what you don't know can hurt you
Showing 1 - 20 of 20 RSS Feed

CVE-2009-2409

Status Candidate

Overview

The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.

Related Files

VMware Security Advisory 2010-0019
Posted Dec 8, 2010
Authored by VMware | Site vmware.com

VMware Security Advisory 2010-0019 - ESX 3.x Console OS (COS) updates for samba, bzip2, and openssl packages.

tags | advisory
advisories | CVE-2009-0590, CVE-2009-2409, CVE-2009-3555, CVE-2010-0405, CVE-2010-3069
MD5 | 77bea71347b06ea7767dc27e922cab06
VMware Security Advisory 2010-0015
Posted Sep 30, 2010
Authored by VMware | Site vmware.com

VMware Security Advisory 2010-0015 - ESX 4.0 Console OS (COS) updates for NSS_db, OpenLDAP, cURL, sudo OpenSSL, GnuTLS, NSS and NSPR packages.

tags | advisory
advisories | CVE-2009-2409, CVE-2009-3245, CVE-2009-3555, CVE-2009-3767, CVE-2010-0433, CVE-2010-0734, CVE-2010-0826, CVE-2010-1646
MD5 | 9f99f58fbdd8d777048475ace5b9e8a4
Mandriva Linux Security Advisory 2010-084
Posted Apr 28, 2010
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2010-084 - Multiple Java OpenJDK security vulnerabilities have been identified and fixed. Packages for 2009.0 are provided due to the Extended Maintenance Program.

tags | advisory, java, vulnerability
systems | linux, mandriva
advisories | CVE-2009-2409, CVE-2009-3555, CVE-2009-3728, CVE-2009-3869, CVE-2009-3871, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877, CVE-2009-3879, CVE-2009-3880, CVE-2009-3881, CVE-2009-3882, CVE-2009-3883, CVE-2009-3884, CVE-2009-3885, CVE-2010-0082
MD5 | 799c117e760584a5cec15b3330233f9a
VMware Security Advisory 2010-0001
Posted Jan 7, 2010
Authored by VMware | Site vmware.com

VMware Security Advisory - Service console packages for Network Security Services (NSS) and NetScape Portable Runtime (NSPR) are updated to versions nss-3.12.3.99.3-1.2157 and nspr-4.7.6-1.2213 respectively. This patch fixes several security issues in the service console packages for NSS and NSPR.

tags | advisory
advisories | CVE-2009-2409, CVE-2009-2408, CVE-2009-2404, CVE-2009-1563, CVE-2009-3274, CVE-2009-3370, CVE-2009-3372, CVE-2009-3373, CVE-2009-3374, CVE-2009-3375, CVE-2009-3376, CVE-2009-3380, CVE-2009-3382
MD5 | 35db47ed4bf8e21e78243971ea73fd74
Mandriva Linux Security Advisory 2009-310
Posted Dec 3, 2009
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2009-310 - Multiple security vulnerabilities has been identified and fixed in OpenSSL.

tags | advisory, vulnerability
systems | linux, mandriva
advisories | CVE-2009-1377, CVE-2009-1378, CVE-2009-1379, CVE-2009-1386, CVE-2009-1387, CVE-2009-2409
MD5 | bf47b4f54622d06750c518c6d72b8f24
Mandriva Linux Security Advisory 2009-197
Posted Dec 3, 2009
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2009-197 - Security issues in nss prior to 3.12.3 could lead to a man-in-the-middle attack via a spoofed X.509 certificate and md2 algorithm flaws, and also cause a denial-of-service and possible code execution via a long domain name in X.509 certificate. This update provides the latest versions of NSS and NSPR libraries which are not vulnerable to those attacks. Packages for 2008.0 are being provided due to extended support for Corporate products.

tags | advisory, spoof, code execution
systems | linux, mandriva
advisories | CVE-2009-2408, CVE-2009-2409, CVE-2009-2404
MD5 | d1fe6bb9111bf8141068a8b4ced23ed8
Gentoo Linux Security Advisory 200912-1
Posted Dec 1, 2009
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 200912-1 - Multiple vulnerabilities in OpenSSL might allow remote attackers to conduct multiple attacks, including the injection of arbitrary data into encrypted byte streams. Versions less than 0.9.8l-r2 are affected.

tags | advisory, remote, arbitrary, vulnerability
systems | linux, gentoo
advisories | CVE-2009-1377, CVE-2009-1378, CVE-2009-1379, CVE-2009-1387, CVE-2009-2409, CVE-2009-3555
MD5 | eda05dcea4fc0d1832c3b0d48efd6661
Debian Linux Security Advisory 1935-1
Posted Nov 18, 2009
Authored by Debian | Site debian.org

Debian Linux Security Advisory 1935-1 - Dan Kaminsky and Moxie Marlinspike discovered that gnutls, an implementation of the TLS/SSL protocol, does not properly handle a '\\0' character in a domain name in the subject's Common Name or Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. In addition, with this update, certificates with MD2 hash signatures are no longer accepted since they're no longer considered cryptograhically secure.

tags | advisory, arbitrary, spoof, protocol
systems | linux, debian
advisories | CVE-2009-2409, CVE-2009-2730
MD5 | f1d05c0e177dfe3d76c29a5d66c2375b
Ubuntu Security Notice 859-1
Posted Nov 18, 2009
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 859-1 - Dan Kaminsky discovered that SSL certificates signed with MD2 could be spoofed given enough time. It was discovered that ICC profiles could be identified with ".." pathnames. Peter Vreugdenhil discovered multiple flaws in the processing of graphics in the AWT library. Multiple flaws were discovered in JPEG and BMP image handling. Multiple flaws were discovered in ASN.1 parsing. It was discovered that the graphics configuration subsystem did not correctly handle arrays.

tags | advisory, spoof
systems | linux, ubuntu
advisories | CVE-2009-2409, CVE-2009-3728, CVE-2009-3869, CVE-2009-3871, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877, CVE-2009-3879, CVE-2009-3880, CVE-2009-3881, CVE-2009-3882, CVE-2009-3883, CVE-2009-3884, CVE-2009-3885
MD5 | 54bc673da709689d9f06640381a35cb9
Mandriva Linux Security Advisory 2009-239
Posted Sep 22, 2009
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2009-239 - Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service (openssl s_client crash) and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server that uses a crafted server certificate. The dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL before 1.0.0 Beta 2 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence DTLS handshake message, related to a fragment bug. The NSS library library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws the scope of this issue is currently limited because the amount of computation required is still large. This update provides a solution to these vulnerabilities.

tags | advisory, remote, denial of service, spoof, vulnerability
systems | linux, mandriva
advisories | CVE-2009-1379, CVE-2009-1387, CVE-2009-2409
MD5 | 53607bac689b7a6488ea91c1596b0e99
Mandriva Linux Security Advisory 2009-238
Posted Sep 21, 2009
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2009-238 - Multiple vulnerabilities was discovered and corrected in openssl. This update provides a solution to these vulnerabilities.

tags | advisory, vulnerability
systems | linux, mandriva
advisories | CVE-2009-1379, CVE-2009-1386, CVE-2009-1387, CVE-2009-2409
MD5 | 85e9f4ac59e253200ef515ac358553de
Mandriva Linux Security Advisory 2009-237
Posted Sep 21, 2009
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2009-237 - ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello. The NSS library library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spooof certificates by using MD2 design flaws the scope of this issue is currently limited because the amount of computation required is still large. This update provides a solution to these vulnerabilities.

tags | advisory, remote, denial of service, vulnerability
systems | linux, mandriva
advisories | CVE-2009-1386, CVE-2009-2409
MD5 | 07a4c05eba0a7f4d1e1867a20a27c5b7
Debian Linux Security Advisory 1888-1
Posted Sep 16, 2009
Authored by Debian | Site debian.org

Debian Security Advisory 1888-1 - Certificates with MD2 hash signatures are no longer accepted by OpenSSL, since they're no longer considered cryptographically secure.

tags | advisory
systems | linux, debian
advisories | CVE-2009-2409
MD5 | 2064131fec58e5ed45bdc20da5c2b1ec
Ubuntu Security Notice 830-1
Posted Sep 15, 2009
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice USN-830-1 - Dan Kaminsky discovered OpenSSL would still accept certificates with MD2 hash signatures. As a result, an attacker could potentially create a malicious trusted certificate to impersonate another site. This update handles this issue by completely disabling MD2 for certificate validation.

tags | advisory
systems | linux, ubuntu
advisories | CVE-2009-2409
MD5 | d27ac5b8e1c7fbe411168e1ff2881023
Mandriva Linux Security Advisory 2009-197
Posted Sep 11, 2009
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2009-197-2 - Security issues in nss prior to 3.12.3 could lead to a man-in-the-middle attack via a spoofed X.509 certificate and md2 algorithm flaws, and also cause a denial-of-service and possible code execution via a long domain name in X.509 certificate. This update provides the latest versions of NSS and NSPR libraries which are not vulnerable to those attacks. This update also provides fixed packages for Mandriva Linux 2008.1 and fixes mozilla-thunderbird error messages.

tags | advisory, spoof, code execution
systems | linux, mandriva
advisories | CVE-2009-2408, CVE-2009-2409, CVE-2009-2404
MD5 | a1b379ded1c6bd3d8b05a91e792d8f95
Debian Linux Security Advisory 1874-1
Posted Aug 26, 2009
Authored by Debian | Site debian.org

Debian Security Advisory 1874-1 - Several vulnerabilities have been discovered in the Network Security Service libraries.

tags | advisory, vulnerability
systems | linux, debian
advisories | CVE-2009-2404, CVE-2009-2408, CVE-2009-2409
MD5 | 9d58597fcf6d247bb87acd2d06eb84ea
Mandriva Linux Security Advisory 2009-216
Posted Aug 24, 2009
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2009-216 - A number of security vulnerabilities have been discovered in the NSS and NSPR libraries and in Mozilla Thunderbird.

tags | advisory, vulnerability
systems | linux, mandriva
advisories | CVE-2009-2625, CVE-2009-2408, CVE-2009-2409, CVE-2009-2404
MD5 | bed9841c09c3299771d905604c5ad862
Ubuntu Security Notice 809-1
Posted Aug 22, 2009
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice USN-809-1 - Multiple vulnerabilities in gnutls12, gnutls13, and gnutls26 have been addressed.

tags | advisory, vulnerability
systems | linux, ubuntu
advisories | CVE-2009-2409, CVE-2009-2730
MD5 | 3dd58c80e1ed90fedfb0b46b66736c22
Mandriva Linux Security Advisory 2009-197
Posted Aug 11, 2009
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2009-197 - Security issues in nss prior to 3.12.3 could lead to a man-in-the-middle attack via a spoofed X.509 certificate and md2 algorithm flaws, and also cause a denial-of-service and possible code execution via a long domain name in X.509 certificate. This update provides the latest versions of NSS and NSPR libraries which are not vulnerable to those attacks.

tags | advisory, spoof, code execution
systems | linux, mandriva
advisories | CVE-2009-2408, CVE-2009-2409, CVE-2009-2404
MD5 | c28d20971a98b354e07b7174dc38b9da
Ubuntu Security Notice 810-1
Posted Aug 6, 2009
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice USN-810-1 - Moxie Marlinspike discovered that NSS did not properly handle regular expressions in certificate names. A remote attacker could create a specially crafted certificate to cause a denial of service (via application crash) or execute arbitrary code as the user invoking the program. Moxie Marlinspike and Dan Kaminsky independently discovered that NSS did not properly handle certificates with NULL characters in the certificate name. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. Dan Kaminsky discovered NSS would still accept certificates with MD2 hash signatures. As a result, an attacker could potentially create a malicious trusted certificate to impersonate another site.

tags | advisory, remote, denial of service, arbitrary
systems | linux, ubuntu
advisories | CVE-2009-2404, CVE-2009-2408, CVE-2009-2409
MD5 | 3e1a2e8101cfd4d6f5b7682efba09625
Page 1 of 1
Back1Next

File Archive:

June 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    10 Files
  • 2
    Jun 2nd
    16 Files
  • 3
    Jun 3rd
    15 Files
  • 4
    Jun 4th
    25 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    0 Files
  • 7
    Jun 7th
    0 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    0 Files
  • 11
    Jun 11th
    0 Files
  • 12
    Jun 12th
    0 Files
  • 13
    Jun 13th
    0 Files
  • 14
    Jun 14th
    0 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close