Dyre Trojan Targeting More than Salesforce.com Credentials

The criminals who unleashed a variant of the Dyre banking Trojan recently may have more up their sleeve than harvesting Salesforce.com credentials. Analysis of a sample conducted by SaaS security company Adallom determined that the new strain of Dyre is targeting large enterprises in addition to...

openSUSE Security Update : icedtea-web (openSUSE-SU-2012:0371-1)

update to 1.2 - New features : - Signed JNLP support - Support for client authentication certificates - Cache size enforcement now supported via itweb-settings - Applet parameter passing through JNLP files now supported - Better icons for access warning dialog - Security Dialog UI revamped to...

Scientific Linux Security Update : freeradius on SL6.x i386/x86_64 (20121002)

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service RADIUS server, designed to allow centralized authentication and authorization for a network. A buffer overflow flaw was discovered in the way radiusd handled the expiration date field in X.509...

freeradius security update

CentOS Errata and Security Advisory CESA-2012:1326 Updated freeradius packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base...

CentOS 5 : freeradius2 (CESA-2012:1327)

Updated freeradius2 packages that fix one security issue are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CentOS 6 : freeradius (CESA-2012:1326)

Updated freeradius packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

RedHat Update for freeradius2 RHSA-2012:1327-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

freeradius: stack-based buffer overflow via long expiration date fields in client X509 certificates

Stack-based buffer overflow in the cbtlsverify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service server crash and possibly execute arbitrary code via a long "not after" timestamp in a client certificate...

Moderate: Red Hat Security Advisory: freeradius2 security update

Updated freeradius2 packages that fix one security issue are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

freeradius: stack-based buffer overflow via long expiration date fields in client X509 certificates

Stack-based buffer overflow in the cbtlsverify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service server crash and possibly execute arbitrary code via a long "not after" timestamp in a client certificate...

Ubuntu 11.04 / 11.10 / 12.04 LTS : freeradius vulnerability (USN-1585-1)

Timo Warns discovered that FreeRADIUS incorrectly handled certain long timestamps in client certificates. A remote attacker could exploit this flaw and cause the FreeRADIUS server to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for...

[PRE-SA-2012-06] FreeRADIUS: Stack Overflow in TLS-based EAP Methods

PRE-CERT Security Advisory ========================== Advisory: PRE-SA-2012-06 Released on: 10 September 2012 Affected product: FreeRADIUS 2.1.10 - 2.1.12 Impact: remote code execution Origin: specially crafted client certificates CVSS Base Score: 10 Impact Subscore: 10 Exploitability Subscore: 1...

CentOS Update for nspr CESA-2012:0973 centos6

Check for the Version of nspr OpenVAS Vulnerability Test CentOS Update for nspr CESA-2012:0973 centos6 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

CentOS 6 : nss (CESA-2012:0973)

Updated nss, nss-util, and nspr packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Network Security Services NSS is a set of...

RHEL 6 : nss, nss-util, and nspr (RHSA-2012:0973)

Updated nss, nss-util, and nspr packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Network Security Services NSS is a set of...

OpenSSL < 0.9.2b Session Reuse

According to its banner, the remote server is running a version of OpenSSL that is earlier than 0.9.2b. A remote attacker could reuse an SSL session under a different context and bypass access control mechanisms based on client certificates. C Tenable Network Security, Inc. include"compat.inc"; i...

OpenSSL 0.9.6 < 0.9.6k Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 0.9.6k. It is, therefore, affected by multiple vulnerabilities as referenced in the 0.9.6k advisory. - OpenSSL 0.9.6 and 0.9.7 does not properly track the number of characters in certain ASN.1 inputs, which allows remote attackers to...

PT-2010-4665 · Microsoft · Iis 7.X +5

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the fix, including Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 Description: A denial of service issue exists due to improper processing of client certificates during SSL...

CVE-2010-0524

The default configuration of the FreeRADIUS server in Apple Mac OS X Server before 10.6.3 permits EAP-TLS authenticated connections on the basis of an arbitrary client certificate, which allows remote attackers to obtain network connectivity via a crafted RADIUS Access Request message...

Moderate: Red Hat Security Advisory: openldap security and bug fix update

Updated openldap packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...