CVE-2010-1633

RSA verification recovery in the EVPPKEYverifyrecover function in OpenSSL 1.x before 1.0.0a, as used by pkeyutl and possibly other applications, returns uninitialized memory upon failure, which might allow context-dependent attackers to bypass intended key requirements or obtain sensitive...

Information disclosure

RSA verification recovery in the EVPPKEYverifyrecover function in OpenSSL 1.x before 1.0.0a, as used by pkeyutl and possibly other applications, returns uninitialized memory upon failure, which might allow context-dependent attackers to bypass intended key requirements or obtain sensitive...

CVE-2010-1633

OpenSSL CVE-2010-1633: RSA verification recovery in EVP_PKEY_verify_recover in OpenSSL 1.x before 1.0.0a returns uninitialized memory on failure, potentially allowing context-dependent attackers to bypass key requirements or glean information via unspecified vectors (noted as used by pkeyutl and ...

CVE-2010-1633

RSA verification recovery in the EVPPKEYverifyrecover function in OpenSSL 1.x before 1.0.0a, as used by pkeyutl and possibly other applications, returns uninitialized memory upon failure, which might allow context-dependent attackers to bypass intended key requirements or obtain sensitive...

CVE-2010-1633

RSA verification recovery in the EVPPKEYverifyrecover function in OpenSSL 1.x before 1.0.0a, as used by pkeyutl and possibly other applications, returns uninitialized memory upon failure, which might allow context-dependent attackers to bypass intended key requirements or obtain sensitive...

CVE-2010-1633: Undefined Security Weakness

RSA verification recovery in the EVPPKEYverifyrecover function in OpenSSL 1.x before 1.0.0a, as used by pkeyutl and possibly other applications, returns uninitialized memory upon failure, which might allow context-dependent attackers to bypass intended key requirements or obtain sensitive...

OpenSSL < 0.9.8o / 1.0.0a Multiple Vulnerabilities

Binary data 801057.prm...

OpenSSL < 0.9.8o / 1.0.0a Multiple Vulnerabilities

Binary data 5559.prm...

Vulnerability in OpenSSL CVE-2010-1633

An invalid Return value check in pkeyrsaverifyrecover was discovered. When verification recovery fails for RSA keys an uninitialised buffer with an undefined length is returned instead of an error code. This could lead to an information leak...

Former Penn CSO Dishes on His Firing

Former State of Pennsylvania CISO Robert Maley has been watching all the news about his firing for talking about a security incident without permission at last month’s RSA conference. He began a talk on application security at CSO Perspectives 2010 by going off topic and addressing the controvers...

IBM Remote Supervisor Adapter Detection (HTTP)

The remote web server has been fingerprinted as one embedded in IBM Remote Supervisor Adapter RSA cards. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid45356; scriptversion "$Revision: 1.10 $"; scriptnameenglish:"IBM Remote Supervisor Adapter Detection HTTP";...

Former Pennsylvania CSO Maley Speaks

Robert Maley was fired from his job as the chief information security officer for the state of Pennsylvania earlier this month after he spoke, without proper authorization, about security incidents involving the state during a panel discussion at the RSA trade show. In this interview, Maley gives...

Marc Maiffret at RSA 2010

Dennis Fisher talks with Marc Maiffret of FireEye at RSA Conference 2010 about the lack of sophistication in the Aurora attack and the state of malware attacks on the Web...

Why Bob Maley's Firing is Bad for All of Us

The news that Pennsylvania CISO Bob Maley lost his job for publicly discussing a security incident at last week’s RSA Conference really shouldn’t come as a surprise, but it does. Even for a government agency, this kind of lack of understanding of what actually matters is appalling and it is a...

State CSO Fired for Talking Openly at RSA

Pennsylvania’s chief information security officer, Robert Maley, has been fired, apparently for talking publicly at the RSA security conference last week about a recent incident involving the Commonwealth’s online driving exam scheduling system. Read the full article. Computerworld...

Tom Ptacek at RSA 2010

Ryan Naraine talks with Tom Ptacek of Matasano Security about the current state of the security industry and themes at the RSA Conference...

RSA 2010: Researchers Demo Mobile Botnet from Smartphone App

A pair of researchers has amassed nearly 8,000 iPhones and Android smartphones in an experimental mobile botnet that demonstrates the ease of spreading potentially malicious applications on these devices. Read the full article. Dark Reading...

RSA 2010: Experts Reject Taxing Hacks & Malware

Microsoft’s idea that the fight against malware could be funded by an Internet tax is “horrible,” an analyst said as other experts weighed in on a recent comment by the company’s security chief. Read the full article. Computerworld...

RSA 2010: BlackEnergy 2 Botnet Revealed

Like the sequel to a successful movie, the botnet behind the distributed denial of service attacks that hit the country of Georgia during its conflict with Russia in 2008 has been updated. This time though, the idea isn’t hacktivism—it’s stealing financial data and, unlike in the case of other...

RSA 2010: How Cloud Security Is the Wild West

Economic pressures are driving more businesses and governments to nervously eye cloud computing, despite myriad unanswered questions that swirl around a single central concern: security. This was backdrop for a panel discussion between CISOs at this week’s RSA Conference. Read the full article...