Early Review of LibreSSL Finds Problematic PRNG

When the OpenBSD foundation sent LibreSSL out the door last weekend, it was with the full intention of getting some feedback and scrutiny in return, all in the name of making the crypto library stable and secure. What they likely didn’t expect were claims surfacing that LibreSSL shared some of th...

Mythic Entertainment Dark Age of Camelot 1.6x Encryption Key Signing Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9960/info An encryption key signing vulnerability has been reported to exist in Dark Age of Camelot. This issue is due to a design error in the application that carries out encryption without having the encryption key...

GNU Classpath 0.97.2 'gnu.java.security.util.PRNG' Class Entropy Weakness (1)

No description provided by source. source: http://www.securityfocus.com/bid/32909/info GNU Classpath is prone to a weakness that may result in weaker cryptographic security because its psuedo-random number generator PRNG lacks entropy. Attackers may leverage this issue to obtain sensitive...

GNU Classpath 0.97.2 'gnu.java.security.util.PRNG' Class Entropy Weakness (2)

No description provided by source. source: http://www.securityfocus.com/bid/32909/info GNU Classpath is prone to a weakness that may result in weaker cryptographic security because its psuedo-random number generator PRNG lacks entropy. Attackers may leverage this issue to obtain sensitive...

openSUSE Security Update : ruby (openSUSE-SU-2012:0228-1)

This update of ruby provides 1.8.7p357, which contains many stability fixes and bug fixes, which are fully compatible with the previous version. You can review the detailed list here : http://svn.ruby-lang.org/repos/ruby/tags/v187357/ChangeLog The particularly noteworthy fixes are : - Hash...

IBM Patches Predictable Output Problem in SecureRandom PRNG

Details have surfaced on a recently patched vulnerability in IBM’s SecureRandom pseudo-random number generator that could allow an attacker to predict its output. Only the default SecureRandom implementation in the IBM Java Cryptography Extension JCE framework is vulnerable; IBM recommends that...

CVE-2013-7373

Android before 4.4 does not properly arrange for seeding of the OpenSSL PRNG, which makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging use of the PRNG within multiple applications...

Design/Logic Flaw

Android before 4.4 does not properly arrange for seeding of the OpenSSL PRNG, which makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging use of the PRNG within multiple applications...

Design/Logic Flaw

The engineNextBytes function in classlib/modules/security/src/main/java/common/org/apache/harmony/security/provider/crypto/SHA1PRNGSecureRandomImpl.java in the SecureRandom implementation in Apache Harmony through 6.0M3, as used in the Java Cryptography Architecture JCA in Android before 4.4 and...

CVE-2013-7373

Android before 4.4 does not properly arrange for seeding of the OpenSSL PRNG, which makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging use of the PRNG within multiple applications...

CVE-2013-7373

CVE-2013-7373 affects Android versions before 4.4, where the OpenSSL PRNG seeding is inadequate. This weakens cryptographic protections because the PRNG may be reused across multiple applications, potentially reducing confidentiality, integrity, and availability. The vulnerability is documented a...

CVE-2013-7372

The engineNextBytes function in classlib/modules/security/src/main/java/common/org/apache/harmony/security/provider/crypto/SHA1PRNGSecureRandomImpl.java in the SecureRandom implementation in Apache Harmony through 6.0M3, as used in the Java Cryptography Architecture JCA in Android before 4.4 and...

CVE-2013-7373: Exposure of Sensitive Information to an Unauthorized Actor

Android before 4.4 does not properly arrange for seeding of the OpenSSL PRNG, which makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging use of the PRNG within multiple applications...

PT-2014-3402

Name of the Vulnerable Software and Affected Versions Android versions prior to 4.4 Description The issue arises from the improper seeding of the OpenSSL PRNG in Android, making it easier for attackers to defeat cryptographic protection mechanisms. This is particularly concerning when the PRNG is...

PT-2014-3401

Name of the Vulnerable Software and Affected Versions Apache Harmony versions through 6.0M3 Android versions prior to 4.4 Description The issue concerns the SecureRandom implementation, specifically the engineNextBytes function in the SHA1PRNG SecureRandomImpl class. When no seed is provided, it...

CVE-2013-7372: Undefined Security Weakness

The engineNextBytes function in classlib/modules/security/src/main/java/common/org/apache/harmony/security/provider/crypto/SHA1PRNGSecureRandomImpl.java in the SecureRandom implementation in Apache Harmony through 6.0M3, as used in the Java Cryptography Architecture JCA in Android before 4.4 and...

Updated stunnel package fixes security vulnerability

A flaw was found in the way stunnel, a socket wrapper which can provide SSL support to ordinary applications, performed reinitialization of PRNG after fork. When accepting a new connection, the server forks and the child process handles the request. The RANDbytes function of openssl doesn't reset...

Linux kernel security vulnerabilities

ptrace information leakage, debug functions privilege escalation, cprng weak PRNG, networking dissector DoS, multiple integer overflows, buffer overlows in WiMax, USB and different devices drivers, UDP fragmentation offload uninitialized memory, privilege escalations. NAT conntrack information...

Multiple Vulnerabilities in Firefox for Android Leak Sensitive Information

The Android operating system has hardened its security with application Sandboxing features to ensure that no application can access sensitive information held by another without proper privileges. Android applications communicate with each other through Intents and these intents can be abused by...

stunnel < 5.00 PRNG State Security Weakness

The version of stunnel installed on the remote host is prior to version 5.00. It is, therefore, affected by a security weakness due to the PRNG state not being reset for new connections where the server forks. A remote attacker can exploit this issue to disclose sensitive information, such as the...