java-1.7.0-openjdk security update

1:1.7.0.201-2.6.16.1.0.1 - Update DISTRONAME in specfile 1:1.7.0.201-2.6.16.1 - Bump to 2.6.16 and u201b00. - Update 8076221/PR2809 disable RC4 to apply after 8208350 disable DES - Resolves: rhbz1633817...

krb5 security, bug fix, and enhancement update

1.15.1-34 - In FIPS mode, add plaintext fallback for RC4 usages and taint - Resolves: 1570600 1.15.1-33 - Use SHA-256 instead of MD5 for audit ticket IDs - Resolves: 1570600 1.15.1-32 - Include preauth name in trace output if possible - Update cert generation scripts to work on modern openssl - F...

java-1.7.0-openjdk security update

1:1.7.0.201-2.6.16.0.0.1 - Update DISTRONAME in specfile 1:1.7.0.201-2.6.16.0 - Bump to 2.6.16 and u201b00. - Update 8076221/PR2809 disable RC4 to apply after 8208350 disable DES - Resolves: rhbz1633817...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Functional Tester

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 & 7 that is used by IBM Rational Functional Tester . These issues were disclosed as part of the IBM Java SDK updates in April 2015 This bulletin also addresses FREAK: "Factoring Attack on RSA-EXPORT keys"...

Security Bulletin: Vulnerability in RC4 stream cipher affects Rational Functional Tester's Extension for Terminal-based Applications (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" attack may affect "Extension for Terminal-based Applications" a.k.a FTE that are shipped with Rational Functional Tester. Vulnerability Details CVEID: CVE-2015-2808 Description: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote...

CVE-2018-17177

An issue was discovered on Neato Botvac Connected 2.2.0 and Botvac 85 1.2.1 devices. Static encryption is used for the copying of so-called "black box" logs event logs and core dumps to a USB stick. These logs are RC4-encrypted with a 9-character password of ^JEd4W!I that is obfuscated by hiding ...

Design/Logic Flaw

An issue was discovered on Neato Botvac Connected 2.2.0 and Botvac 85 1.2.1 devices. Static encryption is used for the copying of so-called "black box" logs event logs and core dumps to a USB stick. These logs are RC4-encrypted with a 9-character password of ^JEd4W!I that is obfuscated by hiding ...

CVE-2018-17177

CVE-2018-17177 affects Neato Botvac Connected 2.2.0 and Botvac 85 1.2.1. The issue is that static RC4 encryption is used to copy log data (event logs and core dumps) to a USB stick, with a 9-character password. The password is obfuscated inside a custom /bin/rc4_crypt binary, implying weak and po...

CVE-2018-17177

An issue was discovered on Neato Botvac Connected 2.2.0 and Botvac 85 1.2.1 devices. Static encryption is used for the copying of so-called "black box" logs event logs and core dumps to a USB stick. These logs are RC4-encrypted with a 9-character password of ^JEd4W!I that is obfuscated by hiding ...

Design/Logic Flaw

A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The "null skcipher" was being dropped when each afalgctx was freed instead of when the aeadtfm was freed. This can cause the null skcipher to be freed while it is still in use leading to a local user bein...

Threat Analysis: Recent Attack Technique Leveraging cmd.exe and PowerShell Demonstrates How Attackers Are Using Trusted Microsoft Applications for Malicious Behavior

An attack leveraging cmd.exe and PowerShell was recently investigated by Cb ThreatSight analysts. Our initial investigation discovered that a batch file was executed on the targeted system. This batch file then invoked PowerShell with a base64 encoded command. Decoding the command revealed a seri...

Default configuration

A flaw was found in the Linux kernel present since v4.0-rc1 and through v4.13-rc4. A crafted network packet sent remotely by an attacker may force the kernel to enter an infinite loop in the cipsov4optptr function in net/ipv4/cipsoipv4.c leading to a denial-of-service. A certain non-default...

FreeBSD : wpa_supplicant -- unauthenticated encrypted EAPOL-Key data (6bedc863-9fbe-11e8-945f-206a8a720317)

SO-AND-SO reports : A vulnerability was found in how wpasupplicant processes EAPOL-Key frames. It is possible for an attacker to modify the frame in a way that makes wpasupplicant decrypt the Key Data field without requiring a valid MIC value in the frame, i.e., without the frame being...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM® SDK for Node.js™ (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM SDK for Node.js Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this...

Security Bulletin: Vulnerability in RC4 stream cipher affects TXSeries for Multiplatforms. (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects TXSeries for Multiplatforms. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Rational Business Developer (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attach for SSL/TLS affects IBM Rational Business Developer. Vulnerability Details CVE-ID: CVE-2015-2808 Description: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could...

Security Bulletin: Multiple vulnerabilities in the IBM Java SDK affects Rational Developer for i, Rational Developer for AIX and Linux and Rational Developer for Power Systems Software

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Versions 6 and 7 that is used by IBM Rational Application Developer for WebSphere Software CVE-2015-0488, CVE-2015-0478, CVE-2015-2808, CVE-2015-1916, CVE-2015-0204. These issues were disclosed as part of the IBM Java...

Security Bulletin: Vulnerability in RC4 stream cipher affects TPF Toolkit (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah Attack" for Secure Socket Layer SSL and Transport Layer Security TLS affects TPF Toolkit. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Developer Business(CVE-2015-0488 CVE-2015-0478 CVE-2015-2808 CVE-2015-0204)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition,Version 7 that is used by Rational Business Developer.These issues were disclosed as part of the IBM Java SDK updates in April 2015 Vulnerability Details CVEID: CVE-2015-0488 DESCRIPTION: An unspecified vulnerability in...

Security Bulletin: Vulnerability in RC4 stream cipher affects z/TPF (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah Attack" for Secure Sockets Layer SSL and Transport Layer Security TLS affects z/TPF. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information...