EUVD-2009-0594

Malware in sbrugna...

OpenSSL < 0.9.8k Signature Repudiation

According to its banner, the remote server is running a version of OpenSSL that is earlier than 0.9.8k. As such, it may allow a valid sign to generate invalid signatures which would appear valid and could be repudiated later. This only affects CMS users. CMS appeared in OpenSSL 0.9.8h. C Tenable...

CVE-2009-0591: Improper Authentication

The CMSverify function in OpenSSL 0.9.8h through 0.9.8j, when CMS is enabled, does not properly handle errors associated with malformed signed attributes, which allows remote attackers to repudiate a signature that originally appeared to be valid but was actually invalid...