USN-2864-1: NSS vulnerability

Karthikeyan Bhargavan and Gaetan Leurent discovered that NSS incorrectly allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to view sensitive information...

USN-2863-1: OpenSSL vulnerability

Karthikeyan Bhargavan and Gaetan Leurent discovered that OpenSSL incorrectly allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to view sensitive information...

Moderate: Red Hat Security Advisory: nss security update

Updated nss packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

SLOTH Collisions Attacks Against SHA-1, MD5 in TLS, IKE, SSH

If you’re hanging on to the theory that collision attacks against SHA-1 and MD5 aren’t yet practical, two researchers from INRIA, the French Institute for Research in Computer Science and Automation, have demonstrated new attacks that raise the urgency to move away from these broken cryptographic...

nss security update

3.19.1-8.0.1 - Added nss-vendor.patch to change vendor 3.19.1-8 - Prevent TLS 1.2 Transcript Collision attacks against MD5 in key exchange protocol - Resolves: Bug 1289881...

gnutls security update

3.3.8-14 - Prevent downgrade attack to RSA-MD5 in server key exchange. 3.3.8-13 - Corrected reseed and respect of maxnumberofbitsperrequest in FIPS140-2 mode. Also enhanced the initial tests. 1228199...

openssl security update

1.0.1e-42.2 - fix CVE-2015-7575 - disallow use of MD5 in TLS1.2...

Threat Outbreak Alert RuleID20319: Email Messages Distributing Malicious Software on December 31, 2015

Medium Alert ID: 42886 First Published: 2016 January 5 13:21 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID20319 may contain the following files: Name |...

Threat Outbreak Alert RuleID20309: Email Messages Distributing Malicious Software on January 4, 2016

Medium Alert ID: 42880 First Published: 2016 January 4 15:24 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID20309 may contain the following files: Name |...

Threat Outbreak Alert RuleID20307: Email Messages Distributing Malicious Software on January 4, 2016

Medium Alert ID: 42878 First Published: 2016 January 4 14:20 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID20307 may contain the following files: Name |...

Threat Outbreak Alert RuleID20295: Email Messages Distributing Malicious Software on January 4, 2016

Medium Alert ID: 42875 First Published: 2016 January 4 14:20 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID20295 may contain the following files: Name |...

Threat Outbreak Alert RuleID20292: Email Messages Distributing Malicious Software on December 25, 2015

Medium Alert ID: 42874 First Published: 2016 January 4 14:20 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID20292 may contain the following files: Name |...

mbedTLS/PolarSSL -- SLOTH attack on TLS 1.2 server authentication

ARM Limited reports: MD5 handshake signatures in TLS 1.2 are vulnerable to the SLOTH attack on TLS 1.2 server authentication. They have been disabled by default. Other attacks from the SLOTH paper do not apply to any version of mbed TLS or PolarSSL...

openSUSE Security Update : mozilla-nss (openSUSE-2015-978) (SLOTH)

This update to mozilla-nss 3.20.2 fixes the following issues : - CVE-2015-7575: MD5 signatures accepted within TLS 1.2 ServerKeyExchange in server signature boo952810 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

CVE-2015-7575

Mozilla Network Security Services NSS before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof...

UBUNTU-CVE-2015-7575

Mozilla Network Security Services NSS before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof...

FreeBSD : NSS -- MD5 downgrade in TLS 1.2 signatures (10f7bc76-0335-4a88-b391-0b05b3a8ce1c) (SLOTH)

The Mozilla Project reports : Security researcher Karthikeyan Bhargavan reported an issue in Network Security Services NSS where MD5 signatures in the server signature within the TLS 1.2 ServerKeyExchange message are still accepted. This is an issue since NSS has officially disallowed the accepti...

Seemingly tasteless ESPCMS background injected, can actually be a lot of fun-vulnerability warning-the black bar safety net

Yesterday, the black bar safety net loophole platform exposes a ESPCMS of injection vulnerabilities, Ali cloud computing security attack and defense against a team of friends first time on the vulnerability to do an impact assessment. Did not think need to login to the backend before it can be...

Threat Outbreak Alert RuleID20278: Email Messages Distributing Malicious Software on December 24, 2015

Medium Alert ID: 42862 First Published: 2015 December 24 16:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID20278 may contain the following files: Name |...

Threat Outbreak Alert RuleID20274: Email Messages Distributing Malicious Software on December 24, 2015

Medium Alert ID: 42861 First Published: 2015 December 24 16:18 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID20274 may contain the following files: Name |...