PT-2015-6033

Name of the Vulnerable Software and Affected Versions Type74 ED versions prior to 4.0 Description The issue concerns the misuse of 128-bit ECB encryption for small files, making it easier for attackers to obtain plaintext data via differential cryptanalysis of a file with an original length small...

File Encryption Software "ED" where encrypted data may be easier to decipher when files of small size are encrypted

Overview File encyption software "ED" contains an issue when files of small size are encyrpted, they may become easier to decipher in comparison to when files of a larger size are encrypted. When encrypting small files that are smaller than the block size 128 bits, file encryption software "ED"...

SSL/TLS Diffie-Hellman Modulus <= 1024 Bits (Logjam)

The remote host allows SSL/TLS connections with one or more Diffie-Hellman moduli less than or equal to 1024 bits. Through cryptanalysis, a third party may be able to find the shared secret in a short amount of time depending on modulus size and attacker resources. This may allow an attacker to...

Weak SSL RC4 Cipher Suites (CVE-2013-2566; CVE-2015-2808)

RC4 is a widely supported stream cipher, often preferred by TLS servers and other servers using encrypted sessions. It has long been known to have a variety of cryptographic weaknesses. Recent cryptanalysis results, one of which is the "Bar Mitzvah attack", exploit biases in the RC4 keystream to...

'Fully Secure Systems Don't Exist'

SAN FRANCISCO–The more things change, the more they stay the same. Thirty years ago, Adi Shamir, one of the inventors of the RSA algorithm, was asked to do a keynote speech at a conference and spoke about his laws of computer security. They were a set of principles that he developed over the year...

TrueCrypt Audit Cryptanalysis Finds No Backdoors

The results are in from the cryptanalysis phase of the TrueCrypt audit, and they show—nothing. Well, maybe not “nothing,” but certainly no signs of a deliberate backdoor from the NSA or any government entity, fears of which date back to the autumn of 2013, post-Snowden, and ignited talk to have t...

TrueCrypt Audit Cryptanalysis Handed Off to NCC Group

The stagnant TrueCrypt audit stirred to life in the last 24 hours with the announcement that the second phase of the audit, tasked with examining the cryptography behind the open source disk encryption software, will begin shortly. NCC Group’s Cryptography Services has been contracted to do the...

Crowdsourcing to be Part of Phase Two of TrueCrypt Audit

TrueCrypt may yet get forked, but it won’t come at the hands of the Open Crypto Audit Project OCAP, which has a working plan to move forward with a cryptanalysis of the open source encryption software. OCAP is the brand name for the grassroots movement that arose out of the ashes of the Snowden...

CVE-2014-0361

The default configuration of IBM 4690 OS, as used in Toshiba Global Commerce Solutions 4690 POS and other products, hashes passwords with the ADXCRYPT algorithm, which makes it easier for context-dependent attackers to obtain sensitive information via unspecified cryptanalysis of an ADXCSOUF.DAT...

CVE-2014-0361

The default configuration of IBM 4690 OS, as used in Toshiba Global Commerce Solutions 4690 POS and other products, hashes passwords with the ADXCRYPT algorithm, which makes it easier for context-dependent attackers to obtain sensitive information via unspecified cryptanalysis of an ADXCSOUF.DAT...

CVE-2014-0361: Undefined Security Weakness

The default configuration of IBM 4690 OS, as used in Toshiba Global Commerce Solutions 4690 POS and other products, hashes passwords with the ADXCRYPT algorithm, which makes it easier for context-dependent attackers to obtain sensitive information via unspecified cryptanalysis of an ADXCSOUF.DAT...

Cryptanalysis Remains for TrueCrypt Audit

Phase two of the TrueCrypt audit figures to be a labor-intensive, largely manual cryptanalysis, according to the two experts behind the Open Crypto Audit Project OCAP. Matthew Green, crypto expert and professor at Johns Hopkins University, said a small team of experts will have to, by hand, exami...

TrueCrypt is Secure; Encryption Tool cleared the First Phase of Security Audit

Is TrueCrypt Audited Yet? Yes, In Part! One of the world's most-used open source file encryption software trusted by tens of millions of users - TrueCrypt is being audited by a team of experts to assess if it could be easily exploited and cracked. Hopefully it has cleared the first phase of the...

Amazon Linux AMI : gnupg (ALAS-2014-278)

GnuPG 1.x before 1.4.16 generates RSA keys using sequences of introductions with certain patterns that introduce a side channel, which allows physically proximate attackers to extract RSA keys via a chosen-ciphertext attack and acoustic cryptanalysis during decryption. NOTE: applications are not...

RedHat Update for gnupg RHSA-2014:0016-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RedHat Update for gnupg RHSA-2014:0016-01

Check for the Version of gnupg OpenVAS Vulnerability Test RedHat Update for gnupg RHSA-2014:0016-01 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms...

Medium: gnupg

Issue Overview: GnuPG 1.x before 1.4.16 generates RSA keys using sequences of introductions with certain patterns that introduce a side channel, which allows physically proximate attackers to extract RSA keys via a chosen-ciphertext attack and acoustic cryptanalysis during decryption. NOTE:...

Scientific Linux Security Update : gnupg on SL5.x i386/x86_64 (20140108)

It was found that GnuPG was vulnerable to side-channel attacks via acoustic cryptanalysis. An attacker in close range to a target system that is decrypting ciphertexts could possibly use this flaw to recover the RSA secret key from that system. CVE-2013-4576 %NASLMINLEVEL 70300 C Tenable Network...

CentOS Update for gnupg CESA-2014:0016 centos5

Check for the Version of gnupg OpenVAS Vulnerability Test CentOS Update for gnupg CESA-2014:0016 centos5 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

CentOS Update for gnupg CESA-2014:0016 centos5

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...