SecureRandom vulnerability details（CVE-2 0 1 3-7 3 7 2-the vulnerability warning-the black bar safety net

0×0 0 vulnerability overview Android 4.4 previous versions of the Java cryptographic architectureJCAusing Apache Harmony 6. 0M3 and the previous version of the SecureRandom implementation there is a security vulnerability, specifically located in the...

OpenJDK: XML parsing Denial of Service (JAXP, 8017298)

A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an...

OpenJDK: XML parsing Denial of Service (JAXP, 8017298)

A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an...

Reverse Shells With Terminal Support: revsh

revsh is a tool for establishing reverse shells with terminal support, reverse VPNs for advanced pivoting Pivoting , as well as arbitrary data tunneling. A reverse shell is a network connection that grants shell access to a remote host. As opposed to other remote login tools such as telnet and ss...

Apple Patches NTP Vulnerabilities in First Automated Patch

Apple last night for the first time pushed an automated patch to Mac OS X users, taking care of critical Network Time Protocol NTP vulnerabilities. The fix was delivered automatically and did not require Mac users to restart their machines. The latest security issue in NTP, which is used by...

CVE-2013-4442

Password Generator aka Pwgen before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers...

Design/Logic Flaw

Password Generator aka Pwgen before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers...

Updated pwgen package fixes security vulnerabilities

Updated pwgen package fixes security vulnerabilities: Pwgen was found to generate weak non-tty passwords by default, which could be brute-forced with a commendable success rate, which could raise security concerns CVE-2013-4440. Pwgen was found to silently falling back to use standard pseudo...

CVE-2013-4442

Pwgen (Password Generator) prior to version 2.07 was vulnerable because it used weak pseudo-random numbers when /dev/urandom was unavailable, allowing context-dependent attackers to potentially guess generated passwords. Public advisories and OSV/NVD records describe fixes in pwgen-2.07 and later...

CVE-2013-4442

Password Generator aka Pwgen before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers...

OpenJDK: XML parsing Denial of Service (JAXP, 8017298)

A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an...

PYSEC-2014-51

Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator PRNG, which makes it easier for remote attackers to guess the value via unspecified vectors. NOTE: this issue was SPLIT from CVE-2012-5508 due to different vulnerability...

USN-2387-1: pollinate update

The pollinate package bundles the certificate for entropy.ubuntu.com. This update refreshes the certificate to match the one currently used on the server...

Laravel 2.1 Hash::make() bcrypt Truncation

| | / | \ | |/ |/ | / | | | | | | | | | | | | | / \ | | | || || | |\ | || | | / | | |/|| ||// \| Laravel 2.1 Hash::make bcrypt truncation Website : http://laravel.com/ Author : @u0x Pichaya Morimoto Release dates : September 16, 2014 Special Thanks to 2600 Thailand group...

GLSA-201408-14 : stunnel: Information disclosure

The remote host is affected by the vulnerability described in GLSA-201408-14 stunnel: Information disclosure stunnel does not properly update the state of the pseudo-random generator after fork-threading which causes subsequent children with the same process ID to use the same entropy pool. ECDSA...

stunnel: Information disclosure

Background The stunnel program is designed to work as an SSL encryption wrapper between a client and a local or remote server. Description stunnel does not properly update the state of the pseudo-random generator after fork-threading which causes subsequent children with the same process ID to us...

LibreSSL PRNG Vulnerability Patched

The OpenBSD project late last night rushed out a patch for a vulnerability in the LibreSSL pseudo random number generator PRNG. The flaw was disclosed two days ago by the founder of secure backup company Opsmate, Andrew Ayer, who said the vulnerability was a “catastrophic failure of the PRNG.”...

DESlock+ <= 3.2.6 DLMFDISK.sys local kernel ring0 SYSTEM Exploit

No description provided by source. / deslock-pown-v2.c Copyright c 2008 by [email protected] DESlock+ = 3.2.6 local kernel ring0 SYSTEM exploit by mu-b - Wed 26 Dec 2007 - Tested on: DLMFDISK.sys 1.2.0.27 - Microsoft Windows 2003 SP2 - Microsoft Windows XP SP2 Note: create a mountable filesyste...

GNU Classpath 0.97.2 'gnu.java.security.util.PRNG' Class Entropy Weakness (1)

No description provided by source. source: http://www.securityfocus.com/bid/32909/info GNU Classpath is prone to a weakness that may result in weaker cryptographic security because its psuedo-random number generator PRNG lacks entropy. Attackers may leverage this issue to obtain sensitive...

Minix 3.1.2a Psuedo Terminal Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/30357/info Minix is prone to a denial-of-service vulnerability. An attacker can exploit this issue to prevent users from opening new pseudo terminals, denying service to legitimate users. Minix 3.1.2a is vulnerable; other...