PSF-2011-3 ssl CBC IV attack

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HT...

CVE-2011-3389

CVE-2011-3389 is the BEAST information-disclosure vulnerability in TLS/SSL CBC-mode encryption, allowing a network attacker to glean plaintext headers under certain configurations (e.g., when CBC with chained IVs is used and the attacker can inject/observe traffic). The connected documents show m...

Comodo Hacker - "Comodogate" Iranian hacker claims all internet is insecure !

Comodo Hacker - "Comodogate" Iranian hacker claims all internet is insecure Message By Comodo Hacker : Hello I'm writing this to the world, so you'll know more about me.. At first I want to give some points, so you'll be sure I'm the hacker: I hacked Comodo from InstantSSL.it, their CEO's e-mail...

FreeBSD : FreeBSD -- SSL protocol flaw (406779fd-ca3b-11df-aade-0050568f000c)

The SSL version 3 and TLS protocols support session renegotiation without cryptographically tying the new session parameters to the old parameters. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML...

Mandriva Update for nss MDVSA-2010:069 (nss)

Check for the Version of nss OpenVAS Vulnerability Test Mandriva Update for nss MDVSA-2010:069 nss Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms ...

Man in the Middle Fix For SSL Is Ready

The Internet Engineering Task Force IETF has completed a security extension to the Secure Sockets Layer SSL protocol that fixes a flaw affecting browsers, servers, smart cards, and VPN products, as well as many lower-profile devices, such as Webcams, that contain the protocol embedded in their...

FreeBSD-SA-09:15.ssl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-09:15.ssl Security Advisory The FreeBSD Project Topic: SSL protocol flaw Category: contrib Module: openssl Announced: 2009-12-03 Credits: Marsh Ray, Steve Dispens...

Cross site request forgery (csrf)

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...

CVE-2009-3555

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...

CVE-2009-3555

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...

The renegotiation vulnerability in SSL protocol

The renegotiation vulnerability in SSL protocol Severity: major CVE-2009-3555 Not vulnerable: 0.8.23+, 0.7.64+ Vulnerable: 0.1.0-0.8.22...

CVE-2009-3555

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...

CVE-2009-3555

The TLS and SSL 3.0 (and possibly earlier) protocols, used in various products including Microsoft IIS 7.0 , mod_ssl in Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla NSS 3.12.4 and earlier, and multiple Cisco products, fail to properly associate r...

CVE-2009-3555

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...

SSL Flaw Has Researchers Hustling to Fix

A flaw in the SSL protocol that could affect company networks, hosting environments and key machines has security researchers scrambling. The flaw, which requires a hack in to a network to launch, has devastating consequences and implications on database and mail servers. Discovered in August by...

Design/Logic Flaw

lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate...

Can MashSSL solve the mash-up security problem?

A startup out of the University of Texas today released a new open protocol and related technology that addresses the inherent security risks to Web 2.0-type application mashups, according to a new report darkreading.com. SafeMashups’ new technology lets applications authenticate with one another...

Debian Security Advisory DSA 465-1 (openssl,openssl094,openssl095)

The remote host is missing an update to openssl,openssl094,openssl095 announced via advisory DSA 465-1. OpenVAS Vulnerability Test $Id: deb4651.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 465-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft...

Debian Security Advisory DSA 888-1 (openssl)

The remote host is missing an update to openssl announced via advisory DSA 888-1. OpenVAS Vulnerability Test $Id: deb8881.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 888-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Ubuntu 5.10 / 6.06 LTS / 6.10 : fetchmail vulnerability (USN-405-1)

It was discovered that fetchmail did not correctly require TLS negotiation in certain situations. This would result in a user's unencrypted password being sent across the network. If fetchmail has been configured to use the 'sslproto tls1', 'sslcertck', or 'sslfingerprint' options with a server...