USN-522-1: openssl vulnerabilities

It was discovered that OpenSSL did not correctly perform Montgomery multiplications. Local attackers might be able to reconstruct RSA private keys by examining another user's OpenSSL processes. CVE-2007-3108 Moritz Jodeit discovered that OpenSSL's SSLgetsharedciphers function did not correctly...

CVE-2007-4900

Cross-site scripting XSS vulnerability in the logon page in RSA EnVision 3.3.6 Build 0115 allows remote attackers to inject arbitrary web script or HTML via the username field...

Cross site scripting

Cross-site scripting XSS vulnerability in the logon page in RSA EnVision 3.3.6 Build 0115 allows remote attackers to inject arbitrary web script or HTML via the username field...

CVE-2007-4900

Cross-site scripting XSS vulnerability in the logon page in RSA EnVision 3.3.6 Build 0115 allows remote attackers to inject arbitrary web script or HTML via the username field...

CVE-2007-4900

CVE-2007-4900 describes a cross-site scripting (XSS) flaw in the logon page of RSA EnVision 3.3.6 Build 0115. The issue allows an attacker to inject arbitrary script/HTML via the username field, potentially enabling user-side script execution in a victim’s browser. The connected records confirm t...

RSA EnVision Reflected XSS Hole

Application: RSA EnVision Vendor: http://www.rsa.com Version: Version 3.3.6 Build 0115 Bug: Cross-Site Scripting Risk: Medium Date: 12 Sept 2007 Author: Stelios Tigkas e-mail: Stigkas at Gmail dot com Current Employer: Fujitsu Services List: BugTraqSecurityFocus ======= Product ======= A Security...

RSA Envision crossite scripting

Crossite scripting with username...

OpenSSL cryptographic vulnerability

Montgomery multiplication for elleptic cryptography is not applied in BNfrommontgomery functions, making it possible to retrieve RSA private key of different user...

CVE-2007-3108

The BNfrommontgomery function in crypto/bn/bnmont.c in OpenSSL 0.9.8e and earlier does not properly perform Montgomery multiplication, which might allow local users to conduct a side-channel attack and retrieve RSA private keys...

CVE-2007-3108

The BNfrommontgomery function in crypto/bn/bnmont.c in OpenSSL 0.9.8e and earlier does not properly perform Montgomery multiplication, which might allow local users to conduct a side-channel attack and retrieve RSA private keys...

Design/Logic Flaw

The BNfrommontgomery function in crypto/bn/bnmont.c in OpenSSL 0.9.8e and earlier does not properly perform Montgomery multiplication, which might allow local users to conduct a side-channel attack and retrieve RSA private keys...

CVE-2007-3108

The BNfrommontgomery function in crypto/bn/bnmont.c in OpenSSL 0.9.8e and earlier does not properly perform Montgomery multiplication, which might allow local users to conduct a side-channel attack and retrieve RSA private keys...

CVE-2007-3108

The BNfrommontgomery function in crypto/bn/bnmont.c in OpenSSL 0.9.8e and earlier does not properly perform Montgomery multiplication, which might allow local users to conduct a side-channel attack and retrieve RSA private keys...

CVE-2007-3108

OpenSSL CVE-2007-3108 affects OpenSSL 0.9.8e and earlier due to a faulty Montgomery multiplication path in BN_from_montgomery, enabling a local side-channel attack to potentially recover RSA private keys. Public advisories confirm multiple vendors released patches; Debian notes a backported fix a...

CVE-2007-3108

The BNfrommontgomery function in crypto/bn/bnmont.c in OpenSSL 0.9.8e and earlier does not properly perform Montgomery multiplication, which might allow local users to conduct a side-channel attack and retrieve RSA private keys...

OpenSSL本地密钥信息泄露漏洞

BUGTRAQ ID: 25163 CVECAN ID: CVE-2007-3108 OpenSSL是一种开放源码的SSL实现，用来实现网络通信的高强度加密，现在被广泛地用于各种网络应用程序中。 某些RSA的实现上存在可重建密钥的漏洞，OpenSSL基于SSLeay，提供RSA算法的加密支持，本地攻击者可能利用此漏洞通过RSA算法解密加密信息的内容。 多种使用了OpenSSL的产品可能受此漏洞影响。 OpenSSL Project OpenSSL 0.9.8e OpenSSL Project OpenSSL 0.9.8d OpenSSL Project OpenSSL 0.9.8c...

RSA key reconstruction vulnerability

Overview Various implementations of RSA may contain a vulnerability that could allow an attacker to retrieve encryption keys. Description Some implementations of RSA may contain a vulnerability that could allow a local attacker to retrieve encryption keys. OpenSSL is a widely used open source...

CVE-2007-2417

Heap-based buffer overflow in mprosrv.exe in Progress Software Progress 9.1E and OpenEdge 10.1x, as used by the RSA Authentication Manager 6.0 and 6.1, SecurID Appliance 2.0, ACE/Server 5.2, and possibly other products, allows remote attackers to execute arbitrary code via crafted packets. NOTE:...

Heap overflow

Heap-based buffer overflow in mprosrv.exe in Progress Software Progress 9.1E and OpenEdge 10.1x, as used by the RSA Authentication Manager 6.0 and 6.1, SecurID Appliance 2.0, ACE/Server 5.2, and possibly other products, allows remote attackers to execute arbitrary code via crafted packets. NOTE:...

CVE-2007-2417

CVE-2007-2417 concerns a heap-based overflow in Progress OpenEdge’s Progress server component _mprosrv.exe. The vulnerability affects Progress OpenEdge 9.1E and 10.1x (via the Progress server) and can be triggered by crafted TCP packets received on the server, leading to potential remote code exe...