[SECURITY] [DSA 1718-1] New boinc packages fix validation bypass

------------------------------------------------------------------------ Debian Security Advisory DSA-1718-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff February 08, 2009 http://www.debian.org/security/faq -...

CVE-2009-0124

The tqslverifyDataBlock function in opensslcert.cpp in American Radio Relay League ARRL tqsllib 2.0 does not properly check the return value from the OpenSSL EVPVerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a...

CVE-2009-0129

libcrypt-openssl-dsa-perl does not properly check the return value from the OpenSSL DSAverify and DSAdoverify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077...

DEBIAN-CVE-2009-0127

M2Crypto does not properly check the return value from the OpenSSL EVPVerifyFinal, DSAverify, ECDSAverify, DSAdoverify, and ECDSAdoverify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to...

CVE-2009-0129

libcrypt-openssl-dsa-perl does not properly check the return value from the OpenSSL DSAverify and DSAdoverify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077...

Input validation

The decryptpublic function in lib/crypt.cpp in the client in Berkeley Open Infrastructure for Network Computing BOINC 6.2.14 and 6.4.5 does not check the return value from the OpenSSL RSApublicdecrypt function, which allows remote attackers to bypass validation of the certificate chain via a...

CVE-2009-0127

Technical details about CVE-2009-0127 are not publicly provided in the supplied documents. Monitor for updates for affected components, root cause, and fixes.

CVE-2009-0125

Technical details for CVE-2009-0125 are not publicly available in the provided documents. Monitor for updates from upstream and security advisories.

SA-CORE-2009-001 Drupal core - Multiple vulnerabilities

Multiple vulnerabilities and weaknesses were discovered in Drupal. Access Bypass The Content Translation module for Drupal 6.x enables users to make a translation of an existing item of content a node. In that process the existing node's content is copied into the new node's submission form. The...

DSA-1700-1 lasso - validation bypass

Bulletin has no description...

DEBIAN-CVE-2009-0050

Lasso 2.2.1 and earlier does not properly check the return value from the OpenSSL DSAverify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077...

Input validation

ZXID 0.29 and earlier does not properly check the return value from the OpenSSL DSAverify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077...

CVE-2009-0047

CVE-2009-0047 affects Gale 0.99 and earlier due to improper checking of the OpenSSL EVP_VerifyFinal return value, allowing a remote attacker to bypass certificate-chain validation via a malformed SSL/TLS signature for DSA/ECDSA keys. The root cause is the same class of issue described in CVE-2008...

CVE-2008-5077

OpenSSL 0.9.8i and earlier does not properly check the return value from the EVPVerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys...

DEBIAN-CVE-2008-5077

OpenSSL 0.9.8i and earlier does not properly check the return value from the EVPVerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys...

CVE-2009-0021

NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVPVerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to...

DEBIAN-CVE-2009-0025

BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL DSAverify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077...

CVE-2009-0021

Removed by vendor...

CVE-2009-0025

CVE-2009-0025 describes a flaw in BIND 9.6.0 and earlier where the OpenSSL DSA_verify return value is not properly checked, enabling remote attackers to bypass certificate-chain validation via a malformed SSL/TLS signature. F5 advisories reference this as a related vulnerability to CVE-2008-5077 ...

OpenSSL Incorrect checks for malformed signatures

OpenSSL 0.9.8i and earlier does not properly check the return value from the EVPVerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys...