Google SHA-1 Deprecation

Google has announced its timeline for deprecating SHA-1 certificates, despite concerns expressed recently that sunsetting the broken encryption hashing algorithm will disconnect millions from the Internet. SHA-1’s demise has been accelerated in recent months since researchers published a paper...

oclHashcat v2.01 - Worlds Fastest Password Cracker

oclHashcat is the world's fastest and most advanced GPGPU-based password recovery utility, supporting five unique modes of attack for over 170 highly-optimized hashing algorithms. oclHashcat currently supports AMD OpenCL and Nvidia CUDA graphics processors on GNU/Linux and Windows 7/8/10, and has...

ntp security, bug fix, and enhancement update

4.2.6p5-22 - check origin timestamp before accepting KoD RATE packet CVE-2015-7704 - allow only one step larger than panic threshold with -g CVE-2015-5300 4.2.6p5-20 - validate lengths of values in extension fields CVE-2014-9297 - drop packets with spoofed source address ::1 CVE-2014-9298 - rejec...

Microsoft Considers Earlier SHA-1 Deprecation Deadline

Tech companies continue to back away from SHA-1 like it’s an infectious disease. Microsoft, which already had plans to deprecate the crusty cryptographic algorithm by the start of 2017, decided this week to move up that deadline six months. The company said it’s considering whether it will start...

Mike Mimoso and Chris Brook Discuss how the a Campaign Using the Angler Exploit Kit was Disrupted and More of the Week's News

Mike Mimoso and Chris Brook discuss the week in news–including how researchers disrupted a $30M campaign using the Angler Exploit Kit, how another researcher was forced to pull a talk from a conference, and how a practical SHA-1 collision could be months away, not years. Download:...

Practical SHA-1 Collision Attack Months Away

When Bruce Schneier made his oft-cited and mathematically sound projections about the life expectancy of the SHA-1 cryptographic algorithm, he didn’t think he was being conservative. “I thought I was being accurate given the information I had at the time,” Schneier said on Thursday. Schneier in...

Collision Attack: Widely Used SHA-1 Hash Algorithm Needs to Die Immediately

SHA-1 – one of the Internet's widely adopted cryptographic hash function – is Just about to Die. Yes, the cost and time required to break the SHA1 algorithm have fallen much faster than previously expected. According to a team of researchers, SHA-1 is so weak that it may be broken and compromised...

SSL Certificate Signed Using SHA-1 Algorithm

The remote service uses an SSL certificate chain that has been signed with SHA-1, a cryptographically weak hashing algorithm. This signature algorithm is known to be vulnerable to collision attacks. An attacker can potentially exploit this to generate another certificate with the same digital...

Scientific Linux Security Update : freeradius on SL6.x i386/x86_64 (20150722)

A stack-based buffer overflow was found in the way the FreeRADIUS rlmpap module handled long password hashes. An attacker able to make radiusd process a malformed password hash could cause the daemon to crash. CVE-2014-2015 The freeradius packages have been upgraded to upstream version 2.2.6, whi...

CentOS 6 : freeradius (CESA-2015:1287)

Updated freeradius packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which giv...

WordPoints: Weak Cryptographic Hash

Issue: The following files are vulnerable to this issue: \src\includes\class-breaking-updater.php line 246 and 247 protected function checkmodule $module $randstr = strshuffle md5 microtime ; $nonce = md5 $randstr . 'wordpointscheckmodules-' . $module ;...

Moderate: Red Hat Security Advisory: freeradius security, bug fix, and enhancement update

Updated freeradius packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which giv...

Facebook Requires SHA-2 Support as of Oct. 1, 2015

Facebook has put developers on notice that as of Oct. 1, apps that do not support SHA-2 will no longer connect to its network. With Tuesday’s announcement, the tech giant has fallen in line alongside Google, Mozilla and Microsoft in deprecating the SHA-1 and older hash algorithms. “These changes...

SUSE SLES10 Security Update : OpenSSL (SUSE-SU-2014:0539-1)

OpenSSL has been updated to fix an attack on ECDSA Nonces. Using the FLUSH+RELOAD Cache Side-channel Attack the Nonces could be recovered. CVE-2014-0076 The update also enables use of SHA-2 family certificate verification of X.509 certificates used in todays SSL certificate infrastructure. Note...

Microsoft SHA-2 Advisory Causing 'Infinite Loop' Issues

Problems with a security update issued this week by Microsoft have surfaced on a number of technology forums. Windows users say Microsoft Security Advisory 303929, which adds SHA-2 code-signing and verification support for Windows 7 client machines and Windows Server 2008 R2 boxes, is causing...

MS KB3033929: Availability of SHA-2 Code Signing Support for Windows 7 and Windows Server 2008 R2

The remote host is missing Microsoft KB3033929, an update that improves cryptography and digital certificate handling in Windows 7 and Windows Server 2008 R2. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid81731; scriptversion"1.3"; scriptcvsdate"Date: 2018/11/15...

Next Generation Snort IPS: Snort3

The Snort++ project has been hard at work for a while now and we have released the third alpha of the next generation Snort IPS Intrusion Prevention System. This file will show you what Snort++ has to offer and guide you through the steps from download to demo. If you are unfamiliar with Snort yo...

OracleVM 2.2 : openssl (OVMSA-2014-0007)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability - replace expired GlobalSign Root CA certificate in ca-bundle.crt - fix for CVE-2013-0169 - SSL/TLS CBC timing attack 907589 - fix for CVE-2013-0166 ...

DEBIAN-CVE-2014-2015

Stack-based buffer overflow in the normify function in the rlmpap module modules/rlmpap/rlmpap.c in FreeRADIUS 2.x, possibly 2.2.3 and earlier, and 3.x, possibly 3.0.1 and earlier, might allow attackers to cause a denial of service crash and possibly execute arbitrary code via a long password has...

Microsoft Extends SHA-2, TLS Support for Windows

One by one, tech companies have been tossing aside the SHA-1 cryptographic algorithm like the unreliable collision-prone mess that it is. Microsoft was among the first to steer its customers away from SHA-1 and established an internal edict that its developers would no longer use it for...