8835 matches found
CVE-2013-6178
Multiple cross-site scripting XSS vulnerabilities in EMC RSA Archer GRC 5.x before 5.4 SP1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...
Researchers Find Way to Extract 4096-Bit RSA Key via Sound
A trio of scientists have verified that results they first presented nearly 10 years ago are in fact valid, proving that they can extract a 4096-bit RSA key from a laptop using an acoustic side-channel attack that enables them to record the noise coming from the laptop during decryption, using a...
Debian DSA-2821-1 : gnupg - side channel attack
Genkin, Shamir and Tromer discovered that RSA key material could be extracted by using the sound generated by the computer during the decryption of some chosen ciphertexts. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...
FreeBSD : gnupg -- RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis attack (2e5715f8-67f7-11e3-9811-b499baab0cbe)
Werner Koch reports : CVE-2013-4576 has been assigned to this security bug. The paper describes two attacks. The first attack allows to distinguish keys: An attacker is able to notice which key is currently used for decryption. This is in general not a problem but may be used to reveal the...
[SECURITY] [DSA 2821-1] gnupg security update
------------------------------------------------------------------------- Debian Security Advisory DSA-2821-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst December 18, 2013 http://www.debian.org/security/faq -...
CVE-2013-4576
GnuPG 1.x before 1.4.16 generates RSA keys using sequences of introductions with certain patterns that introduce a side channel, which allows physically proximate attackers to extract RSA keys via a chosen-ciphertext attack and acoustic cryptanalysis during decryption. NOTE: applications are not...
DSA-2821-1 gnupg - side channel attack
Bulletin has no description...
gnupg -- RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis attack
Werner Koch reports: CVE-2013-4576 has been assigned to this security bug. The paper describes two attacks. The first attack allows to distinguish keys: An attacker is able to notice which key is currently used for decryption. This is in general not a problem but may be used to reveal the...
Debian Security Advisory DSA 2821-1 (gnupg - side channel attack)
Genkin, Shamir and Tromer discovered that RSA key material could be extracted by using the sound generated by the computer during the decryption of some chosen ciphertexts. OpenVAS Vulnerability Test $Id: deb2821.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2821-1...
Debian: Security Advisory (DSA-2821-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2013-6180
EMC RSA Security Analytics SA 10.x before 10.3, and RSA NetWitness NextGen 9.8, does not ensure that SA Core requests originate from the SA REST UI, which allows remote attackers to bypass intended access restrictions by sending a Core request from a web browser or other unintended user agent...
Design/Logic Flaw
EMC RSA Security Analytics SA 10.x before 10.3, and RSA NetWitness NextGen 9.8, does not ensure that SA Core requests originate from the SA REST UI, which allows remote attackers to bypass intended access restrictions by sending a Core request from a web browser or other unintended user agent...
CVE-2013-6180
EMC RSA Security Analytics SA 10.x before 10.3, and RSA NetWitness NextGen 9.8, does not ensure that SA Core requests originate from the SA REST UI, which allows remote attackers to bypass intended access restrictions by sending a Core request from a web browser or other unintended user agent...
CVE-2013-6180
The CVE-2013-6180 issue affects EMC RSA Security Analytics (SA) 10.x prior to 10.3 and RSA NetWitness NextGen 9.8, where SA Core does not verify that requests originate from the SA REST UI, allowing untrusted user agents (e.g., web browsers) to bypass access restrictions. This could enable core-a...
Matthew Green on How NSA Breaks SSL
In order for the National Security Agency to collect the massive amounts of communication it has from email and Web traffic, it needs to elude, leapfrog or bash through the barrier that is SSL. How it’s doing so is the real question, one that noted Johns Hopkins cryptographer Matthew Green wants...
Updated polarssl, pdns & ragel packages fix CVE-2013-5915
Updated polarssl packages fix security vulnerability: The researchers Cyril Arnaud and Pierre-Alain Fouque investigated the PolarSSL RSA implementation and discovered a bias in the implementation of the Montgomery multiplication that we used. For which they then show that it can be used to mount ...
MGASA-2013-0353 Updated polarssl, pdns & ragel packages fix CVE-2013-5915
Updated polarssl packages fix security vulnerability: The researchers Cyril Arnaud and Pierre-Alain Fouque investigated the PolarSSL RSA implementation and discovered a bias in the implementation of the Montgomery multiplication that we used. For which they then show that it can be used to mount ...
ruby security update
1.8.7.352-13 - Workaround build issues against OpenSSL with enabled ECC curves. - Make DRb compatible with OpenSSL 1.0.1. ruby-1.9.3-p222-generate-1024-bits-RSA-key-instead-of-512-bits.patch - Fix CVE-2013-4164 Heap Overflow in Floating Point Parsing...
EMC RSA Data Protection Manager Appliance security vulnerabilities
TLS session renegotiation vulnerability, crossite scripting...
ESA-2013-077: RSA Data Protection Manager Appliance Multiple Vulnerabilities
ESA-2013-077.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-077: RSA Data Protection Manager Appliance Multiple Vulnerabilities EMC Identifier: ESA-2013-077 CVE Identifier: CVE-2013-3288, CVE-2009-3555 Severity Rating: See below for individual scores and refer to vendor advisories for...