UBUNTU-CVE-2014-3509

Race condition in the sslparseserverhellotlsext function in t1lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service memory overwrite and client application crash or possibly have...

openSUSE Security Update : libopenssl-devel (openSUSE-SU-2011:0014-1)

Malicious clients could downgrade a connection to a low strength cipher suite on session resumption if the server offers such ciphers CVE-2010-4180. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security...

Slack: TLS1/SSLv3 Renegotiation Vulnerability

URL: http://www.slack.com Vulnerability description A flaw in the design of the TLS v. 1/SSL v. 3 TLS/SSL handshake process was discovered in 2009, and RFC 5746 Feb. 2010 was released to update the protocol specification. Since then, most system manufacturers have released patches to fix this fla...

Triple Handshake TLS Attacks Target Resumption, Renegotiation

A team of researchers has published a paper that explains a number of attacks against websites and Web-based applications running TLS. The researchers’ techniques do not exploit implementation errors, the most common attack vector against encryption securing online communication, instead focus on...

Internet Bug Bounty: TLS Triple Handshake Attack

More details are at https://secure-resumption.com 2 Scenario ====== Consider a client C that normally authenticates to a server S using a client certificate. If C uses the same certificate to authenticate to a malicious server M, then we show that M can use C's certificate to authenticate its own...

gnutls: buffer overflow in gnutls_session_get_data() (GNUTLS-SA-2011-2)

Buffer overflow in the gnutlssessiongetdata function in lib/gnutlssession.c in GnuTLS 2.12.x before 2.12.14 and 3.x before 3.0.7, when used on a client that performs nonstandard session resumption, allows remote TLS servers to cause a denial of service application crash via a large SessionTicket...

gnutls: buffer overflow in gnutls_session_get_data() (GNUTLS-SA-2011-2)

Buffer overflow in the gnutlssessiongetdata function in lib/gnutlssession.c in GnuTLS 2.12.x before 2.12.14 and 3.x before 3.0.7, when used on a client that performs nonstandard session resumption, allows remote TLS servers to cause a denial of service application crash via a large SessionTicket...

FreeBSD Ports: gnutls

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2012 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 7462)

Malicious clients could have downgraded a connection to a low strength cipher suite on session resumption if the server offers such ciphers CVE-2010-4180. This has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

CVE-2011-4128

CVE-2011-4128 affects GnuTLS: a buffer overflow in gnutls_session_get_data in lib/gnutls_session.c can be triggered when a client uses nonstandard session resumption. A remote TLS server can cause an application crash (DoS) by sending a large SessionTicket. Affected are GnuTLS 2.12.x prior to 2.1...

gnutls -- client session resumption vulnerability

The GnuTLS team reports: GNUTLS-SA-2011-2 Possible buffer overflow/Denial of service...

SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 7463)

Malicious clients could have downgraded a connection to a low strength cipher suite on session resumption if the server offers such ciphers CVE-2010-4180. This has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

OpenSSL SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG Session Resume Ciphersuite Downgrade Issue

The version of OpenSSL on the remote host has been shown to allow resuming session with a weaker cipher than was used when the session was initiated. This means that an attacker that sees i.e., by sniffing the start of an SSL connection can manipulate the OpenSSL session cache to cause subsequent...

CVE-2008-1948

CVE-2008-1948 affects GnuTLS before 2.2.4. The _gnutls_server_name_recv_params function in libext_server_name.c within libgnutls/gnutls-serv mishandles the Server Names count in TLS 1.0 Client Hello extensions, causing a buffer overflow in session resumption data and potentially a crash or arbitr...

GNUTLS-SA-2008-1-1 GnuTLS buffer overflow

The gnutlsservernamerecvparams function in lib/extservername.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during extension handling, which allows remote attackers to cause a denial of service crash or...

GNUTLS-SA-2008-1-1 GnuTLS buffer overflow

The gnutlsservernamerecvparams function in lib/extservername.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during extension handling, which allows remote attackers to cause a denial of service crash or...