Security update for the Linux Kernel (important)

The openSUSE Leap 42.2 Kernel was updated to 4.4.90 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000252: The KVM subsystem in the Linux kernel allowed guest OS users to cause a denial of service assertion failure, and hypervisor hang or crash via a...

Live streaming Cryptopals

tl;dr: Im livecoding the Cryptopals in Go on Twitch, one set every Sunday. The recordings are on YouTube. Oh, wow. I love the idea. Would anyone here seriously watch 20 to 40 hours of me doing crypto, math and Go? Mic, screen, and everything. -- Filippo Valsorda @FiloSottile October 16, 2016 Almo...

CVE-2017-11056

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while doing sha and cipher operations, a userspace buffer is directly accessed in kernel space potentially leading to a page fault...

Google Android Qualcomm Crypto Driver Elevation of Privilege Vulnerability (CNVD-2017-31136)

Android is a free and open source Linux-based operating system led and developed by Google Inc. and the Open Handset Alliance. An elevation of privilege vulnerability exists in the Google Android Qualcomm encryption driver, which can be exploited by an attacker to elevate privileges...

Untrusted Certificate Validation

crypto/x509 in github.com/golang/go uses untrusted certificates for validation. When used on Darwin, golang will use an untrusted root certificate as if it were trusted when verifying connections...

[SECURITY] Fedora 27 Update: libgcrypt-1.8.1-1.fc27

Libgcrypt is a general purpose crypto library based on the code used in GNU Privacy Guard. This is a development version...

ICANN Postpones Scheduled DNS Crypto Key Rollover

ICANN, the overseer of the Internet’s namespace, announced this week that it was postponing a scheduled change to the cryptographic key that protects the Domain Name System. ICANN said in a statement that the change was to occur on Oct. 11, but new data indicates that a “significant number” of...

Security Bulletin: NVIDIA Shield TV and Tablet contain multiple vulnerabilities

Vulnerability Details The following sections summarize the vulnerabilities. Descriptions use CWE™ and risk assessments follow CVSS. CVE-2016-6790 NVIDIA OpenMax Component contains a vulnerability in LIBNVRM where an input buffer is copied to an output buffer without checking the size of the input...

Veeam ONE installation fails with "Couldn't create crypto provider" message

Challenge Veeam ONE installation fails with "Couldn't create crypto provider" message. Cause One of the known issues with Microsoft update 3000850 as per this MS KB article is the following: Opening Credential Manager fails with error 0x80090345", that also affects creating the crypto provider...

ARM Mbedtls x509 ECDSA invalid public key Remote Code Execution Vulnerability(CVE-2017-2784)

Summary An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbedTLS 2.4.0. A specially crafted x509 certificate, when parsed by mbedTLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order ...

The vulnerability of the CRYPTO_ASSOC function in the ntpd daemon of the Network Time Protocol, allowing a intruder to cause a service failure.

The vulnerability of the CRYPTOASSOC function in the ntpd daemon of the Network Time Protocol is related to resource management errors. Exploiting this vulnerability could allow a malicious actor to cause a service failure e.g., memory usage issues...

SAP Redwood BPA Message Service crypto secret information disclosure

Application: SAP Redwood BPA Vendor URL: SAP Bugs: Information Disclosure Reported: 09.11.2017 Vendor response: 10.11.2017 Date of Public Advisory: 13.03.2018 Reference: SAP Security Note 2596535 Author: Mathieu Geli ERPScan DESCRIPTION An anonymous network attacker can forge valid packets that a...

The vulnerability of the Crypto-NAK packages, the demon program ntpd, the Network Time Protocol NTP, allows a perpetrator to bypass the authentication process.

The vulnerability of the Crypto-NAK packages, the demon program ntpd, and the Network Time Protocol NTP are related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to bypass authentication procedures...

Updated botan packages fix security vulnerability

Aleksandar Nikolic discovered that an error in the x509 parser of the Botan crypto library could result in an out-of-bounds memory read, resulting in denial of service or an information leak if processing a malformed certificate CVE-2017-2801...

Code injection

SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the aesEncrypt and aesDecrypt methods in the SimpleSAML/Utils/Crypto class to protect session identifiers in replies to non-HTTPS service providers...

CVE-2017-12870

SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the aesEncrypt and aesDecrypt methods in the SimpleSAML/Utils/Crypto class to protect session identifiers in replies to non-HTTPS service providers...

US Government Site Was Hosting Ransomware

As recently as Wednesday afternoon, a U.S. government website was hosting a malicious JavaScript downloader that led victims to installations of Cerber ransomware. Researcher Ankit Anubhav of NewSky Security tweeted the discovery Wednesday, and within hours, the malware link was taken down. It’s...

Turla APT Used WhiteBear Espionage Tools Against Defense Industry, Embassies

A toolset belonging to the Russian-speaking Turla APT has been publicly disclosed, and along with it details on its capabilities and indicators of compromise. The tools, called WhiteBear, were used to attack defense organizations as recently as June, and diplomatic targets in Europe, Asia and Sou...

Ross Anderson on the History of the Crypto Wars in the UK

Ross Anderson gave a talk on the history of the Crypto Wars in the UK. I am intimately familiar with the US story, but didn't know as much about Britain's verson. Hour-long video. Summary...

Ubuntu 12.04 LTS : python-crypto vulnerability (USN-3199-3)

USN-3199-1 fixed a vulnerability in Python Crypto. This update provides the corresponding update for Ubuntu 12.04 ESM. It was discovered that the ALGnew function in blocktemplace.c in the Python Cryptography Toolkit contained a heap-based buffer overflow vulnerability. A remote attacker could use...