Timing Attacks

django-anymail is vulnerable to timing attacks. The WEBHOOKAUTHORIZATION shared secret can be obtained because it is not compared in constant time. This allows an attacker to decipher the secret by using the time a call takes to return...

Al-Khaser v0.72 - Public malware techniques used in the wild (Virtual Machine, Emulation, Debuggers, Sandbox detection)

al-khaser is a PoC "malware" application with good intentions that aims to stress your anti-malware system. It performs a bunch of common malware tricks with the goal of seeing if you stay under the radar. Features Anti-debugging attacks IsDebuggerPresent CheckRemoteDebuggerPresent Process...

Fedora 26 : firefox (2018-fb582aabcc)

Update to 57.0.4 - Security fixes to address the Meltdown and Spectre timing attacks - https://blog.mozilla.org/security/2018/01/03/mitigations -landing-new-class-timing-attack/ - Require new nss 3.34 fixed 1531031 - Disabled ARM on all Fedoras due to 1523912 Note that Tenable Network Security...

Timing Attacks

woocommerce is vulnerable to timing attacks. The library is vulnerable because it does not compare HMACs in constant-time, which allows malicious users to use the timing of the request to progressively identify a valid HMAC hashes...

CVE-2017-12849

Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks...

Design/Logic Flaw

Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks...

CVE-2017-12849

Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks...

CVE-2017-12849

Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks...

PT-2017-12723 · Silverstripe · Silverstripe Cms

Name of the Vulnerable Software and Affected Versions: SilverStripe CMS versions prior to 3.5.5 SilverStripe CMS versions 3.6.x prior to 3.6.1 Description: The issue allows remote attackers to enumerate users via timing attacks due to response discrepancy in the login and password reset forms...

Timing Attacks

neo4j-security is vulnerable to timing attacks. This vulnerability is caused because the credential hashes are not compared in constant time, allowing malicious users to guess valid hashes based on the time that a comparison takes...

Timing Attacks

kohana/core is vulnerable to timing attacks. The library is vulnerable because it does not compare hashes in constant-time, which allows attackers to use the timing of the request to progressively identify a valid hash...

Design/Logic Flaw

Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors...

CVE-2015-3250

Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors...

DEBIAN-CVE-2015-3250

Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors...

UBUNTU-CVE-2015-3250

Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors...

DEBIAN-CVE-2017-12872

The 1 Htpasswd authentication source in the authcrypt module and 2 SimpleSAMLSession class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input...

Timing Attacks

CakePHP is vulnerable to timing attacks. The library does not compare hashes in constant time, which allows malicious users to use the timing of the request to progressively identify a valid hash...

Al-Khaser: A Benign Malware to Test Your Anti Malware

PenTestIT RSS Feed There is a idiom - use a thorn to remove a thorn. Tools like Al-Khaser cement this idiom. It is an open source, benign malware to test how good your anti-malware or local security product is. It allows you to do so by implementing commonly used tactics used by actual malwares a...

Code injection

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks...

CVE-2017-3156

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks...