CVE-2014-3166

The Public Key Pinning PKP implementation in Google Chrome before 36.0.1985.143 on Windows, OS X, and Linux, and before 36.0.1985.135 on Android, does not correctly consider the properties of SPDY connections, which allows remote attackers to obtain sensitive information by leveraging the use of...

CVE-2014-3166

Removed by vendor...

Google Chrome < 36.0.1985.143 Multiple Vulnerabilities (Mac OS X)

The version of Google Chrome installed on the remote Mac OS X host is a version prior to 36.0.1985.143. It is, therefore, affected by the following vulnerabilities : - A use-after-free error exists in the Web Sockets implementation in Blink which allows remote attackers to cause a denial of...

Google Chrome < 36.0.1985.143 Multiple Vulnerabilities

The version of Google Chrome installed on the remote host is a version prior to 36.0.1985.143. It is, therefore, affected by the following vulnerabilities : - A use-after-free error exists in the Web Sockets implementation in Blink which allows remote attackers to cause a denial of service...

UBUNTU-CVE-2014-3166

The Public Key Pinning PKP implementation in Google Chrome before 36.0.1985.143 on Windows, OS X, and Linux, and before 36.0.1985.135 on Android, does not correctly consider the properties of SPDY connections, which allows remote attackers to obtain sensitive information by leveraging the use of...

Google Chrome < 36.0.1985.143 Multiple Vulnerabilities

Binary data 8356.pasl...

Gmail App for iOS leaves Users vulnerable to Man-in-the-Middle Attacks

Google has failed to provide a very important security measure in its Gmail application for iOS that left millions of its Apple device users to Man-in-the-Middle MitM attacks capable of monitoring encrypted email communications. Researcher at mobile security firm Lacoon has discovered that Google...

No Certificate Pinning Exposes Encrypted iOS Gmail Comms

UPDATE: Updated with comment and clarification from Google. Researchers say that Google’s Gmail application for iOS fails to perform a task called certificate pinning under certain conditions, which could expose the users of affected devices to man-in-the-middle attacks capable of monitoring...

openSUSE Security Update : NetworkManager-gnome (openSUSE-SU-2012:0101-1)

NetworkManager did not pin a certificate's subject to an ESSID. A rogue access point could therefore be used to conduct MITM attacks by using any other valid certificate issued by same CA as used in the original network CVE-2006-7246. Please note that existing WPA2 Enterprise connections need to ...

openSUSE Security Update : NetworkManager-gnome (openSUSE-SU-2012:0101-1)

NetworkManager did not pin a certificate's subject to an ESSID. A rogue access point could therefore be used to conduct MITM attacks by using any other valid certificate issued by same CA as used in the original network CVE-2006-7246. Please note that existing WPA2 Enterprise connections need to ...

Moderate: Red Hat Security Advisory: libvirt security and bug fix update

Updated libvirt packages that fix one security issue and three bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Researchers Find SSL Problems WithWhatsApp

The Facebook acquisition of mobile messaging service WhatsApp has captivated the tech world this week. Much of that has to do with the massive $19 billion price tag and, to a lesser extent, the incredibly fast rise of the company. But while analysts and customers have been examining the deal, som...

PHP openssl_x509_parse() Memory Corruption Vulnerability

Exploit for php platform in category dos / poc Overview: Quote from http://www.php.net "PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML." The PHP function opensslx509parse uses a helper function called...

Microsoft Expands Encryption Use in Cloud Services to Thwart Surveillance

In response to the growing set of revelations about the NSA’s surveillance methods and alleged compromise of some large technology vendors’ services, Microsoft is taking a number of steps to try and reassure customers about the integrity of the company’s offerings and to greatly expand the use of...

Twitter Implements Perfect Forward Secrecy

Twitter took another step toward not only securing the privacy of its users’ communication over the social network, but in warding off the prying eyes of government surveillance with the implementation of Perfect Forward Secrecy. The technology thwarts the efforts of anyone who may be collecting...

[EMET v4.0] Enhanced Mitigation Experience Toolkit

The Enhanced Mitigation Experience Toolkit EMET is designed to help prevent hackers from gaining access to your system. Software vulnerabilities and exploits have become an everyday part of life. Virtually every product has to deal with them and consequently, users are faced with a stream of...

Microsoft EMET 4.0 Enables Certificate Pinning to Defeat MITM Attacks

Microsoft later this month will release a new version of its EMET protection tool, and this iteration will include a certificate pinning feature that will enable users to associate a specific certificate with a given certificate authority. The feature is designed a defense against man-in-the-midd...

Researchers Unveil New Way to Trust Certificates

Two independent researchers are proposing an extension for TLS to provide greater trust in certificate authorities, which have become a weak link in the entire public key infrastructure after some big breaches involving fraudulent SSL certificates. TACK, short for Trust Assertions for Certificate...

SuSE 10 Security Update : NetworkManager (ZYPP Patch Number 7957)

NetworkManager did not pin a certificate's subject to an ESSID. A rogue access point could therefore be used to conduct MITM attacks by using any other valid certificate issued by same CA as used in the original network. CVE-2006-7246 Please note that existing WPA2 Enterprise connections need to ...

[BSA-061] Security Update for openswan

Harald Jenny uploaded new packages for openswan which fixed the following security problems: CVE-2011-4073 Use-after-free vulnerability in the cryptographic helper handler functionality in Openswan 2.3.0 through 2.6.36 allows remote authenticated users to cause a denial of service pluto IKE daemo...