Scientific Linux Security Update : openssl on SL5.x i386/x86_64 (20141016) (POODLE)

This update adds support for the TLS Fallback Signaling Cipher Suite Value TLSFALLBACKSCSV, which can be used to prevent protocol downgrade attacks against applications which re-connect using a lower SSL/TLS protocol version when the initial connection indicating the highest supported protocol...

CVE-2014-6969

The Deltin Suites aka com.DeltinSuites application 3.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Deltin Suites aka com.DeltinSuites application 3.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6969

The CVE-2014-6969 entry describes an issue in the Deltin Suites Android app (com.DeltinSuites) version 3.4.1 where SSL certificate validation is not performed, enabling man‑in‑the‑middle attackers to spoof servers and exfiltrate sensitive data via a crafted certificate. Affected software: Deltin ...

CVE-2014-6969

The Deltin Suites aka com.DeltinSuites application 3.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

SSL/TLS: SSLv3 Protocol CBC Cipher Suites Information Disclosure Vulnerability (POODLE)

This host is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SSL/TLS Version Detection

Check if a server supports a given version of SSL/TLS and cipher suites. The certificate is stored in loot, and any known vulnerabilities against that SSL version and cipher suite combination are checked. These checks include POODLE, deprecated protocols, expired/not valid certs, low key strength...

SSL/TLS: Perfect Forward Secrecy Cipher Suites Missing

The remote service is missing support for SSL/TLS cipher suites supporting Perfect Forward Secrecy. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Scientific Linux Security Update : openssl on SL5.x i386/x86_64 (20140813)

It was discovered that the OBJobj2txt function could fail to properly NUL-terminate its output. This could possibly cause an application using OpenSSL functions to format fields of X.509 certificates to disclose portions of its memory. CVE-2014-3508 Multiple flaws were discovered in the way OpenS...

VMware Horizon View Multiple Vulnerabilities (VMSA-2014-0006)

The version of VMware Horizon View installed on the remote Windows host is version 5.3.x prior to 5.3.2 or 5.3.x prior to 5.3 Feature Pack 3. It is, therefore, affected by multiple vulnerabilities in the bundled OpenSSL library : - An error exists in the function 'ssl3readbytes' that could allow...

HP Smart Update Manager 6.x < 6.4.1 Multiple Vulnerabilities

The version of HP Smart Update manager running on the remote host is prior to 6.4.1. It is, therefore, affected by the following vulnerabilities : - An error exists in the function 'ssl3readbytes' that can allow data to be injected into other sessions or allow denial of service attacks. Note that...

McAfee Email Gateway OpenSSL Multiple Vulnerabilities (SB10075)

The remote host is running a version of McAfee Email Gateway MEG that is affected by the multiple vulnerabilities related to the included OpenSSL library : - An error exists in the function 'ssl3readbytes' that can allow data to be injected into other sessions or allow denial of service attacks...

Oracle July 2014 Critical Patch Update

Never one to skimp on patches, Oracle is expected to release 113 of them tomorrow as part of its quarterly Critical Patch Update. The company also clarified that Java 7 versions will continue to work on the end-of-life Microsoft Windows XP platform and Oracle security updates for Java on XP...

CVE-2014-3812

The Juniper Junos Pulse Secure Access Service SSL VPN devices with IVE OS before 7.4r5 and 8.x before 8.0r1 and Junos Pulse Access Control Service UAC before 4.4r5 and 5.x before 5.0r1 enable cipher suites with weak encryption algorithms, which make it easier for remote attackers to obtain...

AIX OpenSSL Advisory : openssl_advisory9.doc

The version of OpenSSL installed on the remote host is potentially affected by the following remote code execution and denial of service vulnerabilities : - OpenSSL could allow an attacker to cause a buffer overrun situation when an attacker sends invalid DTLS fragments to an OpenSSL DTLS client ...

UBUNTU-CVE-2014-3470

The ssl3sendclientkeyexchange function in s3clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service NULL pointer dereference and client crash by triggering a NULL certificate...

TLS Servers Cipher Suites Vulnerability Scanning Tools

Several vulnerability scanning tools are designed to gather supported cipher suites information from TLS servers. Such scans might indicate an attempt to disclose information about a server, as a preparation for an attack...

SMTP STARTTLS Deployments Better than Expected

As more service providers understand and embrace the importance of encrypting online communication, certain technologies are being elevated to the forefront of conversations. Perfect Forward Secrecy and HTTP Strict Transport Security HSTS are two that generally top most lists, but another, SMTP...

SSL/TLS: Report Perfect Forward Secrecy (PFS) Cipher Suites

This routine reports all SSL/TLS cipher suites accepted by a service which are supporting Perfect Forward Secrecy PFS. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

TLS Invalid Cipher Suites Denial of Service

A denial of service vulnerability has been reported in servers using TLS protocol. The vulnerability is due to the server's inability to handle Invalid TLS cipher suites. Remote attackers can exploit this issue by sending specially crafted cipher suites to an affected server...