SUSE: Security Advisory for mozilla-nss (SUSE-SU-2014:1220-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory for mozilla-nss (SUSE-SU-2014:1220-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the iOS operating system allows a perpetrator to forge any security certificate desired.

The vulnerability of the Certificate UI component in the iOS operating system is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to issue arbitrary security certificates due to display-related data rendering issues...

OpenSSL Alternative Chains Certificate Forgery MITM Proxy

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'openssl' class Metasploit3 'OpenSSL Alternative Chains Certificate Forgery MITM Proxy', 'Description' = %q This module exploits a logic error ...

OpenSSL 1.0.2c Alternative chains certificate forgery Vulnerability

Exploit for multiple platform in category remote exploits The function X509verifycert checks the value of |ctx-chain| at the beginning, and if it is NULL then it initialises it, along with the value of ctx-untrusted. The normal way to use X509verifycert is to first call X509STORECTXinit; then set...

OpenSSL Alternative Chains Certificate Forgery Vulnerability (July 2015) Affecting Cisco Products

On July 9, 2015, the OpenSSL Project released a security advisory detailing a vulnerability affecting applications that verify certificates, including SSL/Transport Layer Security TLS/Datagram Transport Layer Security DTLS clients and SSL/TLS/DTLS servers using client authentication. Multiple Cis...

OpenSSL: Alternate chains certificate forgery

Background OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 as well as a general purpose cryptography library. Description During certificate verification, OpenSSL attempts to find an alternative certificate chain if the first...

[slackware-security] openssl

New openssl packages are available for Slackware 14.0, 14.1, and -current to fix a security issue. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/openssl-1.0.1p-i486-1slack14.1.txz: Upgraded. This update fixes the following security issue: Alternative chains certificate...

Critical OpenSSL Flaw Allows Hackers to Impersonate Any Trusted SSL Certificate

The mysterious security vulnerability in the widely used OpenSSL code library is neither HeartBleed nor FREAK, but it’s critical enough to be patched by sysadmins without any delay. OpenSSL Foundation released the promised patch against a high severity vulnerability in OpenSSL versions 1.0.1n and...

CVE-2015-1793 OpenSSL "Alternative Chains Certificate Forgery"

...

Vulnerability in OpenSSL - Alternative chains certificate forgery

An error in the implementation of the alternative certificate chain logic could allow an attacker to cause certain checks on untrusted certificates to be bypassed, such as the CA flag, enabling them to use a valid leaf certificate to act as a CA and “issue” an invalid certificate...

OpenSSL Alternative Chains Certificate Forgery MITM Proxy

This module exploits a logic error in OpenSSL by impersonating the server and sending a specially-crafted chain of certificates, resulting in certain checks on untrusted certificates to be bypassed on the client, allowing it to use a valid leaf certificate as a CA certificate to sign a fake...

EMC Secure Remote Services Virtual Edition Certificate Forgery Vulnerability

EMC Secure Remote Services Virtual Edition is the virtual edition of the Remote Services software that provides two-way remote connectivity between EMC customer service and end-user EMC products and solutions. EMC Secure Remote Services Virtual Edition fails to properly validate certificates,...

async-http-client certificate validation vulnerability

async-http-client is a client library that allows Java applications to perform HTTP requests and asynchronously process that HTTP response. async-http-client fails to properly disable SSL/TLS certificate validation, allowing an attacker to exploit the vulnerability to conduct a man-in-the-middle...

Multiple F5 Products Certificate Validation Forgery Spoofing Vulnerability

F5 BIG-IP LTM is a local traffic manager; APM is a suite of solutions that provide secure unified access to business-critical applications and networks. A checksum forgery spoofing vulnerability exists in multiple F5 product certificates. Failure to properly validate the server certificate when t...

openssl: Fix various certificate fingerprint issues

Multiple flaws were found in the way OpenSSL parsed X.509 certificates. An attacker could use these flaws to modify an X.509 certificate to produce a certificate with a different fingerprint without invalidating its signature, and possibly bypass fingerprint-based blacklisting in applications...

nss: RSA PKCS#1 signature verification forgery flaw (MFSA 2014-73)

A flaw was found in the way NSS parsed ASN.1 Abstract Syntax Notation One input from certain RSA signatures. A remote attacker could use this flaw to forge RSA certificates by providing a specially crafted signature to an application using NSS...

nss: RSA PKCS#1 signature verification forgery flaw (MFSA 2014-73)

A flaw was found in the way NSS parsed ASN.1 Abstract Syntax Notation One input from certain RSA signatures. A remote attacker could use this flaw to forge RSA certificates by providing a specially crafted signature to an application using NSS...

Privacy-focused Tails 1.1.2 Operating System Released

Tails, a Linux-based highly secure Operating System specially designed and optimized to preserve users' anonymity and privacy, has launched its new release, Tails version 1.1.2. Tails, also known as 'Amnesiac Incognito Live System', is a free security-focused Debian-based Linux distribution, whic...

nss: RSA PKCS#1 signature verification forgery flaw (MFSA 2014-73)

A flaw was found in the way NSS parsed ASN.1 Abstract Syntax Notation One input from certain RSA signatures. A remote attacker could use this flaw to forge RSA certificates by providing a specially crafted signature to an application using NSS...