USN-1197-5: CA Certificates vulnerability

USN-1197-1 addressed an issue in Firefox and Xulrunner pertaining to the Dutch Certificate Authority DigiNotar mis-issuing fraudulent certificates. This update provides the corresponding update for ca-certificates. Original advisory details: It was discovered that Dutch Certificate Authority...

Ubuntu 10.04 LTS / 10.10 / 11.04 : nss vulnerability (USN-1197-4)

USN-1197-1 and USN-1197-3 addressed an issue in Firefox and Xulrunner pertaining to the Dutch Certificate Authority DigiNotar mis-issuing fraudulent certificates. This update provides the corresponding update for the Network Security Service libraries NSS. USN-1197-1 It was discovered that Dutch...

Mandriva Update for mozilla MDVSA-2011:129 (mozilla)

Check for the Version of mozilla OpenVAS Vulnerability Test Mandriva Update for mozilla MDVSA-2011:129 mozilla Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

Mandriva Update for mozilla MDVSA-2011:129 (mozilla)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Ubuntu: Security Advisory (USN-1197-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-1197-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD : nss/ca_root_nss -- fraudulent certificates issued by DigiNotar.nl (aa5bc971-d635-11e0-b3cf-080027ef73ec)

Heather Adkins, Google's Information Security Manager, reported that Google received ... reports of attempted SSL man-in-the-middle MITM attacks against Google users, whereby someone tried to get between them and encrypted Google services. The people affected were primarily located in Iran. The...

Ubuntu 10.04 LTS / 10.10 / 11.04 : thunderbird vulnerability (USN-1197-2)

USN-1197-1 fixed a vulnerability in Firefox with regard to the DigiNotar certificate authority. This update provides the corresponding updates for Thunderbird. We are aware that the DigiNotar Root CA Certificate is still shown as trusted in the Thunderbird certificate manager. This is due to...

RealVNC Authentication Bypass

$Id: realvnc41bypass.rb 13641 2011-08-26 04:40:21Z bannedit $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

nss/ca_root_nss -- fraudulent certificates issued by DigiNotar.nl

Heather Adkins, Google's Information Security Manager, reported that Google received ... reports of attempted SSL man-in-the-middle MITM attacks against Google users, whereby someone tried to get between them and encrypted Google services. The people affected were primarily located in Iran. The...

Symantec Backup Exec 12.5 MiTM Attack

No description provided by source. Exploit Title: Symantec Backup Exec MiTM Attack Date: 27/05/2011 Author: Nibin Software Link: http://www.symantec.com/business/products/family.jsp?familyid=backupexec Version: - Symantec Backup Exec for Windows Servers versions 11.0, 12.0, and 12.5 - Symantec...

smallftpd <= 1.0.3-fix | Connection Saturation Remote Denial of Service Vulnerability

smallftpd = 1.0.3-fix | Connection Saturation Remote Denial of Service Vulnerability 1. OVERVIEW The smallftpd FTP server is found to be vulnerable to denial of service in handling multiple connection requests regardless of its maximum connection settings. Upon successful DoS exploit, the smallft...

Facebook Session Sidejacking

Recently, there was a vulnerability discovered in LinkedIn, which is described here http://www.wtfuzz.com/blogs/linkedin-ssl-cookie-vulnerability/ Basically, this allows someone in network to sniff a cookie value and apply it in his browses session to hijack the target's user session. This simple...

DNS Spoofing - Man in the Middle (Basic Attack)

Document Title: =============== DNS Spoofing - Man in the Middle Basic Attack References: =========== Download: http://www.vulnerability-lab.com/resources/videos/16.wmv View: http://www.youtube.com/watch?v=9HWvUgSk0Y Release Date: ============= 2011-06-12 Vulnerability Laboratory ID VL-ID:...

DNS Spoofing - Man in the Middle (Basic Attack)

Document Title: =============== DNS Spoofing - Man in the Middle Basic Attack References: =========== Download: http://www.vulnerability-lab.com/resources/videos/16.wmv View: http://www.youtube.com/watch?v=9HWvUgSk0Y Release Date: ============= 2011-06-12 Vulnerability Laboratory ID VL-ID:...

Gadu-Gadu Remote Code Execution

Vendor: Gadu-Gadu http://gadu-gadu.pl Vulnerable Version: All Vulnerability Type: MITM, Remote Code Execution Risk level: High Credit: Kacper Szczesniak Vulnerability Details: Gadu-Gadu is vulnerable to the Man-In-The-Middle attack allowing remote code execution on a victim host. JavaScript code ...

CVE-2011-0633

The Net::HTTPS module in libwww-perl LWP before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does not enable full validation of SSL certificates by default, which allows remote attackers to spoof...

CVE-2011-0633

CVE-2011-0633 affects libwww-perl’s Net::HTTPS usage (prior to 6.00) as used by WWW::Mechanize and LWP::UserAgent. When environments do not set the If-SSL-Cert-Subject header, full SSL certificate validation is not enabled by default, enabling MITM-style spoofing via hostnames that are not proper...

CVE-2011-0633

The Net::HTTPS module in libwww-perl LWP before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does not enable full validation of SSL certificates by default, which allows remote attackers to spoof...

PT-2011-2511

Name of the Vulnerable Software and Affected Versions libwww-perl LWP versions prior to 6.00 Description The issue allows remote attackers to conduct man-in-the-middle MITM attacks by spoofing servers due to inadequate validation of SSL certificates when the If-SSL-Cert-Subject header is not set...