156 matches found
FreeBSD : ruby -- Hostname check bypassing vulnerability in SSL client (ebd877b9-7ef4-4375-b1fd-c67780581898)
Ruby Developers report : Ruby's SSL client implements hostname identity check but it does not properly handle hostnames in the certificate that contain null bytes. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the...
Fedora 17 : ruby-1.9.3.448-31.fc17 (2013-12062)
A vulnerability was found in Ruby's SSL client that could allow man-in-the-middle attackers to spoof SSL servers via valid certificate issued by a trusted certification authority. This vulnerability has been assigned the CVE identifier CVE-2013-4073. This new update should solve this issue. Note...
Fedora 18 : ruby-1.9.3.448-31.fc18 (2013-12123)
A vulnerability was found in Ruby's SSL client that could allow man-in-the-middle attackers to spoof SSL servers via valid certificate issued by a trusted certification authority. This vulnerability has been assigned the CVE identifier CVE-2013-4073. This new update should solve this issue. Note...
[slackware-security] ruby (SSA:2013-178-01)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 slackware-security ruby SSA:2013-178-01 New ruby packages are available for Slackware 13.1, 13.37, 14.0, and -current to fix a security issue. Here are the details from the Slackware 14.0 ChangeLog: +--------------------------+...
OpenSSL Man-in-the-middle flaw fixed in Ruby
The maintainers of Ruby have fixed a serious flaw in its SSL client that could have allowed an attacker to conduct man-in-the-middle attacks by spoofing an SSL server. The vulnerability lies in the OpenSSL toolkit that’s built in to Ruby and is present in several versions of the software from 1.8...
CVE-2013-4073 ruby: hostname check bypassing vulnerability in SSL client
The OpenSSL::SSL.verifycertificateidentity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows...
ruby -- Hostname check bypassing vulnerability in SSL client
Ruby Developers report: Ruby's SSL client implements hostname identity check but it does not properly handle hostnames in the certificate that contain null bytes...
DSA-2664-1 stunnel4 - buffer overflow
Bulletin has no description...
SSL Client Certificate Detection
Binary data 7077.pasl...
FreeBSD : stunnel -- Remote Code Execution (c97219b6-843d-11e2-b131-000c299b62e1)
Michal Trojnara reports : 64-bit versions of stunnel with the following conditions : NTLM authentication enabled CONNECT protocol negotiation enabled Configured in SSL client mode An attacker that can either control the proxy server specified in the 'connect' option or execute MITM attacks on the...
stunnel -- Remote Code Execution
Michal Trojnara reports: 64-bit versions of stunnel with the following conditions: NTLM authentication enabled CONNECT protocol negotiation enabled Configured in SSL client mode An attacker that can either control the proxy server specified in the "connect" option or execute MITM attacks on the T...
Fedora Update for guacamole-ext FEDORA-2012-14179
Check for the Version of guacamole-ext OpenVAS Vulnerability Test Fedora Update for guacamole-ext FEDORA-2012-14179 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...
[SECURITY] Fedora 17 Update: guacamole-ext-0.6.1-2.fc17
Guacamole is an HTML5 web application that provides access to desktop environments using remote desktop protocols such as VNC or RDP. A centraliz ed server acts as a tunnel and proxy, allowing access to multiple desktops thr ough a web browser. No plugins are needed: the client requires nothing...
CentOS Update for gnutls CESA-2012:0428 centos5
Check for the Version of gnutls OpenVAS Vulnerability Test CentOS Update for gnutls CESA-2012:0428 centos5 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under th...
CentOS 6 : nss (CESA-2012:0973)
Updated nss, nss-util, and nspr packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Network Security Services NSS is a set of...
RHEL 6 : nss, nss-util, and nspr (RHSA-2012:0973)
Updated nss, nss-util, and nspr packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Network Security Services NSS is a set of...
OpenSSL 0.9.6 < 0.9.6k Multiple Vulnerabilities
The version of OpenSSL installed on the remote host is prior to 0.9.6k. It is, therefore, affected by multiple vulnerabilities as referenced in the 0.9.6k advisory. - OpenSSL 0.9.6 and 0.9.7 does not properly track the number of characters in certain ASN.1 inputs, which allows remote attackers to...
OpenSSL 0.9.7 < 0.9.7c Multiple Vulnerabilities
The version of OpenSSL installed on the remote host is prior to 0.9.7c. It is, therefore, affected by multiple vulnerabilities as referenced in the 0.9.7c advisory. - Double free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service crash and possibly execute arbitra...