CVE-2015-1067

Secure Transport in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORTRSA ciphers via crafted TLS traffic, related to the "FREAK" issue...

Microsoft patches Stuxnet and FREAK Vulnerabilities

Microsoft has come up with its most important Patch Tuesday for this year, addressing the recently disclosed critical the FREAK encryption-downgrade attack, and a separate five-year-old vulnerability leveraged by infamous Stuxnet malware to infect Windows operating system. Stuxnet malware, a...

CVE-2015-1067

CVE-2015-1067 (Apple TLS FREAK issue) : Secure Transport on iOS (pre-8.2), OS X (≤10.10.2), and Apple TV (pre-7.1) could downgrade TLS to EXPORT_RSA ciphers via crafted traffic, enabling a cipher-downgrade attack related to the FREAK family. Affected products map to Apple SSL/TLS implementations;...

CVE-2015-1067

Secure Transport in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORTRSA ciphers via crafted TLS traffic, related to the "FREAK" issue...

March 2015 Microsoft Patch Tuesday Security Bulletins

Windows IT shops figure to be in for some scrambling today. Not only was it revealed that a five-year-old patch for a vulnerability exploited by Stuxnet was incomplete and machines have been exposed since 2010, but today is also Patch Tuesday and the updated Stuxnet patch is one of 14 bulletins...

Apple Fixes FREAK Bug, iCloud Flaw in iOS 8.2

Apple has patched the FREAK SSL vulnerability, along with a nasty bug that could’ve allowed a remote attacker to restart a user’s iPhone via SMS, with the release of iOS 8.2. The new version of Apple’s mobile operating system contains a number of vulnerability fixes, with the FREAK patch being th...

MS15-031: Vulnerability in Schannel Could Allow Security Feature Bypass (3046049) (FREAK)

The remote Windows host is affected by a security feature bypass vulnerability, known as FREAK Factoring attack on RSA-EXPORT Keys, due to the support of weak EXPORTRSA cipher suites with keys less than or equal to 512 bits. A man-in-the-middle attacker may be able to downgrade the SSL/TLS...

OracleVM 3.2 : openssl (OVMSA-2015-0029) (FREAK)

The remote OracleVM system is missing necessary patches to address critical security updates : - Backport openssl 08-Jan-2015 security fixes John Haxby orabug 20409893 - fix CVE-2014-3570 - Bignum squaring may produce incorrect results - fix CVE-2014-3571 - DTLS segmentation fault in dtls1getreco...

Microsoft Releases March 2015 Security Bulletin and Patches FREAK

Microsoft has released updates to address Windows vulnerabilities as part of the Microsoft Security Bulletin Summary for March 2015. Exploitation of one of these vulnerabilities FREAK could allow a remote attacker to decrypt secure communications between vulnerable clients and servers. US-CERT...

Dealing with FREAK and SuperFish

Security Dealing with FREAK and SuperFish Share March 10th, 2015 The FREAK TLS attack Following the trend of memorable names for TLS attacks, FREAK was recently announced. This exploits a bug in some TLS libraries, combined with the support of ancient weak ciphers, to enable a MitM to force...

Microsoft warning: Windows PC there are also Freak security vulnerability-vulnerability warning-the black bar safety net

Microsoft on Friday warned that hundreds of millions of Windows PC users are facing a“Freak”security vulnerability threats, and that a newly discovered security vulnerability was initially considered only for mobile devices and Apple Mac computers pose a threat. On Tuesday, by 9 The name of...

Apple Addresses FREAK and Releases Security Updates for OS X, iOS, and Apple TV

Apple has released security updates for OS X, iOS, and Apple TV to address multiple vulnerabilities, one of which may allow an attacker to decrypt secure communications between vulnerable clients and servers FREAK. Updates available include: Xcode 6.2 for OS X Mavericks v10.9.4 or later Security...

CVE-2015-1637

CVE-2015-1637 is listed in OpenSSL TLS Export Cipher Suite Downgrade advisories (FREAK family). IBM AIX/OpenSSL references indicate OpenSSL on AIX platforms is affected by export-RSA downgrade threats and provides fixes via interim patches (IV69033s9a/b/c) for openssl.base 1.0.1.513 on AIX 5.3/6....

CVE-2015-1637

Schannel aka Secure Channel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly restrict TLS state transitions, which makes it easier for...

Dennis Fisher and Mike Mimoso on the FREAK SSL Vulnerability and CSI: Cyber

Dennis Fisher and Mike Mimoso talk about the FREAK SSL vulnerability and the glorious debut of CSI: Cyber! Download: digitalunderground190.mp3 Music by Chris Gonsalves...

mono -- TLS bugs

The Mono project reports: Mono’s implementation of the SSL/TLS stack failed to check the order of the handshake messages. Which would allow various attacks on the protocol to succeed. Details of this vulnerability are discussed in SKIP-TLS post. Mono’s implementation of SSL/TLS also contained...

SSL/TLS implementations accept export-grade RSA keys (FREAK attack)

Overview Some implementations of SSL/TLS accept export-grade 512-bit or smaller RSA keys even when not specifically requesting export grade ciphers. An attacker able to act as a Man-in-The-Middle MiTM could factor weak temporary RSA keys, obtain session keys, and decrypt SSL/TLS trafflc. This iss...

SSL/TLS: RSA Temporary Key Handling 'RSA_EXPORT' Downgrade Issue (FREAK)

This host is accepting SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.805142";...

CVE-2 0 1 5-0 2 0 4 OpenSSL FREAK Attack vulnerability detection methods and repair recommendations-vulnerability warning-the black bar safety net

0×0 1 Introduction Near the Lantern Festival on the occasion, OpenSSL and because of the FREAK attack（also known as the Factoring Attack on RSA-EXPORT Keys vulnerability or CVE-2 0 1 5-0 2 0 4. the vulnerability fights uproar. Apple and Google are in on Tuesday indicated that they are fixing the...

FREAK

FREAK Factoring Attack on RSA-EXPORT Keys CVE-2015-0204 is a weakness in some implementations of SSL/TLS that may allow an attacker to decrypt secure communications between vulnerable clients and servers. Google has released an updated version of its Android OS and Chrome browser for OS X to...