CVE-2011-4314

CVE-2011-4314 affects OpenID4Java, where AxMessage.java did not verify that Attribute Exchange (AX) data is signed. This allows a remote attacker to modify AX information during MITM without detection. The issue is present in OpenID4Java prior to 0.9.6 final and is used by products such as JBoss ...

CVE-2011-4314

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify...

CVE-2011-4407

ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle MITM attackers to spoof GPG keys for a package repository...

Android Network Toolkit (ANTI) Review - Pentest at the push of a button

This Post reviews the newly released ANTI3 version. We've received a platinum account of ANTI3, before its official release, and this is our review: Recently White-Hat Hacker, Itzhak "Zuk" Avraham, the founder of zImperium unveiled its new app in Blackhat / Defcon19, introducing a new concept whe...

Smart Hacking For Privacy : What TV shows you watch ?

Smart Hacking For Privacy : What TV shows you watch ? White-hat hackers have exposed the privacy shortcomings of smart meter technology. At the Chaos Communication Congress in Germany, 28C3, researchers presented "Smart Hacking For Privacy" After analyzing data collected by a smart meter, these...

SuSE 11.1 Security Update : puppet (SAT Patch Number 5421)

The following security issues have been fixed : - Puppet's certificate authority issued Puppet agent certificates capable of impersonating the Puppet master. Compromised or rogue puppet agents could therefore use their certificates for MITM attacks. CVE-2011-3872 Note: If you've set the...

SuSE 11.1 Security Update : NetworkManager (SAT Patch Number 5381)

NetworkManager did not pin a certificate's subject to an ESSID. A rogue access point could therefore be used to conduct MITM attacks by using any other valid certificate issued by same CA as used in the original network CVE-2006-7246. This has been fixed. Please note that existing WPA2 Enterprise...

SuSE 11.1 Security Update : NetworkManager (SAT Patch Number 5381)

NetworkManager did not pin a certificate's subject to an ESSID. A rogue access point could therefore be used to conduct MITM attacks by using any other valid certificate issued by same CA as used in the original network CVE-2006-7246. This has been fixed. Please note that existing WPA2 Enterprise...

Insecure RSA Encryption in jCryption, PEAR Crypt_RSA and Crypt_RSA2

SWITCH-CERT SECURITY ADVISORY ============================= Vulnerability: Insecure Implementation of RSA Encryption Affected Products: jCryption, PEAR CryptRSA, PEAR CryptRSA2 Advisory Date: 2011-11-30 Advisory Author: Daniel Roethlisberger, SWITCH-CERT Introduction Web applications using...

SuSE Update for NetworkManager, wpa_supplicant, NetworkManager-gnome SUSE-SA:2011:045

Check for the Version of NetworkManager, wpasupplicant, NetworkManager-gnome OpenVAS Vulnerability Test SuSE Update for NetworkManager, wpasupplicant, NetworkManager-gnome SUSE-SA:2011:045 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.ne...

SUSE: Security Advisory for NetworkManager, wpa_supplicant, NetworkManager-gnome (SUSE-SA:2011:045)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2011-4405

The cupshelpers scripts in system-config-printer in Ubuntu 11.04 and 11.10, as used by the automatic printer driver download service, uses an "insecure connection" for queries to the OpenPrinting database, which allows remote attackers to execute arbitrary code via a man-in-the-middle MITM attack...

Deserialization of untrusted data

The cupshelpers scripts in system-config-printer in Ubuntu 11.04 and 11.10, as used by the automatic printer driver download service, uses an "insecure connection" for queries to the OpenPrinting database, which allows remote attackers to execute arbitrary code via a man-in-the-middle MITM attack...

Code injection

Software Center in Ubuntu 11.10, 11.04 10.10 does not properly validate server certificates, which allows remote attackers to execute arbitrary code or obtain sensitive information via a man-in-the-middle MITM attack...

CVE-2011-4405

The cupshelpers scripts in system-config-printer in Ubuntu 11.04 and 11.10, as used by the automatic printer driver download service, uses an "insecure connection" for queries to the OpenPrinting database, which allows remote attackers to execute arbitrary code via a man-in-the-middle MITM attack...

CVE-2011-4405

CVE-2011-4405 concerns the cupshelpers scripts in system-config-printer used by Ubuntu 11.04/11.10, which query the OpenPrinting database over an insecure, unauthenticated connection. This MITM weakness can allow remote tampering with driver packages/repositories and arbitrary code execution. Con...

CVE-2011-3150

Summary: CVE-2011-3150 affects Ubuntu Software Center where server certificates are not properly validated, enabling a remote MITM attack that could reveal sensitive data or allow installation of altered packages. Affected software: Software Center on Ubuntu 11.10, 11.04, and 10.10. Root cause (a...

CVE-2011-4405

The cupshelpers scripts in system-config-printer in Ubuntu 11.04 and 11.10, as used by the automatic printer driver download service, uses an "insecure connection" for queries to the OpenPrinting database, which allows remote attackers to execute arbitrary code via a man-in-the-middle MITM attack...

Fedora 15 : libsocialweb-0.25.20-1.fc15 / rest-0.7.12-1.fc15 (2011-15839)

CVE-2011-4129 A security flaw was found in the way the libsocialweb, a social network data aggregator, performed its initialization when this service start was initiated by the dbus daemon. Due to a deficiency in a way the libsocialweb service was initialized, an untrusted non-SSL network...

Fedora 16 : libsocialweb-0.25.20-1.fc16 / rest-0.7.12-1.fc16 (2011-15833)

CVE-2011-4129 A security flaw was found in the way the libsocialweb, a social network data aggregator, performed its initialization when this service start was initiated by the dbus daemon. Due to a deficiency in a way the libsocialweb service was initialized, an untrusted non-SSL network...