OracleVM 3.2 : onpenssl (OVMSA-2014-0008)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability - replace expired GlobalSign Root CA certificate in ca-bundle.crt - fix for CVE-2013-0169 - SSL/TLS CBC timing attack 907589 - fix for CVE-2013-0166 ...

Fedora 19 : Pound-2.6-8.fc19 (2014-13764)

Backport various security fixes. Note they usually are extra options that need to be enabled manually so that we won't break functionality : - CVE-2011-3389: Make it possible to deny use of 'BEAST' vulnerable ciphers - CVE-2012-4929: Disable compression to be safe from 'CRIME' - CVE-2005-2090:...

AIX OpenSSL Advisory : openssl_advisory11.asc (POODLE)

The version of OpenSSL installed on the remote host is affected by the following vulnerabilities : - An error exists related to DTLS SRTP extension handling and specially crafted handshake messages that can allow denial of service attacks via memory leaks. CVE-2014-3513 - A man-in-the-middle MitM...

SSLv3 Padding Oracle On Downgraded Legacy Encryption in Cisco ASA Software (cisco-sa-20141015-poodle) (POODLE)

The remote Cisco ASA device is affected by a man-in-the-middle MitM information disclosure vulnerability known as POODLE. The vulnerability is due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining CBC mode. A MitM attacker can...

Cisco AnyConnect Secure Mobility Client < 3.1(5187) (POODLE)

The remote host has a version of Cisco AnyConnect prior to 3.15187. It is, therefore, affected by an information disclosure vulnerability known as POODLE. The vulnerability is due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block...

ssl-poodle NSE Script

Checks whether SSLv3 CBC ciphers are allowed POODLE Run with -sV to use Nmap's service scan to detect SSL/TLS on non-standard ports. Otherwise, ssl-poodle will only run on ports that are commonly used for SSL. POODLE is CVE-2014-3566. All implementations of SSLv3 that accept CBC ciphersuites are...

Amazon Linux AMI : nss (ALAS-2014-429) (POODLE)

A flaw was found in the way SSL 3.0 handled padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining CBC mode. This flaw allows a man-in-the-middle MITM attacker to decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a...

TA14-290A: SSL 3.0 Protocol Vulnerability and POODLE Attack

NCCIC / US-CERT National Cyber Awareness System: TA14-290A: SSL 3.0 Protocol Vulnerability and POODLE Attack 10/17/2014 12:27 PM EDT Original release date: October 17, 2014 Systems Affected All systems and applications utilizing the Secure Socket Layer SSL 3.0 with cipher-block chaining CBC mode...

SSL/TLS Version Detection

Check if a server supports a given version of SSL/TLS and cipher suites. The certificate is stored in loot, and any known vulnerabilities against that SSL version and cipher suite combination are checked. These checks include POODLE, deprecated protocols, expired/not valid certs, low key strength...

F5 Networks BIG-IP : OpenSSL vulnerability (K15325)

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessio...

F5 Networks BIG-IP : OpenSSL vulnerability (K15356)

The dtls1reassemblefragment function in d1both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service buffer overflow a...

SOL15568 - OpenSSL vulnerability CVE-2014-3510

Recommended Action You can eliminate this vulnerability by running a version listed in the Versions known to be not vulnerable column in the previous table. If the Versions known to be not vulnerable column does not list a version that is later than the version you are running, then no upgrade...

SUSE-RU-2015:0591-1 Recommended update for apache2-mod_nss

This update brings several improvements to apache2-modnss. More TLS 1.2 ciphers have been added, including AES-GCM and Camelia ciphers. These can be selected by their tags: o rsaaes128sha256 o rsaaes128gcmsha o rsaaes256sha256 o rsacamellia128sha o rsacamellia256sha o ecdhecdsaaes128gcmsha o...

openSUSE Security Update : apache2-mod_nss (openSUSE-SU-2014:0979-1)

apache2-modnss is alternative yet not exclusive to modnss. This update introduces Server Name Indication support to modnss, which was not available previously. In addition to SNI, GCM ciphers have been added to the cipher list of modnss. A bug was corrected that prevented the entry of the...

SOL15401 - OpenSSL vulnerability CVE-2012-2333

Recommended action You can eliminate this vulnerability by running a version listed in the Versions known to be not vulnerable column in the previous table. If the Versions known to be not vulnerable column does not list a version that is higher than the version you are running, then no upgrade...

SOL15348 - OpenSSL DTLS Buffer vulnerability CVE-2009-1387

Recommended Action If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not list any version...

SOL15325 - OpenSSL vulnerability CVE-2014-0224

Client-side componentsProduct| Versions known to be vulnerable| Versions known to be not vulnerable| Vulnerable component or feature ---|---|---|--- BIG-IP LTM| 11.0.0 - 11.5.1 10.0.0 - 10.2.4| 12.0.0 11.6.0 11.5.1 HF3 11.5.0 HF4 11.2.1 HF15| Host-initiated SSL connections COMPAT SSL ciphers BIG-...

CVE-2013-6807

The client in OpenText Exceed OnDemand EoD 8 supports anonymous ciphers by default, which allows man-in-the-middle attackers to bypass server certificate validation, redirect a connection, and obtain sensitive information via crafted responses...

Design/Logic Flaw

The client in OpenText Exceed OnDemand EoD 8 supports anonymous ciphers by default, which allows man-in-the-middle attackers to bypass server certificate validation, redirect a connection, and obtain sensitive information via crafted responses...

CVE-2013-6807

CVE-2013-6807 affects OpenText Exceed OnDemand (EoD) 8. The vulnerability arises because the client supports anonymous ciphers by default, enabling man-in-the-middle attackers to bypass server certificate validation, redirect connections, and obtain sensitive information from crafted responses. R...