zeromq3 / libzmq downgrade attack

Protocol version downgrade attack is possible...

[SECURITY] [DSA 3255-1] zeromq3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3255-1 [email protected] http://www.debian.org/security/ Alessandro Ghedini May 10, 2015 http://www.debian.org/security/faq -...

PT-2015-4365

Name of the Vulnerable Software and Affected Versions libzmq versions prior to 4.0.6 libzmq versions 4.1.x prior to 4.1.1 Description The issue allows remote attackers to conduct downgrade attacks, bypassing security mechanisms of the ZMTP v3 protocol by using a ZMTP v2 or earlier header...

CVE-2014-7202

streamengine.cpp in libzmq aka ZeroMQ/C++ 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request...

CVE-2014-7203

libzmq aka ZeroMQ/C++ 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors...

Design/Logic Flaw

libzmq aka ZeroMQ/C++ 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors...

UBUNTU-CVE-2014-7203

libzmq aka ZeroMQ/C++ 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors...

CVE-2014-7202

streamengine.cpp in libzmq aka ZeroMQ/C++ 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request...

Cross site request forgery (csrf)

streamengine.cpp in libzmq aka ZeroMQ/C++ 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request...

CVE-2014-7203

libzmq aka ZeroMQ/C++ 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors...

UBUNTU-CVE-2014-7202

streamengine.cpp in libzmq aka ZeroMQ/C++ 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request...

CVE-2014-7202

streamengine.cpp in libzmq aka ZeroMQ/C++ 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request...

CVE-2014-7203

libzmq aka ZeroMQ/C++ 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors...

CVE-2014-7203

libzmq aka ZeroMQ/C++ 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors...

CVE-2014-7202

CVE-2014-7202 affects libzmq (ZeroMQ/C++) 4.0.5 prior to 4.0.5, where stream_engine.cpp enables man‑in‑the‑middle downgrade attacks via a crafted connection request. Root cause is in the stream_engine handling; impact is MITM downgrade vulnerability. Remediation: upgrade to version 4.0.5 (or late...

CVE-2014-7203

libzmq (ZeroMQ/C++) 4.0.x before 4.0.5 exposes a replay vulnerability (CVE-2014-7203) because nonces are not guaranteed unique, enabling man-in-the-middle replay attacks via unspecified vectors. The issue is fixed in libzmq 4.0.5 (e.g., openSUSE/SUSE updates reference CVE-2014-7203 and CVE-2014-7...

CVE-2014-7202

streamengine.cpp in libzmq aka ZeroMQ/C++ 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request...

CVE-2014-7203

libzmq aka ZeroMQ/C++ 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors...

CVE-2014-7203: Undefined Security Weakness

libzmq aka ZeroMQ/C++ 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors...

CVE-2014-7202: Undefined Security Weakness

streamengine.cpp in libzmq aka ZeroMQ/C++ 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request...