99 matches found
Authentication flaw
tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1...
CVE-2018-16758
Missing message authentication in the meta-protocol in Tinc VPN version 1.0.34 and earlier allows a man-in-the-middle attack to disable the encryption of VPN packets...
CVE-2018-16737
tinc before 1.0.30 has a broken authentication protocol, without even a partial mitigation...
CVE-2018-16758
CVE-2018-16758 affects the tinc VPN daemon up to version 1.0.34. The root cause is missing message authentication in the meta-protocol, enabling a man-in-the-middle to disable VPN packet encryption. Public sources (NVD, CNVD) describe a MITM-based impact that decrypts or disrupts traffic. Fedora ...
FreeBSD : tinc -- Buffer overflow (a4eb38ea-cc06-11e8-ada4-408d5cf35399)
tinc-vpn.org reports : The authentication protocol allows an oracle attack that could potentially be exploited. If a man-in-the-middle has intercepted the TCP connection it might be able to force plaintext UDP packets between two nodes for up to a PingInterval period. C Tenable Network Security,...
CVE-2018-16758
Missing message authentication in the meta-protocol in Tinc VPN version 1.0.34 and earlier allows a man-in-the-middle attack to disable the encryption of VPN packets...
CVE-2018-16738
tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1...
CVE-2018-16737
CVE-2018-16737 affects the tinc VPN daemon, where versions prior to 1.0.30 implement a broken authentication protocol. The available connected documents confirm this specific root cause and reference affected software as tinc before 1.0.30. Documented impact is implied by the broken authenticatio...
CVE-2018-16738
CVE-2018-16738 affects tinc 1.0.30–1.0.34, which have a broken authentication protocol with only partial mitigation; the issue is fixed in 1.1. The NVD notes a CVSS v3.1 base score of 3.7 (LOW) with network attack vector and high attack complexity, no privileges required, and no impact on confide...
CVE-2018-16738
tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1...
CVE-2018-16758
Missing message authentication in the meta-protocol in Tinc VPN version 1.0.34 and earlier allows a man-in-the-middle attack to disable the encryption of VPN packets...
CVE-2018-16737
tinc before 1.0.30 has a broken authentication protocol, without even a partial mitigation...
CVE-2018-16737
tinc before 1.0.30 has a broken authentication protocol, without even a partial mitigation...
CVE-2018-16738
tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1...
CVE-2018-16758
Missing message authentication in the meta-protocol in Tinc VPN version 1.0.34 and earlier allows a man-in-the-middle attack to disable the encryption of VPN packets...
Debian DSA-4312-1 : tinc - security update
Several vulnerabilities were discovered in tinc, a Virtual Private Network VPN daemon. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2018-16738 Michael Yonli discovered a flaw in the implementation of the authentication protocol that could allow a remo...
[SECURITY] [DSA 4312-1] tinc security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4312-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 08, 2018 https://www.debian.org/security/faq -...
[SECURITY] [DSA 4312-1] tinc security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4312-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 08, 2018 https://www.debian.org/security/faq -...
PT-2018-13714 · Tinc +1 · Tinc +1
Name of the Vulnerable Software and Affected Versions: tinc versions 1.0.30 through 1.0.34 Description: The issue concerns a broken authentication protocol. Although there is a partial mitigation available, the problem is fully resolved in version 1.1. Recommendations: For versions 1.0.30 through...
