Code injection

The DualECDRBG implementation in EMC RSA BSAFE-C Toolkits aka Share for C and C++ processes certain requests for output bytes by considering only the requested byte count and not the use of cached bytes, which makes it easier for remote attackers to obtain plaintext from TLS sessions by recoverin...

Code injection

The TLS implementation in EMC RSA BSAFE-C Toolkits aka Share for C and C++ sends a long series of random bytes during use of the DualECDRBG algorithm, which makes it easier for remote attackers to obtain plaintext from TLS sessions by recovering the algorithm's inner state, a different issue than...

Default configuration

The default configuration of EMC RSA BSAFE Toolkits and RSA Data Protection Manager DPM 20130918 uses the Dual Elliptic Curve Deterministic Random Bit Generation DualECDRBG algorithm, which makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by leveraging...

Code injection

The TLS implementation in EMC RSA BSAFE-Java Toolkits aka Share for Java supports the Extended Random extension during use of the DualECDRBG algorithm, which makes it easier for remote attackers to obtain plaintext from TLS sessions by requesting long nonces from a server, a different issue than...

CVE-2014-4193

The TLS implementation in EMC RSA BSAFE-Java Toolkits aka Share for Java supports the Extended Random extension during use of the DualECDRBG algorithm, which makes it easier for remote attackers to obtain plaintext from TLS sessions by requesting long nonces from a server, a different issue than...

CVE-2014-4192

CVE-2014-4192 affects EMC RSA BSAFE-C Toolkits (Share for C/C++) Dual_EC_DRBG. The vulnerability arises from how output bytes are produced: the implementation uses the requested byte count without considering cached bytes, enabling recovery of the algorithm’s inner state and potential plaintext e...

CVE-2013-6078

The default configuration of EMC RSA BSAFE Toolkits and RSA Data Protection Manager DPM 20130918 uses the Dual Elliptic Curve Deterministic Random Bit Generation DualECDRBG algorithm, which makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by leveraging...

CVE-2013-6078

CVE-2013-6078 affects EMC RSA BSAFE Toolkits and RSA Data Protection Manager (DPM) 20130918 family when configured by default to use Dual_EC_DRBG. The issue arises from the use of Dual_EC_DRBG, which can enable context-dependent attackers to defeat cryptographic protections. The description notes...

CVE-2014-4193

CVE-2014-4193 concerns the TLS implementation in EMC RSA BSAFE-Java Toolkits (Share for Java) . The vulnerability arises from the TLS stack using the Extended Random extension while Dual_EC_DRBG is in use, which can allow an observer to recover enough state to obtain plaintext from TLS sessions b...

CVE-2014-4191

CVE-2014-4191 affects the EMC RSA BSAFE-C Toolkits TLS implementation (Share for C/C++) that uses Dual_EC_DRBG. The issue is caused by the TLS code sending a long series of random bytes during Dual_EC_DRBG usage, which enables an attacker to recover the algorithm’s inner state and potentially obt...

openSUSE Security Update : strongswan (openSUSE-SU-2012:0691-1)

Strongswan's gmp plugin could treat empty RSA signature as valid ones %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2012-309. The text description of this plugin is C SUSE LLC...

openSUSE Security Update : libgcrypt (openSUSE-SU-2013:1294-1)

libgcrypt was updated to 1.5.3 bnc831359 to fix a security issue, bugs and get some new features : Security issue fixed : - Mitigate the Yarom/Falkner flush+reload side-channel attack on RSA secret keys. See . - contains changes from 1.5.2 - The upstream sources now contain the IDEA algorithm,...

openSUSE Security Update : nss-201112 (openSUSE-SU-2012:0030-1) (BEAST)

The Mozilla NSS libraries were updated to version 3.13.1 to fix various bugs and security problems. Following security issues were fixed : - SSL 2.0 is disabled by default - A defense against the SSL 3.0 and TLS 1.0 CBC chosen plaintext attack demonstrated by Rizzo and Duong CVE-2011-3389 is...

openSUSE Security Update : mozilla-nss (openSUSE-2011-100) (BEAST)

Added a patch to fix errors in the pkcs11n.h header file. bmo702090 - update to 3.13.1 RTM - better SHA-224 support bmo647706 - fixed a regression causing hangs in some situations introduced in 3.13 bmo693228 - update to 3.13.0 RTM - SSL 2.0 is disabled by default - A defense against the SSL 3.0...

OpenJDK: RSA unpadding timing issues (Security, 8027766)

Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security...

OpenJDK: RSA unpadding timing issues (Security, 8027766)

Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security...

New Pandemiya Banking Trojan Written From Scratch

Brand new, written-from-scratch malware is a relatively rare undertaking on the underground. Aside from some private endeavors, source code is available for a number of popular Trojans, including Zeus, Citadel and Carberp, making it easy for attackers to simply grab one off the shelf and get...

Fedora 20 : mingw-gnutls-3.1.25-1.fc20 (2014-6953)

Version 3.1.25 released 2014-05-30 - libgnutls: Eliminated memory corruption issue in Server Hello parsing. Issue reported by Joonas Kuorilehto of Codenomicon. - libgnutls: Increased the maximum certificate size buffer in the PKCS 11 subsystem. - libgnutls: Check the return code of getpwuidr...

CVE-2014-2502

Cross-site scripting XSS vulnerability in rsafso.swf in EMC RSA Adaptive Authentication Hosted 11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in rsafso.swf in EMC RSA Adaptive Authentication Hosted 11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...