5666 matches found
OpenJDK: PKCS#8 implementation timing attack (JCE, 8176760)
A covert timing channel flaw was found in the PKCS8 implementation in the JCE component of OpenJDK. A remote attacker able to make a Java application repeatedly compare PKCS8 key against an attacker controlled value could possibly use this flaw to determine the key via a timing side channel...
OpenJDK: PKCS#8 implementation timing attack (JCE, 8176760)
A covert timing channel flaw was found in the PKCS8 implementation in the JCE component of OpenJDK. A remote attacker able to make a Java application repeatedly compare PKCS8 key against an attacker controlled value could possibly use this flaw to determine the key via a timing side channel...
CVE-2017-1224
IBM Tivoli Endpoint Manager uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 123903...
CVE-2017-1224
IBM Tivoli Endpoint Manager uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 123903...
CVE-2016-10398
Android 6.0 has an authentication bypass for attackers with root and physical access. Cryptographic authentication tokens AuthTokens used by the Trusted Execution Environment TEE are protected by a weak challenge. This allows adversaries to replay previously captured responses and use the TEE...
Authentication flaw
On iSmartAlarm cube devices, there is authentication bypass leading to remote execution of commands e.g., setting the alarm on/off, related to incorrect cryptography...
CVE-2017-7728
On iSmartAlarm cube devices, there is authentication bypass leading to remote execution of commands e.g., setting the alarm on/off, related to incorrect cryptography...
CVE-2017-7728
On iSmartAlarm cube devices, there is authentication bypass leading to remote execution of commands e.g., setting the alarm on/off, related to incorrect cryptography...
CVE-2017-7728
The CVE-2017-7728 entry concerns iSmartAlarm cube devices, where an Authentication Bypass allows remote execution of alarm controls. The connected material confirms: (a) vulnerability type is Authentication Bypass leading to remote command execution (e.g., Arm/Disarm, Siren control); (b) root cau...
Researchers Crack 1024-bit RSA Encryption in GnuPG Crypto Library
Security boffins have discovered a critical vulnerability in a GnuPG cryptographic library that allowed the researchers to completely break RSA-1024 and successfully extract the secret RSA key to decrypt data. Gnu Privacy Guard GnuPG or GPG is popular open source encryption software used by many...
Archive Cryptography: unarcrypto
Archive Cryptography unarcrypto.py is an educational tool to depict the use of cryptography for password verification, headers and content encryption by popular archivers: zip, 7zip, rar v3 and v5. Supported archives format, encryption and compression algorithms: zip password protected or not,...
Command injection
A Weak Cryptography for Passwords issue was discovered in General Electric GE Multilin SR 750 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 760 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 469 Motor Protection Relay, firmware versions prior to Versio...
CVE-2017-7905
The CVE covers a weakness in cryptographic handling of passwords in GE Multilin protection relays (SR series, UR/URPlus). A non-random initialization vector was used for ciphertext passwords, making them vulnerable to dictionary attacks. Password ciphertext could be obtained from the front LCD or...
CVE-2017-7905
A Weak Cryptography for Passwords issue was discovered in General Electric GE Multilin SR 750 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 760 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 469 Motor Protection Relay, firmware versions prior to Versio...
Path Traversal Via NUL Characters
pkg/crypto in github.com/golang/go is susceptible to path traversal attacks. The attacks are possible because it does not properly handle the NUL bytes if any string arguments to syscall contain them. If the filename contains NUL bytes \x00 , it may allow access to a subdirectory or "root"...
Historical courses and resorts in Elliptic Curves Cryptography - Is Curve25519 dead?
tl;dr This short blog post serves to me to recollect some of the thing I have been learning climbing about Elliptic Curves Cryptography ECC from now on during the last months/years, so please take it with a grain of salt since it might contains some erroneous beliefs. '80 - Introduction...
NSA Opens Github Account — Lists 32 Projects Developed by the Agency
The National Security Agency NSA — the United States intelligence agency which is known for its secrecy and working in the dark — has finally joined GitHub and launched an official GitHub page. The NSA employs genius-level coders and brightest mathematicians, who continually work to break codes,...
UBUNTU-CVE-2017-9526
In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key from side-channel observation during the signing process can easily recover the long-term secret key. 1.7.7 makes a cipher/ecc-eddsa.c change to store this session key in secure memory, to ensure that constant-time point...
Design/Logic Flaw
IBM BigFix Compliance Analytics 1.9.79 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 123431...