FreeBSD : fetchmail -- STARTTLS denial of service (f7d838f2-9039-11e0-a051-080027ef73ec)

Matthias Andree reports : Fetchmail version 5.9.9 introduced STLS support for POP3, version 6.0.0 added STARTTLS for IMAP. However, the actual STARTTLS-initiated in-band SSL/TLS negotiation was not guarded by a timeout. Depending on the operating system defaults as to TCP stream keepalive mode,...

CVE-2011-1925

nbd-server.c in Network Block Device nbd-server 2.9.21 allows remote attackers to cause a denial of service NULL pointer dereference and crash by causing a negotiation failure, as demonstrated by specifying a name for a non-existent export...

DEBIAN-CVE-2011-1925

nbd-server.c in Network Block Device nbd-server 2.9.21 allows remote attackers to cause a denial of service NULL pointer dereference and crash by causing a negotiation failure, as demonstrated by specifying a name for a non-existent export...

CVE-2011-1925

nbd-server.c in Network Block Device nbd-server 2.9.21 allows remote attackers to cause a denial of service NULL pointer dereference and crash by causing a negotiation failure, as demonstrated by specifying a name for a non-existent export...

CVE-2011-1925

nbd-server.c in Network Block Device nbd-server 2.9.21 allows remote attackers to cause a denial of service NULL pointer dereference and crash by causing a negotiation failure, as demonstrated by specifying a name for a non-existent export...

Oracle Linux 6.1 kernel security, bug fix and enhancement update

2.6.32-131.0.15.el6 - build disable Werr for external modules Aristeu Rozanski 703504 2.6.32-131.0.14.el6 - scsi hpsa: fix reading a write only register causes a hang Rob Evers 703262 - scsi mpt2sas: remove the use of writeq, since writeq is not atomic Tomas Henzl 701947 2.6.32-131.0.13.el6 - scs...

fetchmail -- STARTTLS denial of service

Matthias Andree reports: Fetchmail version 5.9.9 introduced STLS support for POP3, version 6.0.0 added STARTTLS for IMAP. However, the actual STARTTLS-initiated in-band SSL/TLS negotiation was not guarded by a timeout. Depending on the operating system defaults as to TCP stream keepalive mode,...

Hydra v6.2 with a password bruteforcing mode, xmpp and irc modules, MD5/SHA1/ Support !

Hydra v6.2 with a password bruteforcing mode, xmpp and irc modules, MD5/SHA1/ Support ! A very fast network logon cracker which support many different services. Have a look at the feature sets and services coverage page - including a speed comparison against ncrack and medusa! CHANGELOG for 6.2...

CVE-2010-4508

The WebSockets implementation in Mozilla Firefox 4 through 4.0 Beta 7 does not properly perform proxy upgrade negotiation, which has unspecified impact and remote attack vectors, related to an "inherent problem" with the WebSocket specification...

Wanted: E-Mail Addresses

Spammers always need fresh lists of e-mail addresses, says Steve Santorelli of Team Cymru. Supplying them is a lucrative underground business in its own right. The easy availability of such lists and the commodity prices they fetch is a sign of how well developed the underground economy really is...

MS Patch Tuesday: Googler Zero-Day Fixed in 33 Days

Last month, when Google researcher Tavis Ormandy released details on a critical Help and Support Center vulnerability that exposed Windows XP and Windows Server 2003 users to malicious hacker attacks, Microsoft was publicly unhappy with the decision. Ormandy claims he spent five days negotiating...

openSUSE Security Update : mozilla-xulrunner190 (mozilla-xulrunner190-2261)

This patch updates Mozilla XULRunner 3.0 engine the 1.9.0.19 release. It includes also following security fixes: MFSA 2010-16: Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed eviden...

openssl: crash caused by a missing krb5_sname_to_principal() return value check

The ksslkeytabisavailable function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, which allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via SS...

MIT Kerberos DoS

Crash on SPNEGO negotiation...

OpenSSL 'kssl_keytab_is_available()' Denial Of Service Vulnerability (Windows)

This host is installed with OpenSSL and is prone to Denial Of Service Vulnerability. OpenVAS Vulnerability Test $Id: gbopensslsslkssdosvulnwin.nasl 8193 2017-12-20 10:46:55Z cfischer $ OpenSSL 'ksslkeytabisavailable' Denial Of Service Vulnerability Windows Authors: Antu Sanadi Copyright: Copyrigh...

Null pointer dereference

The ksslkeytabisavailable function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, which allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via SS...

CVE-2010-0433

CVE-2010-0433 affects OpenSSL before 0.9.8n. In kssl_keytab_is_available (ssl/kssl.c), when Kerberos is enabled but Kerberos config files cannot be opened, the code does not check a certain return value, enabling a remote attacker to cause a denial of service via SSL cipher negotiation (NULL poin...

CVE-2010-0433

The ksslkeytabisavailable function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, which allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via SS...

Asterisk T.38 Negotiation Remote DoS Vulnerability (AST-2010-001)

Asterisk is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:digium:asterisk";...

CVE-2010-0441

Asterisk Open Source 1.6.0.x before 1.6.0.22, 1.6.1.x before 1.6.1.14, and 1.6.2.x before 1.6.2.2, and Business Edition C.3 before C.3.3.2, allows remote attackers to cause a denial of service daemon crash via an SIP T.38 negotiation with an SDP FaxMaxDatagram field that is 1 missing, 2 modified ...