Privacy issue with SSL Client Authentication — Mozilla

Peter Brodersen and Alexander Klink independently reported that the default setting for SSL Client Authentication, automatically selecting a client certificate on behalf of the user, creates a potential privacy issue for users by allowing tracking through client certificates. For users who alread...

OpenSSL SSL client DoS

NULL pointer dereference on malformed server certificate...

Code injection

The SSL client implementation in BEA WebLogic Server 7.0 SP7, 8.1 SP2 through SP6, 9.0, 9.1, 9.2 Gold through MP2, and 10.0 sometimes selects the null cipher when others are available, which might allow remote attackers to intercept communications...

CVE-2007-4615

The CVE-2007-4615 entry concerns BEA WebLogic Server’s SSL client implementation. Affected versions include BEA WebLogic Server 7.0 SP7, 8.1 SP2–SP6, 9.0, 9.1, 9.2 Gold through MP2, and 10.0. The vulnerability arises when the SSL client sometimes selects the null cipher if other ciphers are avail...

CVE-2006-5075

The Kernel SSL Proxy service svc:/network/ssl/proxy in Sun Solaris 10 before 20060926 allows remote attackers to cause a denial of service system crash via unspecified vectors related to an SSL client...

IBM Tivoli Storage Manager < 5.2.5.4/5.3.6.6/5.4.2.7/5.5.2 Multiple Vulnerabilities

Binary data 5016.prm...

FreeBSD : Apache-SSL optional client certificate vulnerability (7)

The following package needs to be updated: apache+ssl %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkg7557a2b15d6311d880e30020ed76ef5a.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright...

CVE-2003-0544

OpenSSL 0.9.6 and 0.9.7 does not properly track the number of characters in certain ASN.1 inputs, which allows remote attackers to cause a denial of service crash via an SSL client certificate that causes OpenSSL to read past the end of a buffer when the long form is used...

CVE-2003-0543

Integer overflow in OpenSSL 0.9.6 and 0.9.7 allows remote attackers to cause a denial of service crash via an SSL client certificate with certain ASN.1 tag values...

[SECURITY] [DSA 394-1] New openssl095 packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 394-1 [email protected] http://www.debian.org/security/ Martin Schulze October 11th, 2003 http://www.debian.org/security/faq -...

CVE-2003-0543

Integer overflow in OpenSSL 0.9.6 and 0.9.7 allows remote attackers to cause a denial of service crash via an SSL client certificate with certain ASN.1 tag values...

CVE-2003-0544

OpenSSL 0.9.6 and 0.9.7 does not properly track the number of characters in certain ASN.1 inputs, which allows remote attackers to cause a denial of service crash via an SSL client certificate that causes OpenSSL to read past the end of a buffer when the long form is used...

CVE-2003-0543

Integer overflow in OpenSSL 0.9.6 and 0.9.7 allows remote attackers to cause a denial of service crash via an SSL client certificate with certain ASN.1 tag values...

CAN-2003-0543/0544 OpenSSL ASN.1 protocol crashes

Integer overflow in OpenSSL 0.9.6 and 0.9.7 allows remote attackers to cause a denial of service crash via an SSL client certificate with certain ASN.1 tag values...

CVE-2001-1105

The CVE-2001-1105 entry affects RSA BSAFE SSL-J 3.0, 3.0.1 and 3.1 as used in Cisco iCND 2.0. The vulnerability is that the product caches session IDs from failed login attempts, which could allow remote attackers to bypass SSL client authentication and access sensitive data after an initial fail...

CVE-2001-1105

RSA BSAFE SSL-J 3.0, 3.0.1 and 3.1, as used in Cisco iCND 2.0, caches session IDs from failed login attempts, which could allow remote attackers to bypass SSL client authentication and gain access to sensitive data by logging in after an initial failure...