libtasn1: multiple boundary check issues

Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 before 3.6, as used in GnuTLS, allow remote attackers to cause a denial of service out-of-bounds read via crafted ASN.1 data...

libtasn1: asn1_get_bit_der() can return negative bit length

The asn1getbitder function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN.1 data...

Moderate: Red Hat Security Advisory: libtasn1 security update

Updated libtasn1 packages that fix three security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

libtasn1 security update

2.3-6 - added check for null pointer 1102336 2.3-5 - fix various DER decoding issues 1102336 2.3-4 - fix CVE-2012-1569 - missing length check when decoding DER lengths 804920...

Ruby OpenSSL CA private key forgery vulnerability-vulnerability warning-the black bar safety net

The Ruby OpenSSL CA private key forgery vulnerability require ‘rubygems’ require ‘openssl’ require 'digest/md5' key = OpenSSL::PKey::RSA. new2 0 4 8 cipher = OpenSSL::Cipher::AES. new2 5 6, :CBC ctx = OpenSSL::SSL::SSLContext. new puts “Spoof must be in DER format and saved as root. cer” raw =...

Ruby OpenSSL CA私钥伪造漏洞

Bugtraq ID:66956 CVE ID:CVE-2014-2734 Yukihiro Matsumoto Ruby是一款功能强大的面向对象的脚本语言。 Yukihiro Matsumoto Ruby OpenSSL存在一个安全漏洞，允许攻击者利用漏洞伪造CA私钥。 0 Ruby 目前没有详细解决方案： http://www.ruby-lang.org/ require 'rubygems' require 'openssl' require 'digest/md5' key = OpenSSL::PKey::RSA.new2048 cipher =...

Sercomm TCP/32674 - Backdoor Reactivation

/ PoC to reactivate Sercomm TCP/32674 backdoor See http://www.synacktiv.com/ressources/TCP32764backdooragain.pdf Eloi Vanderbeken - Synacktiv THIS SOFTWARE IS PROVIDED BY SYNACKTIV ''AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF...

Worst Data Breach in German History, 18 Million Email Passwords Compromised

Germany has confirmed its biggest Data theft in the country's history with usernames and passwords of some 18 million email accounts stolen and compromised by hackers. The Story broke by the German press, Der Spiegel on Thursday, when German Authorities revealed another mass hacking of private da...

Jacob Appelbaum 2013 30c3 keynote on NSA Surveillance

Cryptographer, developer and activist Jacob Appelbaum took to the pages of Germany’s Der Spiegel and the keynote dais of the 30th Chaos Communication Congress this weekend to deliver a damning expose of the catalog of backdoors, monitoring programs and products that potentially have and could be...

IT-Grundschutz M4.135: Restriktive Vergabe von Zugriffsrechten auf Systemdateien

IT-Grundschutz M4.135: Restriktive Vergabe von Zugriffsrechten auf Systemdateien. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94215 Stand: 13. Ergänzungslieferung 1...

IT-Grundschutz M4.014: Obligatorischer Passwortschutz unter Unix

IT-Grundschutz M4.014: Obligatorischer Passwortschutz unter Unix. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94181 Stand: 13. Ergänzungslieferung 13. EL. OpenVAS...

IT-Grundschutz M5.147: Absicherung der Kommunikation mit Verzeichnisdiensten (Windows)

IT-Grundschutz M5.147: Absicherung der Kommunikation mit Verzeichnisdiensten Windows. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94172 Stand: 13. Ergänzungslieferu...

Interalp Touristik SQL Injection

Exploit Title : Interalp Touristik Sql injection Vulnerabilites Exploit Author : Ashiyane Digital Security Team Software Link : http://interalp-touristik.com Tested on: Windows 7 , Linux Google Dork : intext:"powered by Interalp Touristik" Date: 2013/09/10...

NSA can access your data on Smartphones including iPhone, BlackBerry and Android devices

National Security Agency NSA has the capability to access a broad range of data on most Smartphones out there, including iPhone, BlackBerry, and Android devices, according to the documents provided by former US intelligence contractor Edward Snowden to the German news agency Der Spiegel report. A...

NSA can access your data on Smartphones including iPhone, BlackBerry and Android devices

National Security Agency NSA has the capability to access a broad range of data on most Smartphones out there, including iPhone, BlackBerry, and Android devices, according to the documents provided by former US intelligence contractor Edward Snowden to the German news agency Der Spiegel report. A...

Amazon Linux AMI : libtasn1 (ALAS-2012-60)

A flaw was found in the way libtasn1 decoded DER data. An attacker could create carefully-crafted DER encoded input such as an X.509 certificate that, when parsed by an application that uses libtasn1 such as applications using GnuTLS, could cause the application to crash. CVE-2012-1569 C Tenable...

Amazon Linux AMI : openssl (ALAS-2012-72)

Multiple numeric conversion errors, leading to a buffer overflow, were found in the way OpenSSL parsed ASN.1 Abstract Syntax Notation One data from BIO OpenSSL's I/O abstraction inputs. Specially crafted DER Distinguished Encoding Rules encoded data read from a file or other BIO input could cause...

[SECURITY] Fedora 18 Update: nodejs-asn1-0.1.11-3.fc18

nodejs-asn1 is a library for encoding and decoding Abstract Syntax Notation One ASN.1 datatypes in pure JavaScript. ASN.1 is is a standard and notation that describes rules and structures for representing, encoding, transmitting, and decoding data in telecommunications and computer networking...

Snowden Confirms Stuxnet Malware developed by NSA and Israel Together

In an interview with Germany's Der Spiegel Magazine, American whistleblower Edward Snowden has Confirmed that Stuxnet Malware was developed by NSA and Israel Together. Stuxnet made international headlines in 2010 for specifically target a uranium enrichment facility in Natanz, Iran. Stuxnet was...

Snowden Confirms Stuxnet Malware developed by NSA and Israel Together

In an interview with Germany’s Der Spiegel Magazine, American whistleblower Edward Snowden has Confirmed that Stuxnet Malware was developed by NSA and Israel Together. Stuxnet made international headlines in 2010 for specifically target a uranium enrichment facility in Natanz, Iran. Stuxnet was...