252 matches found
CVE-2014-3470
The ssl3sendclientkeyexchange function in s3clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service NULL pointer dereference and client crash by triggering a NULL certificate...
CVE-2014-3470
The ssl3sendclientkeyexchange function in s3clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service NULL pointer dereference and client crash by triggering a NULL certificate...
Fedora 20 : mingw-gnutls-3.1.22-1.fc20 (2014-3454)
Version 3.1.22 released 2014-03-03 - libgnutls: Corrected certificate verification issue GNUTLS-SA-2014-2 - libgnutls: Corrected issue in gnutlspcertlistimportx509raw when provided with invalid data. Reported by Dmitriy Anisimkov. - libgnutls: Corrected timeout issue in subsequent to the first DT...
Experts Urge Conservatism on Crypto Standards
SAN FRANCISCO–Security people are, by nature, cautious and methodical, and that is even more true of cryptographers. And in the current environment, when new adversaries seem to emerge on a daily basis and cryptographic standards are under intense scrutiny, a panel of some of the biggest names in...
CVE-2014-0627
The SSLEngine API implementation in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to trigger the selection of a weak cipher suite by using the wrap method during a certain incomplete-handshake state...
Design/Logic Flaw
The SSLEngine API implementation in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to trigger the selection of a weak cipher suite by using the wrap method during a certain incomplete-handshake state...
PT-2014-3723
Name of the Vulnerable Software and Affected Versions EMC RSA BSAFE SSL-J versions 5.x before 5.1.3 EMC RSA BSAFE SSL-J versions 6.x before 6.0.2 Description The issue allows remote attackers to trigger the selection of a weak cipher suite by using the wrap method during a certain...
CVE-2014-0627
The SSLEngine API implementation in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to trigger the selection of a weak cipher suite by using the wrap method during a certain incomplete-handshake state...
CVE-2014-0627
Summary: CVE-2014-0627 affects EMC RSA BSAFE SSL-J (SSL-J) 5.x before 5.1.3 and 6.x before 6.0.2. The SSLEngine API can reveal information by using the wrap method after the Finished message in an incomplete handshake, potentially allowing an attacker to trigger a weak cipher suite. Impact: Infor...
CVE-2014-0627: Undefined Security Weakness
The SSLEngine API implementation in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to trigger the selection of a weak cipher suite by using the wrap method during a certain incomplete-handshake state...
IPMI Cipher Suite 0 (Cipher Zero) Authentication Bypass Vulnerability (IPMI Protocol)
Intelligent Platform Management Interface IPMI services are prone to an authentication bypass vulnerability through the use of cipher suite 0 aka cipher zero. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...
Twitter Implements Perfect Forward Secrecy
Twitter took another step toward not only securing the privacy of its users’ communication over the social network, but in warding off the prying eyes of government surveillance with the implementation of Perfect Forward Secrecy. The technology thwarts the efforts of anyone who may be collecting...
Updated firefox, rootcerts, nspr & nss packages fix security vulnerabilities
Updated nspr and nss packages fix security vulnerabilities: Potentially exploitable buffer overflow in NSS before 3.15.3 that allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid handshake packets CVE-2013-5605. The CERTVerifyCert function in...
[security bulletin] HPSBMU02902 rev.1 - HP Integrated Lights-Out iLO3, iLO4 IPMI Cipher Suite 0 Authentication Bypass Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03844348 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03844348 Version: 1 HPSBMU02902 rev....
IPMI Cipher Suite Zero Authentication Bypass
Binary data ipmicipher0authbypass.nbin...
Oracle Linux 6 : openldap (ELSA-2012-1151)
The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-1151 advisory. - CVE-2012-2668 825875 cipher suite selection by name can be ignored default cipher suite is always selected Tenable has extracted the preceding description blo...
CVE-2013-4784
The HP Integrated Lights-Out iLO BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 aka cipher zero and an arbitrary password...
Authentication flaw
The Supermicro BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 aka cipher zero and an arbitrary password...
Authentication flaw
The HP Integrated Lights-Out iLO BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 aka cipher zero and an arbitrary password...