Practical SHA-1 Collision Attack Months Away

When Bruce Schneier made his oft-cited and mathematically sound projections about the life expectancy of the SHA-1 cryptographic algorithm, he didn’t think he was being conservative. “I thought I was being accurate given the information I had at the time,” Schneier said on Thursday. Schneier in...

Collision Attack: Widely Used SHA-1 Hash Algorithm Needs to Die Immediately

SHA-1 – one of the Internet's widely adopted cryptographic hash function – is Just about to Die. Yes, the cost and time required to break the SHA1 algorithm have fallen much faster than previously expected. According to a team of researchers, SHA-1 is so weak that it may be broken and compromised...

Cobham Aviator satellite terminals contain multiple vulnerabilities

Overview Cobham Aviator 700D and 700E satellite terminals contain multiple vulnerabilities. Description Cobham Aviator 700D and 700E satellite communication terminals contain the following vulnerabilities:CWE-327:Use of a Broken or Risky Cryptographic Algorithm - CVE-2014-2942 Please note that th...

OpenDrive <= 1.3.141 Local Password Disclosure

No description provided by source. / Title: OpenDrive = 1.3.141 Local Password Disclosure Authors: Glafkos Charalambous, George Nicolaou Contact: glafkosatastalavistadotcom, ishtusatastalavistadotcom Version: 1.3.141 Vendor: http://www.opendrive.com Description: Authentication credentials used by...

Analyze Cryptographic Specifications: Cryptol

The Cryptol specification language was designed by Galois for the NSA’s Trusted Systems Research Group as a public standard for specifying cryptographic algorithms. A reference specification can serve as the formal documentation for a cryptographic module. Unlike current specification mechanisms,...

CVE-2007-6755: Use of a Broken or Risky Cryptographic Algorithm

The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation DualECDRBG algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection...

CVE-2012-5575

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic...

Code injection

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic...

CVE-2012-5575

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic...

SHA-3 Winner Chosen, But It May Be Years Before Keccak Has an Effect

Now that NIST has selected Keccak as the winner of the five-year-long SHA-3 competition, the next question to be answered is whether the new hash algorithm will be implemented in any meaningful way in the near future. The answer, for right now at least, appears to be probably not. The SHA-3...

Flame Attackers Used Collision Attack to Forge Microsoft Certificate

The attackers behind the Flame malware used a collision attack against a cryptographic algorithm as part of the method for gaining a forged certificate to sign specific components of the attack tool. Microsoft officials said on Tuesday that it’s imperative for customers to install the update issu...

OpenDrive <= 1.3.141 Local Password Disclosure

Exploit for windows platform in category local exploits / Title: OpenDrive include include int ReadRegistryKey LPBYTE lpBuffer, LPDWORD lpBufferSize, HKEY hKey, LPCTSTR lpszSubKey, LPCTSTR lpszValueName HKEY hKeyLocal; int nType; if RegOpenKeyExhKey, lpszSubKey, 0, KEYREAD, &hKeyLocal ==...

OpenDrive 1.3.141 - Local Password Disclosure

/ Title: OpenDrive include include int ReadRegistryKey LPBYTE lpBuffer, LPDWORD lpBufferSize, HKEY hKey, LPCTSTR lpszSubKey, LPCTSTR lpszValueName HKEY hKeyLocal; int nType; if RegOpenKeyExhKey, lpszSubKey, 0, KEYREAD, &hKeyLocal == ERRORSUCCESS if RegQueryValueEx hKeyLocal, lpszValueName, 0,...

OpenDrive 1.3.141 - Local Password Disclosure

OpenDrive 1.3.141 - Local Password Disclosure / Title: OpenDrive include include int ReadRegistryKey LPBYTE lpBuffer, LPDWORD lpBufferSize, HKEY hKey, LPCTSTR lpszSubKey, LPCTSTR lpszValueName HKEY hKeyLocal; int nType; if RegOpenKeyExhKey, lpszSubKey, 0, KEYREAD, &hKeyLocal == ERRORSUCCESS if...

Debian Security Advisory DSA 2054-2 (bind9)

The remote host is missing an update to bind9 announced via advisory DSA 2054-2. OpenVAS Vulnerability Test $Id: deb20542.nasl 6614 2017-07-07 12:09:12Z cfischer $ Description: Auto-generated from advisory DSA 2054-2 bind9 Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

Hash brute force attack-vulnerability warning-the black bar safety net

Name: the end Tutorial: Hash brute force attack Nature: the translation of the article Time: 2 0 1 0 3 2 7 on Saturday ------------------------------------The above information↑------------------------------------ --------------------------------------The content of the...

CVE-2009-2273: Use of a Broken or Risky Cryptographic Algorithm

The default configuration of the Wi-Fi component on the Huawei D100 does not use encryption, which makes it easier for remote attackers to obtain sensitive information by sniffing the network...

For the Bluetooth PIN code of the latest attack techniques details of the analysis-vulnerability warning-the black bar safety net

Note: This Chapter is just to explain the determination for the Bluetooth PIN code of the latest attack techniques, in order to draw attention to prevention, and no other purpose. No person shall use in this article the description of the technology to do illegal things. Recently, many domestic a...

OpenSSL Version Rollback and Weak Cryptographic Algorithm Vulnerabilities

OpenSSL contains vulnerabilities that could allow an unauthenticated, remote attacker to bypass security restrictions. The first vulnerability CVE-2005-2969 affects any application using a SL/TLS server implementation provided by OpenSSL versions 0.9.7g and prior. If these implementations have...

CVE-2005-2946: Use of a Broken or Risky Cryptographic Algorithm

The default configuration on OpenSSL before 0.9.8 uses MD5 for creating message digests instead of a more cryptographically strong algorithm, which makes it easier for remote attackers to forge certificates with a valid certificate authority signature...