Complete Microsoft EMET Bypass Developed

SAN FRANCISCO — Researchers at Bromium Labs are expected to announce today they have developed an exploit that bypasses all of the mitigations in Microsoft’s Enhanced Mitigation Experience Toolkit EMET. Principal security researcher Jared DeMott is scheduled to deliver a presentation this morning...

Dennis Fisher and Mike Mimoso Preview RSA 2014

Dennis Fisher and Mike Mimoso preview next week’s RSA conference, discuss the sessions they’re looking forward to covering and what the fallout from the NSA controversy will be during the week...

CVE-2014-0625

The SSLSocket implementation in the 1 JSAFE and 2 JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to cause a denial of service memory consumption by triggering application-data processing during the TLS handshake, a time at which the data is internal...

CVE-2014-0626

The 1 JSAFE and 2 JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 make it easier for remote attackers to bypass intended cryptographic protection mechanisms by triggering application-data processing during the TLS handshake, a time at which the data is both unencrypted and...

CVE-2014-0627

The SSLEngine API implementation in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to trigger the selection of a weak cipher suite by using the wrap method during a certain incomplete-handshake state...

Design/Logic Flaw

The SSLEngine API implementation in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to trigger the selection of a weak cipher suite by using the wrap method during a certain incomplete-handshake state...

Code injection

The SSLSocket implementation in the 1 JSAFE and 2 JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to cause a denial of service memory consumption by triggering application-data processing during the TLS handshake, a time at which the data is internal...

Design/Logic Flaw

The 1 JSAFE and 2 JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 make it easier for remote attackers to bypass intended cryptographic protection mechanisms by triggering application-data processing during the TLS handshake, a time at which the data is both unencrypted and...

CVE-2014-0626

The RSA BSAFE SSL-J vulnerability CVE-2014-0626 affects SSL-J 5.x (before 5.1.3) and 6.x (before 6.0.2). The JSAFE and JSSE APIs can process application data during the TLS handshake, exposing data unencrypted and unauthenticated and enabling potential information disclosure at handshake time. Ac...

CVE-2014-0627

Summary: CVE-2014-0627 affects EMC RSA BSAFE SSL-J (SSL-J) 5.x before 5.1.3 and 6.x before 6.0.2. The SSLEngine API can reveal information by using the wrap method after the Finished message in an incomplete handshake, potentially allowing an attacker to trigger a weak cipher suite. Impact: Infor...

CVE-2014-0627

The SSLEngine API implementation in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to trigger the selection of a weak cipher suite by using the wrap method during a certain incomplete-handshake state...

CVE-2014-0626

The 1 JSAFE and 2 JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 make it easier for remote attackers to bypass intended cryptographic protection mechanisms by triggering application-data processing during the TLS handshake, a time at which the data is both unencrypted and...

CVE-2014-0625

The CVE-2014-0625 issue affects RSA BSAFE SSL-J (JSAFE/JSSE) 5.x before 5.1.3 and 6.x before 6.0.2, where SSLSocket processing during TLS handshakes can buffer application data, leading to memory-based DoS. The SUSE/Security advisory and ESA-2014-009 describe a memory-denial vulnerability in the ...

CVE-2014-0625

The SSLSocket implementation in the 1 JSAFE and 2 JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to cause a denial of service memory consumption by triggering application-data processing during the TLS handshake, a time at which the data is internal...

WinSCP < 5.1.6 RSA Signature Blob Integer Overflow

The WinSCP program installed on the remote host is a version prior to 5.1.6. It therefore contains code from PuTTY that is affected by an integer overflow related to handling RSA signature data. This error allows a remote attacker to crash the application. C Tenable Network Security, Inc...

Amazon Linux AMI : gnupg (ALAS-2014-278)

GnuPG 1.x before 1.4.16 generates RSA keys using sequences of introductions with certain patterns that introduce a side channel, which allows physically proximate attackers to extract RSA keys via a chosen-ciphertext attack and acoustic cryptanalysis during decryption. NOTE: applications are not...

Screenlogger - A keylogger app for Android and iOS Smartphones

Are you using a pattern lock for your Smartphone to remain untouched from cyber criminals? But you are not aware that even your swipe gestures can be analyzed by hackers. Neal Hindocha, a security adviser for the technology company Trustwave, has developed a prototype malware for the Smartphones...

Boasting Better Encryption, Bug Fixes, OpenSSH 6.5 Released

The OpenBSD Project pushed out a new build on Thursday of the OpenSSH security suite, adding a new private key format, a new transport cipher and fixing 15 bugs in the Secure Shell. OpenSSH version 6.5 adds support for the key exchange using elliptic-curve Diffie Hellman within cryptographer Dani...

Mobile Malware Captures Keystrokes and Screengrabs

New proof-of-concept mobile malware logs keystrokes and captures screen-grabs on jailbroken iOS and Android devices in order to steal online log-in credentials and other sensitive information from targeted devices. In an interview with Threatpost, Trustwave senior security consultant Neal Hindoch...

Honey Encryption Deceives Hackers with Plausible Data

Traps are constantly set on the Internet to snare hackers in order to research their behavior and tactics. Many of these traps are honeypots or honeynets that take the form of deliberately unpatched computers or infrastructure exposed to the Internet that lure attackers to break in while their...