[SECURITY] Fedora 18 Update: libreswan-3.7-1.fc18

Libreswan is a free implementation of IPsec & IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks. Everything passing through the...

Fedora Update for libreswan FEDORA-2013-23299

Check for the Version of libreswan OpenVAS Vulnerability Test Fedora Update for libreswan FEDORA-2013-23299 Authors: System Generated Check Copyright: Copyright C 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under t...

[SSLDigger v1.02] Tool to assess the strength of SSL

SSLDigger v1.02 is a tool to assess the strength of SSL servers by testing the ciphers supported. Some of these ciphers are known to be insecure. Features: full Browser Support using Microsoft Internet Explorer Browser Control support for operating the tool in batch modefor operating on multiple...

Fedora Update for mod_nss FEDORA-2013-22786

Check for the Version of modnss OpenVAS Vulnerability Test Fedora Update for modnss FEDORA-2013-22786 Authors: System Generated Check Copyright: Copyright C 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

CVE-2013-6394

Percona XtraBackup had an IV handling flaw (constant IV) up to 2.1.6, enabling plaintext-attacks against encrypted backups. The issue is acknowledged as a result of an incomplete fix; later advisories indicate that xbcrypt in 2.3.6 and 2.4.x before 2.4.5 does not properly set the IV, implying an ...

Improperly Issued Digital Certificates Could Allow Spoofing (Microsoft Security Advisory 2916652)

The remote host is missing either KB2677070 or KB2917500. If KB2677070 is installed, it is missing the latest auto-updates. Note that this plugin checks that the updaters have actually updated the disallowed CTL list, not that the KBs listed are installed. This approach was taken since the...

Matthew Green on How NSA Breaks SSL

In order for the National Security Agency to collect the massive amounts of communication it has from email and Web traffic, it needs to elude, leapfrog or bash through the barrier that is SSL. How it’s doing so is the real question, one that noted Johns Hopkins cryptographer Matthew Green wants...

RedHat Update for mod_nss RHSA-2013:1779-01

Check for the Version of modnss OpenVAS Vulnerability Test RedHat Update for modnss RHSA-2013:1779-01 Authors: System Generated Check Copyright: Copyright C 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

[SECURITY] Fedora 20 Update: mod_nss-1.0.8-24.fc20

The modnss module provides strong cryptography for the Apache Web server via the Secure Sockets Layer SSL and Transport Layer Security TLS protocols using the Network Security Services NSS security library...

Fedora Update for mod_nss FEDORA-2013-19976

Check for the Version of modnss OpenVAS Vulnerability Test Fedora Update for modnss FEDORA-2013-19976 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

Fedora Update for mod_nss FEDORA-2013-19985

Check for the Version of modnss OpenVAS Vulnerability Test Fedora Update for modnss FEDORA-2013-19985 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

TrueCrypt Audit Team Creates Technical Advisory Board

As the TrueCrypt audit chugs along toward a deterministic, clean build of the open-source encryption software and a palatable license, the organizers have brought prominent security and legal experts aboard as a technical advisory team. The experts will not only provide guidance on the current...

NIST Reviews Crypto Standards Development

The National Institute for Standards and Technology has taken an important step toward repairing what the National Security Agency has allegedly fractured by initiating a review of its cryptographic standards development processes. NIST-sponsored algorithms are at the heart of numerous crypto...

kernel: ansi_cprng: off by one error in non-block size request

Off-by-one error in the getprngbytes function in crypto/ansicprng.c in the Linux kernel through 3.11.4 makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via multiple requests for small amounts of data, leading to improper management of the state of the...

Crypto Party, Anti-Surveillance Rally in DC

WASHINGTON — Saturday marked the 12-year anniversary of the initial signing of the controversial USA PATRIOT Act, the anti-terrorism bill signed into law shortly after the terrorist attacks on Sept. 11, 2001, sections of which have allegedly given federal law enforcement the authority to...

PYSEC-2013-29

The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator PRNG before allowing a child process to access it, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging a race condition in which a...

TrueCrypt Audit Endorsed by Development Team

UPDATE — The effort to audit TrueCrypt, the open source encryption tool, received an important endorsement in the last week when a member of its anonymous development team reached out to the organizers of IsTrueCryptAuditedYet? “He wrote us a friendly but formal letter stating that they were happ...

/Dev/Random PRNG in Linux Questioned

The sanctity of the dev/random random number generator used in the Linux kernel has been a hot-button issue for more than a month. A petition posted to change.org in September to remove RdRand from dev/random, for example, was met with fury from Linus Torvalds who called the developer who posted ...

WhatsApp Crypto Implementation Vulnerability Discovered

WhatsApp, a popular mobile message application, suffers from crypto implementation vulnerability that leaves messages exposed. Thijs Alkemade, a computer science student at Utrecht University in The Netherlands who works on the open source Adium instant messaging project, disclosed a serious issu...

OWASP ESAPI Security Advisory: MAC Bypass in ESAPI Symmetric Encryption

OWASP ESAPI for Java Security Advisory 1 The OWASP Foundation MAC Bypass in ESAPI Symmetric Encryption Summary ======= Category: Symmetric cryptography Module: ESAPI Encryptor interface Announced: 2013-08-23 via ESAPI-Dev mailing list...