198 matches found
SuSE 10 Security Update : eID-belgium (ZYPP Patch Number 6006)
eID-belgium uses EVPVerifyFinal incorrectly CVE-2009-0049 which allowed bypassing the validation of the certificate chain. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descripti...
PT-2009-5378 · Opera · Opera
Name of the Vulnerable Software and Affected Versions: Opera versions prior to 10.00 Description: The issue arises from the failure to check all intermediate X.509 certificates for revocation, making it easier for remote SSL servers to bypass validation of the certificate chain via a revoked...
VMSA-2009-0004 : ESX Service Console updates for openssl, bind, and vim
a. Updated OpenSSL package for the Service Console fixes a security issue. OpenSSL 0.9.7a-33.24 and earlier does not properly check the return value from the EVPVerifyFinal function, which could allow a remote attacker to bypass validation of the certificate chain via a malformed SSL/TLS signatur...
HP System Management Homepage < 3.0.1.73 Multiple Flaws
According to its self-reported version number, the HP System Management Homepage install on the remote host is earlier than 3.0.1.73. Such versions are reportedly affected by multiple flaws : - A weakness in PHP could be exploited to perform cross- site scripting attacks, provided PHP directive...
CVE-2009-0127
M2Crypto does not properly check the return value from the OpenSSL EVPVerifyFinal, DSAverify, ECDSAverify, DSAdoverify, and ECDSAdoverify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to...
CVE-2009-0127
M2Crypto does not properly check the return value from the OpenSSL EVPVerifyFinal, DSAverify, ECDSAverify, DSAdoverify, and ECDSAdoverify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to...
Input validation
DISPUTED lib/crypto/csrc/cryptodrv.c in erlang does not properly check the return value from the OpenSSL DSAdoverify function, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a...
CVE-2009-0126
The decryptpublic function in lib/crypt.cpp in the client in Berkeley Open Infrastructure for Network Computing BOINC 6.2.14 and 6.4.5 does not check the return value from the OpenSSL RSApublicdecrypt function, which allows remote attackers to bypass validation of the certificate chain via a...
CVE-2009-0130
The erlang software component contains a vulnerability in lib/crypto/c_src/crypto_drv.c where it fails to properly check the return value from the OpenSSL DSA_do_verify function. This flaw could allow remote attackers to bypass certificate chain validation using a malformed SSL/TLS signature, a b...
CVE-2009-0050
Lasso 2.2.1 and earlier does not properly check the return value from the OpenSSL DSAverify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077...
CVE-2009-0047
Gale 0.99 and earlier does not properly check the return value from the OpenSSL EVPVerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077...
CVE-2009-0049
Belgian eID middleware eidlib 2.6.0 and earlier does not properly check the return value from the OpenSSL EVPVerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to...
CVE-2009-0050
Lasso 2.2.1 and earlier does not properly check the return value from the OpenSSL DSAverify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077...
Input validation
NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVPVerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to...
CVE-2009-0021
NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVPVerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to...
CVE-2004-2393: Undefined Security Weakness
Java Secure Socket Extension JSSE 1.0.3 through 1.0.32 does not properly validate the certificate chain of a client or server, which allows remote attackers to falsely authenticate peers for SSL/TLS...
CVE-2004-2393
Java Secure Socket Extension JSSE 1.0.3 through 1.0.32 does not properly validate the certificate chain of a client or server, which allows remote attackers to falsely authenticate peers for SSL/TLS...
