jbossws: Prone to character encoding pattern attack (XML Encryption flaw)

The W3C XML Encryption Standard, as used in the JBoss Web Services JBossWS component in JBoss Enterprise Portal Platform before 5.2.2 and other products, when using block ciphers in cipher-block chaining CBC mode, allows remote attackers to obtain plaintext data via a chosen-ciphertext attack on...

openssl: CMS and PKCS#7 Bleichenbacher attack

The implementation of Cryptographic Message Syntax CMS and PKCS 7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h does not properly restrict certain oracle behavior, which makes it easier for context-dependent attackers to decrypt data via a Million Message Attack MMA adaptive chosen ciphertext...

openssl: CMS and PKCS#7 Bleichenbacher attack

The implementation of Cryptographic Message Syntax CMS and PKCS 7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h does not properly restrict certain oracle behavior, which makes it easier for context-dependent attackers to decrypt data via a Million Message Attack MMA adaptive chosen ciphertext...

FreeBSD Ports: openssl

The remote host is missing an update to the system as announced in the referenced advisory. VID 60eb344e-6eb1-11e1-8ad7-00e0815b8da8 OpenVAS Vulnerability Test $ Description: Auto generated from VID 60eb344e-6eb1-11e1-8ad7-00e0815b8da8 Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

SuSE 11.1 Security Update : OpenSSL (SAT Patch Number 6054)

The following security issues have been fixed : - Specially crafted MIME headers could cause openssl's ans1 parser to dereference a NULL pointer leading to a Denial of Service CVE-2006-7250 or fail verfication. CVE-2012-1165 - The implementation of Cryptographic Message Syntax CMS and PKCS 7 in...

[ MDVSA-2012:038 ] openssl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2012:038 http://www.mandriva.com/security/ Package : openssl Date : March 26, 2012 Affected: 2010.1, 2011., Enterprise Server 5.0 Problem Description: Multiple vulnerabilities has been found and corrected in...

Mandriva Linux Security Advisory : openssl (MDVSA-2012:038)

Multiple vulnerabilities has been found and corrected in openssl : The implementation of Cryptographic Message Syntax CMS and PKCS 7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h does not properly restrict certain oracle behavior, which makes it easier for context-dependent attackers to decrypt...

CVE-2012-0884

The implementation of Cryptographic Message Syntax CMS and PKCS 7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h does not properly restrict certain oracle behavior, which makes it easier for context-dependent attackers to decrypt data via a Million Message Attack MMA adaptive chosen ciphertext...

CVE-2012-0884

CVE-2012-0884 affects the OpenSSL CMS/PKCS#7 implementations. The vulnerability arises from an improper restriction of oracle behavior, enabling context-dependent attackers to decrypt data via a Million Message Attack (MMA) under certain conditions. The issue is present in OpenSSL versions prior ...

CVE-2012-0884

The implementation of Cryptographic Message Syntax CMS and PKCS 7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h does not properly restrict certain oracle behavior, which makes it easier for context-dependent attackers to decrypt data via a Million Message Attack MMA adaptive chosen ciphertext...

MS10-070 ASP.NET Auto-Decryptor File Download Exploit

No description provided by source. !/usr/bin/ruby -w aspxadchotextattack.rb Copyright c 2010 AmpliaSECURITY. All rights reserved http://www.ampliasecurity.com Agustin Azubel - [email protected] MS10-070 ASPX proof of concept Decrypt data using an auto decryptor bundled in the aspx...

MS10-070 ASP.NET Auto-Decryptor File Download

!/usr/bin/ruby -w aspxadchotextattack.rb Copyright c 2010 AmpliaSECURITY. All rights reserved http://www.ampliasecurity.com Agustin Azubel - [email protected] MS10-070 ASPX proof of concept Decrypt data using an auto decryptor bundled in the aspx framework Encrypt data using Rizzo-Duong...

Microsoft ASP.NET - Auto-Decryptor File Download (MS10-070)

Microsoft ASP.NET - Auto-Decryptor File Download MS10-070 !/usr/bin/ruby -w aspxadchotextattack.rb Copyright c 2010 AmpliaSECURITY. All rights reserved http://www.ampliasecurity.com Agustin Azubel - [email protected] MS10-070 ASPX proof of concept Decrypt data using an auto decryptor...

Microsoft ASP.NET - Auto-Decryptor File Download (MS10-070)

!/usr/bin/ruby -w aspxadchotextattack.rb Copyright c 2010 AmpliaSECURITY. All rights reserved http://www.ampliasecurity.com Agustin Azubel - [email protected] MS10-070 ASPX proof of concept Decrypt data using an auto decryptor bundled in the aspx framework Encrypt data using Rizzo-Duong...

CVE-2008-7128

The sslparseclientkeyexchange function in XySSL before 0.9 does not protect against certain Bleichenbacher attacks using chosen ciphertext, which allows remote attackers to recover keys via unspecified vectors...

CVE-2008-7128

The sslparseclientkeyexchange function in XySSL before 0.9 does not protect against certain Bleichenbacher attacks using chosen ciphertext, which allows remote attackers to recover keys via unspecified vectors...

CVE-2008-7128

The sslparseclientkeyexchange function in XySSL before 0.9 does not protect against certain Bleichenbacher attacks using chosen ciphertext, which allows remote attackers to recover keys via unspecified vectors...

CVE-2008-7128

The CVE-2008-7128 entry concerns the ssl_parse_client_key_exchange function in XySSL prior to 0.9, which does not protect against certain Bleichenbacher-style chosen-ciphertext attacks. The vulnerability allows remote attackers to recover keys via unspecified vectors. Documented impact is partial...

FreeBSD Ports: gnupg

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD : gnutls -- Adaptive Chosen Ciphertext Attack (831) (deprecated)

The remote host is missing an update to the system The following package is affected: gnutls-devel This plugin has been deprecated since the advisory has been canceled. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the VuXML entry has been cancelled. Disabled on 2011/10/02....