Design/Logic Flaw

crpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the-middle attackers to spoof clients via unspecified vectors...

CVE-2014-7189

CVE-2014-7189 affects the crypto/tls implementation in Go 1.1 up to 1.3.2, where enabling SessionTicketsDisabled can enable MITM attackers to spoof clients via unspecified vectors. Connected records identify this CVE in multiple contexts: GO-2021-0154 describes a MITM attack when SessionTicketsDi...

Fedora 19 : nodejs-0.10.32-1.fc19 / v8-3.14.5.10-14.fc19 (2014-10975)

This update provides the latest stable version of Node.js and corresponding backports to the v8 package. This update resolves CVE-2013-6668, which has only a minor impact since Node.js is not typically used to execute untrusted JavaScript. For more information on the fixed vulnerability, please s...

Fedora 21 : nodejs-0.10.32-1.fc21 / v8-3.14.5.10-14.fc21 (2014-11132)

This update provides the latest stable version of Node.js and corresponding backports to the v8 package. This update resolves CVE-2013-6668, which has only a minor impact since Node.js is not typically used to execute untrusted JavaScript. For more information on the fixed vulnerability, please s...

Key Flaw Enables Recovery of Files Encrypted by TorrentLocker

Crypto ransomware, a relatively unknown phenomenon a couple of years ago, has exploded into one of the nastier malware problems for Internet users. Variants such as CryptoLocker and CryptoWall have been siphoning money from victims for some time, and now researchers have dissected a newer variant...

USN-2339-2: Libgcrypt vulnerability

Daniel Genkin, Adi Shamir, and Eran Tromer discovered that Libgcrypt was susceptible to an adaptive chosen ciphertext attack via physical side channels. A local attacker could use this attack to possibly recover private keys...

kernel security, bug fix, and enhancement update

2.6.32-431.23.3 - netdrv pppol2tp: fail when socket option level is not SOLPPPOL2TP 1119461 1119462 CVE-2014-4943 2.6.32-431.23.2 - kernel utrace: force IRET path after utracefinishvfork Oleg Nesterov 1115932 1115933 CVE-2014-4699 2.6.32-431.23.1 - net iptunnel: fix iptunnelfind to return NULL in...

Onion Ransomware Demands Bitcoins, Uses Tor, Advanced Encryption

More details about a new family of encryption ransomware that uses the anonymous network Tor and requires users pay by Bitcoin have emerged. The ransomware, known in some circles as Critoni or CTB-Locker, has been dubbed Onion by researchers at Kaspersky Lab as its creators use command and contro...

kernel security, bug fix, and enhancement update

3.10.0-123.4.2 - Oracle Linux certificates Alexey Petrenko 3.10.0-123.4.2 - fs aio: fix plug memory disclosure and fix reqsactive accounting backport Jeff Moyer 1094604 1094605 CVE-2014-0206 - fs aio: plug memory disclosure and fix reqsactive accounting Mateusz Guzik 1094604 1094605 CVE-2014-0206...

Early Review of LibreSSL Finds Problematic PRNG

When the OpenBSD foundation sent LibreSSL out the door last weekend, it was with the full intention of getting some feedback and scrutiny in return, all in the name of making the crypto library stable and secure. What they likely didn’t expect were claims surfacing that LibreSSL shared some of th...

Exploit for Inadequate Encryption Strength in Openssl

Adam Langley's tool for testing for OpenSSL CVE-2014-0224, origi...

Facebook Takes Down Bitcoin Stealing Botnet that Infected 250,000 Computers

Once again Facebook is on The Hacker News! This time not for any scam or surveillance, but for a different reason. The social networking giant has managed to take down a Greek botnet that used Facebook to spread malware and infected 250,000 computers to mine crypto-currencies, steal bitcoins, ema...

Ultra Crypto Component (CryptoX.dll <= 2.0) Remote BoF Exploit

No description provided by source. pre codespan style=font: 10pt Courier New;span class=general1-symbolbody bgcolor=E0E0E0----------------------------------------------------------------------------------- bUltra Crypto Component CryptoX.dll = 2.0 AcquireContext Remote BoF Exploit/b url:...

Ultra Crypto Component (CryptoX.dll <= 2.0) SaveToFile() Inscure Method

No description provided by source. pre codespan style=font: 10pt Courier New;span class=general1-symbolbody bgcolor=E0E0E0------------------------------------------------------------------------------------- bUltra Crypto Component CryptoX.dll = 2.0 SaveToFile Inscure Method/b url:...

Microsoft Crypto API X.509 Certificate Validation - Remote Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/28548/info Microsoft's Crypto API library is prone to an information-disclosure vulnerability because HTTP requests to arbitrary hosts and ports may be automatically triggered when validating X.509 certificates. Successfu...

Crowdsourcing a Tool for Application Vulnerability Research

Pulling in security help on a project has traditionally meant either hiring more full-time help, or bringing in an outside consultant. Enterprises and vendors alike, however, are starting to really go outside the perimeter these days and are taking advantage of crowdsourcing. Given the paranoia i...

SuSE 11.3 Security Update : openssh (SAT Patch Number 9357)

This update for OpenSSH fixes the following issues : - Exit sshd normally when port is already in use. bnc832628 - Use hardware crypto engines where available. bnc826427 - Use correct options for login when it is used. bnc833605 - Move FIPS messages to higher debug level. bnc862875 - Fix forwardi...

SuSE 11.3 Security Update : openssh (SAT Patch Number 9357)

This update for OpenSSH fixes the following issues : - Exit sshd normally when port is already in use. bnc832628 - Use hardware crypto engines where available. bnc826427 - Use correct options for login when it is used. bnc833605 - Move FIPS messages to higher debug level. bnc862875 - Fix forwardi...

Student Decrypts Simplocker Android Ransomware that Encrypts Files

In a previous story, I reported about a new ransomware threat known as Simplocker discovered by researchers at the security firm ESET, targeting Android users in the UK, Switzerland, Germany, India and Russia, for ransom. Simplocker Android/Simplocker.A is the latest Android ransomware that has...

openSUSE Security Update : openssl (openSUSE-SU-2012:0474-1)

Changes in openssl : - S/MIME verification may erroneously fail - Free headers after use in error message - Symmetric crypto errors in PKCS7decrypt %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security...