FreeBSD-SA-03:06.openssl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-03:06.openssl Security Advisory The FreeBSD Project Topic: OpenSSL timing-based SSL/TLS attack Category: crypto Module: openssl Announced: 2003-03-21 Credits:...

[OpenSSL Advisory] Klima-Pokorny-Rosa attack on PKCS #1 v1.5 padding

OpenSSL Security Advisory 19 March 2003 Klima-Pokorny-Rosa attack on RSA in SSL/TLS =========================================== Czech cryptologists Vlastimil Klima, Ondrej Pokorny, and Tomas Rosa have come up with an extension of the "Bleichenbacher attack" on RSA with PKCS 1 v1.5 padding as used...

Vulnerability in OpenSSL CVE-2003-0131

The SSL and TLS components allowed remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS 1 v1.5 padding that caused OpenSSL to leak information regarding the relationship between...

CVE-2003-0147

OpenSSL CVE-2003-0147 is documented as a timing-attack vulnerability where RSA private-key material can be inferred because RSA blinding is not used by default. The vulnerability arises from timing differences during Montgomery reductions and differing multiply routes (Karatsuba vs. normal), enab...

CVE-2003-0147

OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on 1 the number of extra reductions during Montgomery reduction, and 2 the use of different integer multiplication algorithms...

CVE-2003-0147

OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on 1 the number of extra reductions during Montgomery reduction, and 2 the use of different integer multiplication algorithms...

[ADVISORY] Timing Attack on OpenSSL

OpenSSL v0.9.7a and 0.9.6i vulnerability ---------------------------------------- Researchers have discovered a timing attack on RSA keys, to which OpenSSL is generally vulnerable, unless RSA blinding has been turned on. Typically, it will not have been, because it is not easily possible to do so...

@(#)Mordred Security Labs - RSA ClearTrust Cross Site Scripting issues

-----BEGIN PGP SIGNED MESSAGE----- //@ Mordred Security Labs advisory Release date: March 14, 2003 Name: RSA ClearTrust Cross Site Scripting issues Risk: low Author: Sir Mordred [email protected], http://mslabs.iwebland.com I. Description: The RSA ClearTrust is a Web access management solution...

Vulnerability in OpenSSL

Dan Boneh and I have been researching timing attacks against software crypto libraries. Timing attacks are usually used to attack weak computing devices such as smartcards. We've successfully developed and mounted timing attacks against software crypto libraries running on general purpose PC's. W...

RSA ClearTrust 4.64.7 - Login Page Cross-Site Scripting

RSA ClearTrust 4.64.7 - Login Page Cross-Site Scripting source: https://www.securityfocus.com/bid/7108/info A cross-site scripting vulnerability has been discovered in ClearTrust. Specifically, the login page for the management application is not properly sanitized of some user-supplied values. A...

Vulnerability in OpenSSL CVE-2003-0147

RSA blinding was not enabled by default, which could allow local and remote attackers to obtain a server’s private key by determining factors using timing differences on 1 the number of extra reductions during Montgomery reduction, and 2 the use of different integer multiplication algorithms...

CVE-2002-0507

An interaction between Microsoft Outlook Web Access OWA with RSA SecurID allows local users to bypass the SecurID authentication for a previous user via several submissions of an OWA Authentication request with the proper OWA password for the previous user, which is eventually accepted by OWA...

Three problems in OpenSSH's ssh-keysign

This is being posted to bugtraq in the interest of full disclosure. Originally sent to [email protected]. There are 3 problems we observed by inspection of OpenSSH's ssh-keysign: 1 Charles Hannum Since no blinding is done on the RSA calculations, ssh-keysign is effectively a fairly efficient...

CVE-2002-0507

An interaction between Microsoft Outlook Web Access OWA with RSA SecurID allows local users to bypass the SecurID authentication for a previous user via several submissions of an OWA Authentication request with the proper OWA password for the previous user, which is eventually accepted by OWA...

CVE-2002-0507

CVE-2002-0507 describes an authentication bypass in Microsoft Outlook Web Access (OWA) when used with RSA SecurID. Local users could bypass SecurID for a previous user by submitting multiple OWA Authentication requests using the previous user’s password, which is eventually accepted by OWA. The N...

CVE-2001-1105

RSA BSAFE SSL-J 3.0, 3.0.1 and 3.1, as used in Cisco iCND 2.0, caches session IDs from failed login attempts, which could allow remote attackers to bypass SSL client authentication and gain access to sensitive data by logging in after an initial failure...

CVE-2001-1105

The CVE-2001-1105 entry affects RSA BSAFE SSL-J 3.0, 3.0.1 and 3.1 as used in Cisco iCND 2.0. The vulnerability is that the product caches session IDs from failed login attempts, which could allow remote attackers to bypass SSL client authentication and access sensitive data after an initial fail...

Login configurations

This plugin provides the username and password credentials for common servers, such as HTTP, FTP, NNTP, POP2, POP3, IMAP, IPMI, and SMB NetBios. Some plugins will use those credentials when needed. If you do not provide the credentials, those plugins will not be able to run. Note that this plugin...

OpenSSH fails to properly apply source IP based access control restrictions

Overview OpenSSH is an implementation of the Secure Shell protocol. A user may be able to bypass the IP based access control restriction feature specified in a key when two keys of varying types are specified. Description Versions of OpenSSH between 2.5.x - 2.9.x may fail to enforce the IP based...

CVE-2001-1462

WebID in RSA Security SecurID 5.0 as used by ACE/Agent for Windows, Windows NT and Windows 2000 allows attackers to cause the WebID agent to enter debug mode via a URL containing null characters, which may allow attackers to obtain sensitive information...