not performed properly, making it easier for remote attackers to trick users into accepting an invalid certificate. Connected sources corroborate the vulnerability in Safari/WebKit and note a ven...

Mandrake Security Advisory MDVSA-2009:116 (gnutls)

The remote host is missing an update to gnutls announced via advisory MDVSA-2009:116. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

gnutls multiple security vulnerabilities

DoS, certificate validation vulnerabilities...

CVE-2009-0161

CVE-2009-0161 affects Apple Mac OS X 10.5 before 10.5.7, specifically the Ruby OpenSSL OCSP module. The issue stems from incomplete error checking in OpenSSL’s OCSP handling, which may cause an invalid OCSP response to be treated as valid, potentially allowing certificate spoofing via a revoked c...

CVE-2009-1417

CVE-2009-1417 concerns gnutls-cli in GnuTLS prior to 2.6.6, where the time checks for X.509 certificates are not performed in _gnutls_x509_verify_certificate. This allows a remote attacker to present a certificate that is not yet valid or has expired, with downstream impact on affected apps (Exim...

Mandriva Linux Security Advisory : openssl (MDVSA-2009:001)

A vulnerability was found by the Google Security Team with how OpenSSL checked the verification of certificates. An attacker in control of a malicious server or able to effect a man-in-the-middle attack, could present a malformed SSL/TLS signature from a certificate chain to a vulnerable client,...

Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : gnutls12, gnutls13, gnutls26 regression (USN-678-2)

USN-678-1 fixed a vulnerability in GnuTLS. The upstream patch introduced a regression when validating certain certificate chains that would report valid certificates as untrusted. This update fixes the problem. We apologize for the inconvenience. Martin von Gagern discovered that GnuTLS did not...

Mandriva Linux Security Advisory : ntp (MDVSA-2009:007)

A flaw was found in how NTP checked the return value of signature verification. A remote attacker could use this to bypass certificate validation by using a malformed SSL/TLS signature CVE-2009-0021. The updated packages have been patched to prevent this issue. %NASLMINLEVEL 70300 C Tenable Netwo...

CentOS 4 : ruby (CESA-2007:0961)

Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ruby is an interpreted scripting language for object-oriented programming. A flaw was...

Microsoft WinHTTP服务证书验证漏洞（MS09-013）

BUGTRAQ ID: 34437 CVECAN ID: CVE-2009-0089 Microsoft Windows是微软发布的非常流行的操作系统。 当应用程序调用Windows HTTP服务与远程Web服务器创建连接时，WinHTTP仅对主机试图连接的原始站点的证书验证URL是否为完全合格的域名，特定的DNS欺骗攻击可能将连接转发到拥有该特定主机有效证书但不是WinHTTP初始化连接所到页面有效证书的不同Web服务器上，这可能导致WinHTTP错误的认为远程 Web服务器的证书为可接受。由于WinHTTP的用户交互依赖于应用程序，因此用户可能不会得到上述差异的警告。 Microso...

PT-2009-2789 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the fixed version Description: A spoofing issue exists due to incomplete validation of the distinguished name in a digital certificate. This can be combined with other attacks, such as DNS spoofing, allowin...

Microsoft WinHTTP Server Name Mismatch Certificate Validation Security Bypass Vulnerability

Description Microsoft Windows HTTP Services WinHTTP is prone to a security-bypass vulnerability because of an error in verifying website certificates. Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further...

GLSA-200904-05 : ntp: Certificate validation error

The remote host is affected by the vulnerability described in GLSA-200904-05 ntp: Certificate validation error It has been reported that ntp incorrectly checks the return value of the EVPVerifyFinal, a vulnerability related to CVE-2008-5077 GLSA 200902-02. Impact : A remote attacker could exploit...

Gentoo Security Advisory GLSA 200904-05 (ntp)

The remote host is missing updates announced in advisory GLSA 200904-05. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

ntp: Certificate validation error

Background ntp contains the client and daemon implementations for the Network Time Protocol. Description It has been reported that ntp incorrectly checks the return value of the EVPVerifyFinal, a vulnerability related to CVE-2008-5077 GLSA 200902-02. Impact A remote attacker could exploit this...

Ubuntu: Security Advisory (USN-675-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Gentoo Security Advisory GLSA 200902-02 (openssl)

The remote host is missing updates announced in advisory GLSA 200902-02. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...