DSA-1532-1 xulrunner

Bulletin has no description...

Debian Security Advisory DSA 120-1 (libapache-mod-ssl, apache-ssl)

The remote host is missing an update to libapache-mod-ssl, apache-ssl announced via advisory DSA 120-1. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Authentication flaw

Hitachi Web Server 01-00 through 03-00-01, as used by certain Cosminexus products, does not properly validate SSL client certificates, which might allow remote attackers to spoof authentication via a client certificate with a forged signature...

CVE-2007-4879

Mozilla Firefox before Firefox 2.0.0.13, and SeaMonkey before 1.1.9, can automatically install TLS client certificates with minimal user interaction, and automatically sends these certificates when requested, which makes it easier for remote web sites to track user activities across domains by...

Code injection

Mozilla Firefox before Firefox 2.0.0.13, and SeaMonkey before 1.1.9, can automatically install TLS client certificates with minimal user interaction, and automatically sends these certificates when requested, which makes it easier for remote web sites to track user activities across domains by...

CVE-2007-4879

Mozilla Firefox before Firefox 2.0.0.13, and SeaMonkey before 1.1.9, can automatically install TLS client certificates with minimal user interaction, and automatically sends these certificates when requested, which makes it easier for remote web sites to track user activities across domains by...

CVE-2007-4879

Mozilla Firefox before Firefox 2.0.0.13, and SeaMonkey before 1.1.9, can automatically install TLS client certificates with minimal user interaction, and automatically sends these certificates when requested, which makes it easier for remote web sites to track user activities across domains by...

mod_ssl fails to properly enforce client certificates authentication

Overview modssl, the Apache web server module for Secure Socket Layer SSL communications, may not properly authenticate client certificates. Description modssl provides Secure Socket Layer SSL communications for the Apache web server. SSL is designed to provide the ability to encrypt and...

Debian DSA-120-1 : mod_ssl - buffer overflow

Ed Moyle recently found a buffer overflow in Apache-SSL and modssl. With session caching enabled, modssl will serialize SSL session variables to store them for later use. These variables were stored in a buffer of a fixed size without proper boundary checks. To exploit the overflow, the server mu...

SUSE-SA:2003:043: openssl

The remote host is missing the patch for the advisory SUSE-SA:2003:043 openssl. OpenSSL is an implementation of the Secure Socket Layer SSL v2/3 and Transport Layer Security TLS v1 protocol. While checking the openssl implementation with a tool-kit from NISCC several errors were revealed most are...

RHEL 2.1 : apache (RHSA-2003:244)

Updated Apache and modssl packages that fix several minor security issues are now available for Red Hat Enterprise Linux. The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server. Ben Laurie found a bug in the optional renegotiation code in modssl which can...

BEA WebLogic Server fails to properly associate the user identity on subsequent client connections

Overview BEA WebLogic Server fails to properly associate a user's identity when a client attempts to connect multiple times using different client certificates. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing, integrating,...

CVE-2005-1247

webadmin.exe in Novell Nsure Audit 1.0.1 allows remote attackers to cause a denial of service via malformed ASN.1 packets in corrupt client certificates to an SSL server, as demonstrated using an exploit for the OpenSSL ASN.1 parsing vulnerability...

DEBIAN-CVE-2003-0544

OpenSSL 0.9.6 and 0.9.7 does not properly track the number of characters in certain ASN.1 inputs, which allows remote attackers to cause a denial of service crash via an SSL client certificate that causes OpenSSL to read past the end of a buffer when the long form is used...

OpenSSL ASN.1 0.9.6j0.9.7b - Brute Forcer for Parsing Bugs

OpenSSL ASN.1 0.9.6j0.9.7b - Brute Forcer for Parsing Bugs / Brute forcer for OpenSSL ASN.1 parsing bugs include include include include include include include include include include include include include include char buf8192; / This was simply sniffed from an stunnel session / const char...

Brute forcer for OpenSSL ASN.1 parsing bugs (<=0.9.6j <=0.9.7b)

No description provided by source. / Brute forcer for OpenSSL ASN.1 parsing bugs =0.9.6j =0.9.7b written by Bram Matthys Syzop on Oct 9 2003. This program sends corrupt client certificates to the SSL server which will 1 crash it 2 create lots of error messages, and/or 3 result in other...

DSA-393 openssl - denial of service

Bulletin has no description...

CAN-2003-0543/0544 OpenSSL ASN.1 protocol crashes

Integer overflow in OpenSSL 0.9.6 and 0.9.7 allows remote attackers to cause a denial of service crash via an SSL client certificate with certain ASN.1 tag values...

PT-2003-1008 · Openssl +1 · Openssl +1

Name of the Vulnerable Software and Affected Versions: OpenSSL versions 0.9.6 through 0.9.7a Description: The issue concerns multiple vulnerabilities in the OpenSSL package, which can lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilitie...

[Full-Disclosure] [OpenSSL Advisory] Vulnerabilities in ASN.1 parsing

-----BEGIN PGP SIGNED MESSAGE----- OpenSSL Security Advisory 30 September 2003 Vulnerabilities in ASN.1 parsing ================================ NISCC www.niscc.gov.uk prepared a test suite to check the operation of SSL/TLS software when presented with a wide range of malformed client certificate...