213 matches found
AIX 7.1 TL 3 : bos.net.tcp.server (U867669) (Bar Mitzvah)
The remote host is missing AIX PTF U867669, which is related to the security of the package bos.net.tcp.server. Product could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a...
[SECURITY] [DSA 3489-1] lighttpd security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3489-1 [email protected] https://www.debian.org/security/ Sebastien Delafond February 23, 2016 https://www.debian.org/security/faq -...
DSA-3489-1 lighttpd - security update
Bulletin has no description...
Gratipay: The POODLE attack (SSLv3 supported) for https://grtp.co/
Websites that support SSLv3 and CBC-mode ciphers are potentially vulnerable to an active MITM Man-in-the-middle attack. This attack, called POODLE, is similar to the BEAST attack and also allows a network attacker to extract the plaintext of targeted parts of an SSL connection, usually cookie dat...
Ubuntu: Security Advisory (USN-2839-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-2839-1 cups update
As a security improvement against the POODLE attack, this update disables SSLv3 support in the CUPS web interface. For legacy environments where SSLv3 support is still required, it can be re-enabled by adding "SSLOptions AllowSSL3" to /etc/cups/cupsd.conf...
AIX 6.1 TL 9 : bos.net.tcp.client (U861500)
The remote host is missing AIX PTF U861500, which is related to the security of the package bos.net.tcp.client. Product could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a...
[SECURITY] [DLA 282-1] lighttpd security update
Package : lighttpd Version : 1.4.28-2+squeeze1.7 CVE ID : CVE-2014-3566 Debian Bug : 765702 This update allows to disable SSLv3 in lighttpd in order to protect against the POODLE attack. SSLv3 is now disabled by default and can be reenabled if needed using the ssl.use-sslv3 option...
DLA-282-1 lighttpd - security update
Bulletin has no description...
IETF Officially Deprecates SSLv3
Attacks such as POODLE and BEAST not only caused some sleepless nights for server admins having to patch against the respective weaknesses, but they also accelerated SSLV3 deprecation. In the time since both attacks were disclosed, major browsers have removed the fallback condition that enabled t...
This POODLE Bites: Exploiting The SSL 3.0 Fallback
Introduction SSL 3.0 RFC6101 is an obsolete and insecure protocol. While for most practical purposes it has been replaced by its successors TLS 1.0 RFC2246, TLS 1.1 RFC4346, and TLS 1.2 RFC5246, many TLS implementations remain backwardscompatible with SSL 3.0 to interoperate with legacy systems ...
Exploit for CVE-2014-3566
PoC exploit for CVE-2014-3566, a Padding Oracle On Downgraded Le...
Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Web Platform 5.2.0 security update
An update for Red Hat JBoss Enterprise Web Platform 5.2.0 that provides a patch to mitigate the CVE-2014-3566 issue is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Red Hat JBoss Enterprise Web Platform is a...
Two Cisco Products Vulnerable to POODLE Attack on TLS
Two of Cisco’s products are vulnerable to the POODLE attack via the TLS implementation in those products. The vulnerability affects Cisco’s Adaptive Security Appliance software and its Application Control Engine module. The POODLE attack was disclosed in October by researchers from Google, who...
Researchers Say POODLE Attack Affects Some TLS Implementations
The POODLE attack against SSLv3 that researchers from Google revealed earlier this year also affects some implementations of TLS and vendors now are scrambling to release patches for gear affected by the vulnerability. Soon after the POODLE attack was disclosed in October, researchers began looki...
OpenSSL multiple security vulnerabilities
Poodle attack. Protocol version downgrade to SSL 3.0. Memory leaks in SRTP and session tickets. Insufficient no-ssl3 protection. Data leakage via padding attack...
Certain TLS Implementations Vulnerable to POODLE Attacks
A new variant of the POODLE attack may affect some TLS implementations on account of an issue similar to one present in SSL 3.0. Successful exploitation may enable actors to derive plaintext from encrypted communications. US-CERT encourages users and administrators to review TA14-290A for...
SUSE-SU-2015:1086-2 Security update for IBM Java
java-160-ibm has been updated to version 1.6.0sr16.2 to fix 18 security issues. These security issues has been fixed: Unspecified vulnerability in Oracle Java SE 6u81 CVE-2014-3065. The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, whic...
Google Removes SSLv3 Fallback Support From Chrome
Google has released Chrome 39, fixing 42 security vulnerabilities and removing support for the fallback to SSLv3, the component that was the target of the POODLE attack revealed last month. When the POODLE attack was disclosed by several Google researchers in October, the company said that it had...