1166 matches found
MGASA-2014-0489 Updated ruby-httpclient package enables SSL negotiation
This new version enables SSL negotiation instead of hardcoding SSLv3...
[SECURITY] Fedora 21 Update: wpa_supplicant-2.0-12.fc21
wpasupplicant is a WPA Supplicant for Linux, BSD and Windows with support for WPA and WPA2 IEEE 802.11i / RSN. Supplicant is the IEEE 802.1X/WPA component that is used in the client stations. It implements key negotiation with a WPA Authenticator and it controls the roaming and IEEE 802.11...
polarssl: multiple issues
CVE-2014-8627 weak signature negotiation A mistake resulted in servers negotiating the lowest common hash from signaturealgorithms extension in TLS 1.2. - CVE-2014-8628 memory leaks Two issues were found that result in remotely triggerable memory leaks when parsing crafted ClientHello messages or...
Fedora 20 : rubygem-httpclient-2.4.0-2.fc20 (2014-13040)
Updated to 2.4.0 which stops hard-coding ssl v3 and allows ssl negotiation Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducin...
TA14-290A: SSL 3.0 Protocol Vulnerability and POODLE Attack
NCCIC / US-CERT National Cyber Awareness System: TA14-290A: SSL 3.0 Protocol Vulnerability and POODLE Attack 10/17/2014 12:27 PM EDT Original release date: October 17, 2014 Systems Affected All systems and applications utilizing the Secure Socket Layer SSL 3.0 with cipher-block chaining CBC mode...
Security changes in Opera 25; the poodle attacks
Security Security changes in Opera 25; the poodle attacks Share October 15th, 2014 So the last weeks have been rather hectic behind the scenes in the browser security world, when Google security group found a new way to exploit a rather well known design weakness in SSLv3 published in the paper...
New POODLE SSL 3.0 Attack Exploits Protocol Fallback Issue
A new attack on the SSLv3 protocol, disclosed Tuesday, takes advantage of an issue with the protocol that enables a network attacker to recover the plaintext communications of a victim. The attack is considered easier to exploit than similar previous attacks against SSL/TLS, such as BEAST and...
CVE-2014-5139
The sslsetclientdisabled function in t1lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service NULL pointer dereference and client application crash via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite...
CVE-2014-4344
The accctxcont function in the SPNEGO acceptor in lib/gssapi/spnego/spnegomech.c in MIT Kerberos 5 aka krb5 1.5.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via an empty continuation token at a certain point...
MS14-037: Security update for Internet Explorer 11 for systems that do not have update 2919355 or update 2929437 installed: July 8, 2014
Resolves vulnerabilities in Internet Explorer that could allow remote code execution if a user views a specially crafted webpage by using Internet Explorer.INTRODUCTIONThe security update addresses the vulnerabilities by modifying the way that Internet Explorer handles objects in memory, validate...
Apache 2.0 Path Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/5485/info A path disclosure vulnerability has been reported in Apache 2.0.x. It is possible to reproduce this condition on vulnerable systems by making a request for certain types of files such as error documents that hav...
STunnel 3.x Client Negotiation Protocol Format String Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/3748/info Stunnel is a freely available, open source cryptography wrapper. It is designed to wrap arbitrary protocols that may or may not support cryptography. It is maintained by the Stunnel project. Stunnel does not...
DTLS v1.0 Traffic Negotiation Detection
Binary data 8318.prm...
DTLS v1.0 Traffic Negotiation Detection
Binary data 8319.prm...
OpenSSL Server-Side ChangeCipherSpec Injection Scanner
This module checks for the OpenSSL ChangeCipherSpec CCS Injection vulnerability. The problem exists in the handling of early CCS messages during session negotiation. Vulnerable installations of OpenSSL accepts them, while later implementations do not. If successful, an attacker can leverage this...
The negotiation of encryption algorithm is failed
Challenge When trying to restore files from a Veeam appliance to the original location using Other OS restore, the following error is received: "The negotiation of encryption algorithm is failed" Cause Between Linux flavors, certain Ciphers may be enabled or disabled by default or by local policy...
SMTP STARTTLS Deployments Better than Expected
As more service providers understand and embrace the importance of encrypting online communication, certain technologies are being elevated to the forefront of conversations. Perfect Forward Secrecy and HTTP Strict Transport Security HSTS are two that generally top most lists, but another, SMTP...
openssl: client NULL dereference crash on malformed handshake packets
The ssl3takemac function in ssl/s3both.c in OpenSSL 1.0.1 before 1.0.1f allows remote TLS servers to cause a denial of service NULL pointer dereference and application crash via a crafted Next Protocol Negotiation record in a TLS handshake...