New Attack Uses SSL/TLS Information Leak to Hijack HTTPS Sessions

There is a feature supported by the SSL/TLS encryption standard and used by most of the major browsers that leaks enough information about encrypted sessions to enable attackers decrypt users’ supposedly protected cookies and hijack their sessions. The researchers who developed the attack that...

GnuTLS TLS Record Application GenericBlockCipher Parsing Integer Overflow (CVE-2012-1573)

An integer overflow vulnerability has been reported in GnuTLS. The vulnerability is due to improper handling of certain fields during the decryption process. A remote attacker can exploit this vulnerability by sending a specially crafted TLS Application Data packet to the server. Successful...

CVE-2012-2146

Elixir 0.8.0 uses Blowfish in CFB mode without constructing a unique initialization vector IV, which makes it easier for context-dependent users to obtain sensitive information and decrypt the database...

PYSEC-2012-13

Elixir 0.8.0 uses Blowfish in CFB mode without constructing a unique initialization vector IV, which makes it easier for context-dependent users to obtain sensitive information and decrypt the database...

UBUNTU-CVE-2012-2146

Elixir 0.8.0 uses Blowfish in CFB mode without constructing a unique initialization vector IV, which makes it easier for context-dependent users to obtain sensitive information and decrypt the database...

CVE-2012-2146

Elixir 0.8.0 uses Blowfish in CFB mode without constructing a unique initialization vector IV, which makes it easier for context-dependent users to obtain sensitive information and decrypt the database...

CVE-2012-2146

CVE-2012-2146 affects Elixir up to at least 0.8.0, where Blowfish in CFB mode is used without a unique initialization vector (IV). This weak IV construction can enable context-dependent users to obtain sensitive information and potentially decrypt the database. The connected documents confirm the...

PT-2012-3836

Name of the Vulnerable Software and Affected Versions Elixir versions prior to 0.8.0 Elixir versions 0.8.0 Description The issue arises from Elixir using Blowfish in CFB mode without constructing a unique initialization vector IV. This makes it easier for context-dependent users to obtain sensiti...

CVE-2012-2146: Undefined Security Weakness

Elixir 0.8.0 uses Blowfish in CFB mode without constructing a unique initialization vector IV, which makes it easier for context-dependent users to obtain sensitive information and decrypt the database...

PT-2012-2095

Name of the Vulnerable Software and Affected Versions Sophos SafeGuard Enterprise Device Encryption versions 5.x through 5.50.8.13 Sophos SafeGuard Easy Device Encryption Client version 5.50.x Sophos Disk Encryption version 5.50.x Description The issue concerns a delay in removing out-of-date and...

More Sophisticated DDoS Attack a New Threat to Apache Servers

A once flawed DDoS attack targeting the world’s most widely used Web servers has improved its cryptography and attack capabilities to become a more serious threat. MP-DDoser, also known as “IP-Killer,” uses a relatively new low-bandwidth, “asymmetrical” HTTP attack to inflict a denial-of-service...

SOL13607 - Hosts may generate weak RSA keys under low entropy conditions

A recent study, linked in the Supplemental Information section, has revealed that when a system generates new RSA keys under low-entropy conditions, such as during the first system boot, the resulting keys may not be cryptographically strong. During its first boot, the BIG-IP system generates...

Ubuntu 8.04 LTS / 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : openssl vulnerabilities (USN-1451-1)

Ivan Nestlerode discovered that the Cryptographic Message Syntax CMS and PKCS 7 implementations in OpenSSL returned early if RSA decryption failed. This could allow an attacker to expose sensitive information via a Million Message Attack MMA. CVE-2012-0884 It was discovered that an integer...

Ubuntu Update for openssl USN-1451-1

Ubuntu Update for Linux kernel vulnerabilities USN-1451-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN14511.nasl 7960 2017-12-01 06:58:16Z santu $ Ubuntu Update for openssl USN-1451-1 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This...

Ubuntu: Security Advisory (USN-1451-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-1451-1: OpenSSL vulnerabilities

Ivan Nestlerode discovered that the Cryptographic Message Syntax CMS and PKCS 7 implementations in OpenSSL returned early if RSA decryption failed. This could allow an attacker to expose sensitive information via a Million Message Attack MMA. CVE-2012-0884 It was discovered that an integer...

DSA-2454-2 openssl - incomplete fix

Bulletin has no description...

DSA-2454-1 openssl - multiple

Bulletin has no description...

Mind that signal

The pace of change in mobile spying applications is rapid. However, when it comes to intercepting phone calls in the field, phones that use the older 2G mobile communications standard are easier to crack. Often, organizations that want to carry out an attack will force a mobile device from 3G int...

SiteEngine 7.1 members to upload WEBSHELL vulnerability 0DAY-vulnerability warning-the black bar safety net

Author:hackdn Reprinted indicate the zend encoding and decryption is not complete, do not bother to look at the code, use a Tamper or the like of the plug-in test of the POST parameters, it's$sFile = $oFile'name';filtering too fool, looks like the 5th version after you modify a function. This is ...