PT-2010-5014 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 2.6.36 Description: The issue is related to the sctp auth asoc get hmac function in the Linux kernel, which does not properly validate the hmac ids array of an SCTP peer. This allows remote attackers to cause a...

Microsoft .Net XML signing protection bypass

Only part of signature is compared in case of incomplete HMAC...

Microsoft .NET Framework XML HMAC Truncation Vulnerability (981343)

This host is missing a critical security update according to Microsoft Bulletin MS10-041. OpenVAS Vulnerability Test $Id: secpodms10-041.nasl 5361 2017-02-20 11:57:13Z cfi $ Microsoft .NET Framework XML HMAC Truncation Vulnerability 981343 Authors: Antu Sanadi Updated By: Madhuri D on 2010-11-15 ...

Microsoft .NET Framework XML HMAC Truncation Vulnerability (981343)

This host is missing a critical security update according to Microsoft Bulletin MS10-041. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

OpenJDK MessageDigest.isEqual introduces timing attack vulnerabilities (6863503)

The MessageDigest.isEqual function in Java Runtime Environment JRE in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.127, and SDK and JRE 1.4.x before 1.4.224 allows remote attackers to spoof HMAC-based digital signatures, and possibl...

Ubuntu Update for openoffice.org vulnerabilities USN-903-1

Ubuntu Update for Linux kernel vulnerabilities USN-903-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN9031.nasl 7965 2017-12-01 07:38:25Z santu $ Ubuntu Update for openoffice.org vulnerabilities USN-903-1 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH,...

Ubuntu: Security Advisory (USN-903-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 8.04 LTS / 8.10 / 9.04 / 9.10 : openoffice.org vulnerabilities (USN-903-1)

It was discovered that the XML HMAC signature system did not correctly check certain lengths. If an attacker sent a truncated HMAC, it could bypass authentication, leading to potential privilege escalation. CVE-2009-0217 Sebastian Apelt and Frank Reissner discovered that OpenOffice did not...

USN-903-1: OpenOffice.org vulnerabilities

It was discovered that the XML HMAC signature system did not correctly check certain lengths. If an attacker sent a truncated HMAC, it could bypass authentication, leading to potential privilege escalation. CVE-2009-0217 Sebastian Apelt and Frank Reißner discovered that OpenOffice did not correct...

Debian DSA-1849-1 : xml-security-c - design flaw

It was discovered that the W3C XML Signature recommendation contains a protocol-level vulnerability related to HMAC output truncation. This update implements the proposed workaround in the C++ version of the Apache implementation of this standard, xml-security-c, by preventing truncation to outpu...

Sun OpenOffice.org < 3.2 Multiple Vulnerabilities

The version of Sun Microsystems OpenOffice.org installed on the remote host is prior to version 3.2. It is, therefore, affected by several issues : - Signatures may not be handled properly due to a vulnerability in the libxml2 library. CVE-2006-4339 - There is an HMAC truncation authentication...

OpenJDK MessageDigest.isEqual introduces timing attack vulnerabilities (6863503)

The MessageDigest.isEqual function in Java Runtime Environment JRE in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.127, and SDK and JRE 1.4.x before 1.4.224 allows remote attackers to spoof HMAC-based digital signatures, and possibl...

SuSE9 Security Update : IBM Java2 JRE and SDK (YOU Patch Number 12565)

IBM Java 1.4.2 was updated to 13 fp3. The following security issues were fixed : - A buffer overflow vulnerability in the Java Runtime Environment audio system might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself...

xml-security-1.3.0-1jpp.ep1.*: XMLDsig HMAC-based signatures spoofing and authentication bypass

The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in products including 1 the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; 2 the WebLogic Server component in BEA Product Suite 10.3, 10.0...

OpenJDK MessageDigest.isEqual introduces timing attack vulnerabilities (6863503)

The MessageDigest.isEqual function in Java Runtime Environment JRE in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.127, and SDK and JRE 1.4.x before 1.4.224 allows remote attackers to spoof HMAC-based digital signatures, and possibl...

GLSA-200912-02 : Ruby on Rails: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200912-02 Ruby on Rails: Multiple vulnerabilities The following vulnerabilities were discovered: sameer reported that lib/actioncontroller/cgiprocess.rb removes the :cookieonly attribute from the default session options...

Mandriva Security Advisory MDVSA-2009:318 (xmlsec1)

The remote host is missing an update to xmlsec1 announced via advisory MDVSA-2009:318. OpenVAS Vulnerability Test $Id: mdksa2009318.nasl 6573 2017-07-06 13:10:50Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:318 xmlsec1 Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft...

Mandriva Security Advisory MDVSA-2009:322 (mono)

The remote host is missing an update to mono announced via advisory MDVSA-2009:322. OpenVAS Vulnerability Test $Id: mdksa2009322.nasl 6573 2017-07-06 13:10:50Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:322 mono Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

Mandriva Security Advisory MDVSA-2009:322 (mono)

The remote host is missing an update to mono announced via advisory MDVSA-2009:322. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

Mandriva Security Advisory MDVSA-2009:318 (xmlsec1)

The remote host is missing an update to xmlsec1 announced via advisory MDVSA-2009:318. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...