CVE-2001-1461

Directory traversal vulnerability in WebID in RSA Security SecurID 5.0 as used by ACE/Agent for Windows, Windows NT and Windows 2000 allows attackers to access restricted resources via URL-encoded 1 /.. or 2 .. sequences...

RSA Security ACE/Agent for Windows, ACE/Agent for Windows NT, and ACE/Agent for Windows 2000 do not properly handle null characters in URL

Overview RSA Security ACE/Agent for Windows, ACE/Agent for Windows NT, and ACE/Agent for Windows 2000 contain a vulnerability in which the ACE/Agent does not properly handle null characters contained in a URL. A specially crafted request may cause ACE/Agent to enter a debugging mode, possibly...

RSA Security ACE/Agent for Windows, ACE/Agent for Windows NT, and ACE/Agent for Windows 2000 do not properly handle URL encoded characters in URL

Overview RSA Security ACE/Agent for Windows, ACE/Agent for Windows NT, and ACE/Agent for Windows 2000 contain a vulnerability in which the ACE/Agent does not properly handle URL encoded characters contained in a URL. A specially crafted request may bypass authentication and expose the contents of...

OpenSSH Security Advisory (adv.option)

Weakness in OpenSSH's source IP based access control for SSH protocol v2 public key authentication. 1. Systems affected: Versions of OpenSSH between 2.5.x and 2.9.x using the 'from=' key file option in combination with both RSA and DSA keys in /.ssh/authorizedkeys2. 2. Description: Depending on t...

Проблемы с RSA BSAFE SSL (unauthorized access)

Ошибка в кэшировании сертификатов позволяет подключиться с недействительным сертификатом...

Cisco Security Advisory: Vulnerable SSL implementation in iCDN

-----BEGIN PGP SIGNED MESSAGE----- Cisco Security Advisory: Vulnerable SSL implementation in iCDN Revision 1.0 For public release 2001 September 12 08:00 GMT -0800 Summary A security vulnerability has been discovered in version 3.x of the RSA BSAFE SSL-J Software Developer Kit made by RSA Securit...

CVE-2001-1105

RSA BSAFE SSL-J 3.0, 3.0.1 and 3.1, as used in Cisco iCND 2.0, caches session IDs from failed login attempts, which could allow remote attackers to bypass SSL client authentication and gain access to sensitive data by logging in after an initial failure...

CVE-1999-1444

genkey utility in Alibaba 2.0 generates RSA key pairs with an exponent of 1, which results in transactions that are sent in cleartext...

CVE-1999-1444

CVE-1999-1444 affects the genkey utility in Alibaba 2.0, which generates RSA key pairs with an exponent of 1. The underlying issue is the weak exponent, enabling transactions to be sent in cleartext. The connected documents confirm the vulnerability scope but do not provide a published exploit, a...

CVE-2001-0572

The SSH protocols 1 and 2 aka SSH-2 as implemented in OpenSSH and other packages have various weaknesses which can allow a remote attacker to obtain the following information via sniffing: 1 password lengths or ranges of lengths, which simplifies brute force password guessing, 2 whether RSA or DS...

CVE-2001-0572

CVE-2001-0572 concerns the SSH protocols 1 and 2 as implemented in OpenSSH and other packages. The connected documents confirm concrete details: the issue enables a remote attacker to sniff and disclose information such as password lengths, the authentication method (RSA/DSA), the number of autho...

BindView Advisory: MITM Attacks Against Novell NetWare

MITM Attacks Against Novell NetWare ----------------------------------- Issue Date: 15Feb2001 Contact: Simple Nomad [email protected] http://razor.bindview.com/publish/advisories/advNovellMITM.html Topic: ------ Man-in-the-middle Attack can reveal password hashes and private keys in...

SSH authentication agent follows symlinks via a UNIX domain socket

Overview Older versions of SSH allow local attackers to to establish ssh sessions as the victim user without authentication. Description The text of this document was originally released on January 20, 1998, as SNI-23, developed by Secure Networks, Inc. SNI. To more widely broadcast this...

SNMP Request Network Interfaces Enumeration

It is possible to obtain the list of the network interfaces installed on the remote host by sending SNMP requests with the OID 1.3.6.1.2.1.2.1.0 An attacker may use this information to gain more knowledge about the target host. TRUSTED...

[SECURITY] New version of gnupg installed

Package: gnupg Debian-specific: no The version of gnupg that was distributed in Debian GNU/Linux 2.2 had a logic error in the code that checks for valid signatures which could cause false positive results: Jim Small discovered that if the input contained multiple signed sections the exit-code gnu...

CVE-2000-0522

RSA ACE/Server allows remote attackers to cause a denial of service by flooding the server's authentication request port with UDP packets, which causes the server to crash...

CVE-2000-0522

The CVE-2000-0522 entry refers to RSA ACE/Server and describes a denial-of-service vulnerability arising when an attacker floods the server’s authentication request port with UDP packets, causing the server to crash. Public sources (NVD/CVE records) confirm this issue exists and indicate an in-ne...

CVE-2000-0522

RSA ACE/Server allows remote attackers to cause a denial of service by flooding the server's authentication request port with UDP packets, which causes the server to crash...

Potential DoS Attack on RSA's ACE/Server

Hi folks, RSA Security http://www.rsasecurity.com/ produce a 2 factor secure authentication solution called ACE/Server. This uses SecurID tokens to enforce authentication and runs on NT/2000 and Solaris. It is possible for a nonprivileged user on the same network as the ACE/Server to trivially...

Newsletter 35

RSA Web site defaced Amazon.com, eBay & CNN all targeted with DDoS President Clinton convenes meeting on internet security Infosec professionals like yourself can't afford to miss out on late breaking news, in-depth analysis, product reviews and more in each issue of Information Security Magazine...