Crypto flaws becoming a killer for Web applications

One of the few things that most people in the security community seem to agree on is that there is a dire need for better security around Web applications. That need begins with the lack of security training for most Web developers and extends through the inconsistent use of Web-application...

CVE-2009-1473

The 1 Windows and 2 Java client programs for the ATEN KH1516i IP KVM switch with firmware 1.0.063 and the KN9116 IP KVM switch with firmware 1.1.104 do not properly use RSA cryptography for a symmetric session-key negotiation, which makes it easier for remote attackers to a decrypt network traffi...

Input validation

The 1 Windows and 2 Java client programs for the ATEN KH1516i IP KVM switch with firmware 1.0.063 and the KN9116 IP KVM switch with firmware 1.1.104 do not properly use RSA cryptography for a symmetric session-key negotiation, which makes it easier for remote attackers to a decrypt network traffi...

CVE-2009-1473

The 1 Windows and 2 Java client programs for the ATEN KH1516i IP KVM switch with firmware 1.0.063 and the KN9116 IP KVM switch with firmware 1.1.104 do not properly use RSA cryptography for a symmetric session-key negotiation, which makes it easier for remote attackers to a decrypt network traffi...

CVE-2009-1473

The CVE-2009-1473 entry affects ATEN KH1516i (firmware 1.0.063) and KN9116 (firmware 1.1.104). The root cause is an insecure RSA-based handling of the symmetric session-key negotiation in the Windows/Java clients, enabling a remote attacker to decrypt traffic or perform MITM by replaying client-s...

NTP.org 'ntpd' Autokey Stack Overflow Vulnerability

NTP.org SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:ntp:ntp"; ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.900652";...

Bruce Schneier on Cryptography, Security Theater and the Psychology of Fear

Dennis Fisher talks with security expert Bruce Schneier about the usefulness of cryptography, the psychology of security and fear and the war on the unexpected after 9/11. Download Subscribe to the Digital Underground podcast on Podcast audio courtesy of George Wood...

RSA Cryptographer's Panel: Cloud Computing Takes Center Stage

Not so surprising, the state elders of cryptography had a few things to say about the security of cloud computing — but with little agreement. Whitfield Diffie, chief security officer at Sun Microsystems, kicked off the cloud security discussion, stating that while securing the cloud computing...

RedHat Security Advisory RHSA-2009:0402

The remote host is missing updates announced in advisory RHSA-2009:0402. Openswan is a free implementation of Internet Protocol Security IPsec and Internet Key Exchange IKE. IPsec uses strong cryptography to provide both authentication and encryption services. These services allow you to build...

RHEL 5 : openswan (RHSA-2009:0402)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:0402 advisory. Openswan is a free implementation of Internet Protocol Security IPsec and Internet Key Exchange IKE. IPsec uses strong cryptography to provi...

Important: Red Hat Security Advisory: openswan security update

Updated openswan packages that fix various security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Openswan is a free implementation of Internet Protocol Security IPsec and Internet Key...

CVE-2007-6721

The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."...

Design/Logic Flaw

The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."...

CVE-2007-6721

CVE-2007-6721 concerns the Legion of the Bouncy Castle Java Cryptography API (used in Crypto Provider Package) up to release 1.38; a Bleichenbacher vulnerability affects simple RSA CMS signatures without signed attributes. The exact impact is described as unknown in some sources, with remote atta...

CVE-2007-6721

The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."...

CVE-2007-6721

The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."...

PT-2009-1169 · Bouncy Castle · Crypto Provider Package +1

Name of the Vulnerable Software and Affected Versions: Bouncy Castle Java Cryptography API versions prior to 1.38 Crypto Provider Package versions prior to 1.36 Description: The issue is related to a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes, which has...

Analyze page Trojan how to encrypt code to evade kill-vulnerability warning-the black bar safety net

As the web hang horse popular, the virus also began to keep tabs on various web hang horse way, this let many hackers very annoyed. But hackers soon found a coping method, this method iswill hang horse web page code to be encrypted, disrupting the original code looks like, let the antivirus...

PyCrypto: Execution of arbitrary code

Background PyCrypto is the Python Cryptography Toolkit. Description Mike Wiacek of the Google Security Team reported a buffer overflow in the ARC2 module when processing a large ARC2 key length. Impact A remote attacker could entice a user or automated system to decrypt an ARC2 stream in an...

L0phtCrack password cracker set to return

More than two years after Symantec pulled the plug on L0phtCrack, the venerable password cracking tool is being prepped for a return to the spotlight. The original creators of L0phtCrack has reacquired the tool with plans to release a new version at next week’s SOURCE Boston conference. A teaser...