TLS: MITM attacks via session renegotiation

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...

Mandriva Update for rootcerts MDVA-2010:100 (rootcerts)

Check for the Version of rootcerts OpenVAS Vulnerability Test Mandriva Update for rootcerts MDVA-2010:100 rootcerts Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

cURL/libcURL CURLOPT_ENCODING选项缓冲区溢出漏洞

BUGTRAQ ID: 38162 cURL是命令行传输文件工具，支持FTP、FTPS、HTTP、HTTPS、GOPHER、TELNET、DICT、FILE和LDAP。 在下载数据时，libcurl库使用客户端软件所注册的回调函数将数据传送给应用程序，在完成传输之前会反复的调用该函数。回调函数可接收的最大数据大小为16K（CURLMAXWRITESIZE）。 在HTTP上使用libcurl库下载压缩的内容时应用程序可以要求libcurl自动解压数据。而解压期间libcurl可能错误的向回调函数发送最多可为64K的数据，因此盲目信任libcurl的最大缓冲区限制的应用可能会出现缓冲区溢出。...

CVE-2010-0660

Google Chrome before 4.0.249.78 sends an https URL in the Referer header of an http request in certain circumstances involving https to http redirection, which allows remote HTTP servers to obtain potentially sensitive information via standard HTTP logging...

CVE-2010-0660

Google Chrome before 4.0.249.78 sends an https URL in the Referer header of an http request in certain circumstances involving https to http redirection, which allows remote HTTP servers to obtain potentially sensitive information via standard HTTP logging...

CVE-2010-0660

Removed by vendor...

CVE-2010-0660

Google Chrome before 4.0.249.78 sends an https URL in the Referer header of an http request in certain circumstances involving https to http redirection, which allows remote HTTP servers to obtain potentially sensitive information via standard HTTP logging...

CVE-2010-0660

CVE-2010-0660 affects Google Chrome prior to 4.0.249.78. The issue arises when Chrome sends an https URL in the Referer header of an http request during https→http redirection, enabling remote servers to log and potentially obtain sensitive information via standard HTTP logs. Affected component i...

Cisco IronPort Encryption Appliance multiple security vulnerabilities

Multiple vulnerabilities in HTTPS interface...

CVE-2010-0145

Unspecified vulnerability in the embedded HTTPS server on the Cisco IronPort Encryption Appliance 6.2.x before 6.2.9.1 and 6.5.x before 6.5.2, and the IronPort PostX MAP before 6.2.9.1, allows remote attackers to execute arbitrary code via unknown vectors, aka IronPort Bug 65923...

Code injection

Unspecified vulnerability in the WebSafe DistributorServlet in the embedded HTTPS server on the Cisco IronPort Encryption Appliance 6.2.x before 6.2.9.1 and 6.5.x before 6.5.2, and the IronPort PostX MAP before 6.2.9.1, allows remote attackers to read arbitrary files via unknown vectors, aka...

Code injection

Unspecified vulnerability in the administrative interface in the embedded HTTPS server on the Cisco IronPort Encryption Appliance 6.2.x before 6.2.9.1 and 6.5.x before 6.5.2, and the IronPort PostX MAP before 6.2.9.1, allows remote attackers to read arbitrary files via unknown vectors, aka IronPo...

CVE-2010-0144

Unspecified vulnerability in the WebSafe DistributorServlet in the embedded HTTPS server on the Cisco IronPort Encryption Appliance 6.2.x before 6.2.9.1 and 6.5.x before 6.5.2, and the IronPort PostX MAP before 6.2.9.1, allows remote attackers to read arbitrary files via unknown vectors, aka...

CVE-2010-0143

Unspecified vulnerability in the administrative interface in the embedded HTTPS server on the Cisco IronPort Encryption Appliance 6.2.x before 6.2.9.1 and 6.5.x before 6.5.2, and the IronPort PostX MAP before 6.2.9.1, allows remote attackers to read arbitrary files via unknown vectors, aka IronPo...

CVE-2010-0145

Cisco IronPort Encryption Appliance versions 6.2.x before 6.2.9.1, 6.5.x before 6.5.2, and IronPort PostX MAP before 6.2.9.1 are affected by CVE-2010-0145. The vulnerability is a remote code execution flaw in the embedded HTTPS server (IronPort Bug 65923) that allows an unauthenticated, remote at...

CVE-2010-0144

Unspecified vulnerability in the WebSafe DistributorServlet in the embedded HTTPS server on the Cisco IronPort Encryption Appliance 6.2.x before 6.2.9.1 and 6.5.x before 6.5.2, and the IronPort PostX MAP before 6.2.9.1, allows remote attackers to read arbitrary files via unknown vectors, aka...

CVE-2010-0143

CVE-2010-0143 affects Cisco IronPort Encryption Appliance and IronPort PostX MAP prior to versions 6.2.9.1/6.5.2 (and MAP before 6.2.9.1). The vulnerability is an unspecified information-disclosure in the embedded HTTPS server’s administrative interface, allowing remote attackers to read arbitrar...

Researchers Discover New ACH Banker Trojan

Malware hunters at SecureWorks have intercepted a new banker Trojan being used by cyber-criminals to steal financial credentials from banks in the U.S. The Trojan, dubbed “Bugat,” targets Automated Clearing House ACH and wire transfer transactions by small- and mid-sized business in the U.S., muc...

Aruba Advisory ID: AID-020810 TLS Protocol Session Renegotiation Security Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Aruba Networks Security Advisory Title: TLS Protocol Session Renegotiation Security Vulnerability Aruba Advisory ID: AID-020810 Revision: 1.0 For Public Release on 02/08/2010 +---------------------------------------------------- SUMMARY This advisory...

Internet Explorer Install Engine Buffer Overflow (CVE-2004-0216)

Microsoft Internet Explorer is a popular web browser bundled with the Microsoft Windows operating system. The browser is capable of communicating with HTTP and HTTPS compliant servers. The browser also has the capability to launch locally-installed libraries, or ActiveX controls, embedded in web...