exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 25 of 100 RSS Feed

Files

crypto-gram-0102.txt
Posted Feb 16, 2001
Authored by Bruce Schneier, crypto-gram | Site counterpane.com

Crypto-gram for February 15, 2001. In this issue: Hard-Drive-Embedded Copy Protection, An Intentional Backdoor, The Doghouse: NASA and eTrue, A Semantic Attack on URLs, E-mail Filter Idiocy, Air Gaps, and Internet Voting vs. Large-Value e-Commerce.

tags | crypto, magazine
SHA-256 | b0b49966a2d150c0a44f721540654f4d81304aea8b42eaa28021ffddd0f33b1f

Related Files

Entropy Broker RNG 1.0.1
Posted Aug 14, 2012
Authored by Folkert van Heusden | Site vanheusden.com

Entropy Broker is an infrastructure for distributing cryptographically secure random numbers (entropy data) from one or more servers to one or more clients. Entropy Broker allows you to distribute entropy data (random values) to /dev/random devices from other systems (real servers or virtualised systems). It helps preventing that the /dev/random device gets depleted; an empty /dev/random-device can cause programs to hang (waiting for entropy data to become available). This is useful for systems that need to generate encryption keys, run VPN software or run a casino website.

Changes: This is an important bugfix release. This version replaces the ivec initializer code with something more sensible.
tags | encryption
systems | linux
SHA-256 | e505291a3ada9f1ba3928113fa70f9f79bfc771b2fe8e20560d612d5c64beb5b
Entropy Broker RNG 1.0
Posted Aug 7, 2012
Authored by Folkert van Heusden | Site vanheusden.com

Entropy Broker is an infrastructure for distributing cryptographically secure random numbers (entropy data) from one or more servers to one or more clients. Entropy Broker allows you to distribute entropy data (random values) to /dev/random devices from other systems (real servers or virtualised systems). It helps preventing that the /dev/random device gets depleted; an empty /dev/random-device can cause programs to hang (waiting for entropy data to become available). This is useful for systems that need to generate encryption keys, run VPN software or run a casino website.

Changes: EGD client now fully implements the EGD protocol. A network protocol fix was implemented.
tags | encryption
systems | linux
SHA-256 | 76ca25d4f7c84938b67595662b7b2a2ccc1f026c5fd38878da67d399c829206c
Spark IM Stored Static Crypto Key
Posted Jul 31, 2012
Authored by Adam Caudill

Spark IM client version 2.6.3 suffers from a cryptography failure where the key for encrypting the passwords is stored statically in Encryptor.java. Tool included that will recover usernames and passwords.

tags | exploit, java, info disclosure
systems | linux
SHA-256 | 9782253ae9795fa6cba9d6a8e3b03d59608adabe717e35b82a175473cd0bfd36
Mandriva Linux Security Advisory 2012-117
Posted Jul 28, 2012
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2012-117 - PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key. The updated packages have been patched to correct this issue.

tags | advisory
systems | linux, mandriva
advisories | CVE-2012-2417
SHA-256 | a257bef09bc054b9c2ddf00af72cb709c6daf86ed9863e285ba7b71a0ed7c536
Entropy Broker RNG 0.9
Posted Jul 26, 2012
Authored by Folkert van Heusden | Site vanheusden.com

Entropy Broker is an infrastructure for distributing cryptographically secure random numbers (entropy data) from one or more servers to one or more clients. Entropy Broker allows you to distribute entropy data (random values) to /dev/random devices from other systems (real servers or virtualised systems). It helps preventing that the /dev/random device gets depleted; an empty /dev/random-device can cause programs to hang (waiting for entropy data to become available). This is useful for systems that need to generate encryption keys, run VPN software or run a casino website.

Changes: video4linux server is now compatible with video4linux2. It will now dump and restore the pool-contents.
tags | tool, encryption
systems | linux
SHA-256 | 1256b9eabb591bfe6735cfcd5b31fafece6cca0028f6df1894bd805070ba6d45
Botan C++ Crypto Algorithms Library 1.10.3
Posted Jul 26, 2012
Site botan.randombit.net

Botan is a C++ library of cryptographic algorithms, including AES, DES, SHA-1, RSA, DSA, Diffie-Hellman, and many others. It also supports X.509 certificates and CRLs, and PKCS #10 certificate requests, and has a high level filter/pipe message processing system. The library is easily portable to most systems and compilers, and includes a substantial tutorial and API reference.

Changes: Several bugs in the TLS implementation related to session renegotiation have been fixed. The SRP password-based key agreement scheme and the Camellia block cipher have been added. Support for the Ivy Bridge hardware random number generator has also been added. Various minor bugs affecting OpenBSD and MinGW users have been fixed.
tags | library
systems | linux
SHA-256 | b76fc3118d8fe93230f8544a6507609fe103e65bd131ddd246af1ee88c30a1ab
MultiObfuscator 2.00
Posted Jul 13, 2012
Authored by Cosimo Oliboni | Site embeddedsw.net

MultiObfuscator is a professional cryptography tool that offers double encryption, csprng based scrambling, csprng based whitening, and more. Documentation provided.

Changes: Various updates.
tags | tool, encryption
SHA-256 | f7fb28d42040f25c6a5ec261633f0c897d3b6c465fb6c7f5b13676b342117f5c
Secunia Security Advisory 49768
Posted Jul 5, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - SUSE has issued an update for python-crypto. This fixes a weakness, which can be exploited by malicious people to conduct brute force attacks.

tags | advisory, crypto, python
systems | linux, suse
SHA-256 | f4130749b8c631dae273b117f941bcbfab35aa62db0ea73f8d609cff0374a530
strongSwan IPsec Implementation 5.0.0
Posted Jul 3, 2012
Authored by Andreas Steffen | Site strongswan.org

strongSwan is a complete IPsec implementation for the Linux, Android, Maemo, FreeBSD, and Mac OS X operating systems. It interoperates with with most other IPsec-based VPN products via the IKEv2 or IKEv1 key exchange protocols. The focus of the strongSwan project is on strong authentication mechanisms using X.509 public key certificates and optional secure storage of private keys on smartcards through a standardized PKCS#11 interface. A rich choice of modular plugins adds additional features like Trusted Network Connect or advanced cryptographical algorithms.

Changes: The IKEv1 protocol was re-implemented from scratch by extending the successful IKEv2 code. The charon keying daemon now supports both protocols, which allowed the old IKEv1 pluto daemon to be removed. Support for the IKEv1 Aggressive and Hybrid Modes has been added.
tags | tool, encryption, protocol
systems | linux, freebsd, apple, osx
SHA-256 | 1a7ed98015df32e7412caf37391105af25a9dc66a0e357a1c92ccd5a9f180298
Secunia Security Advisory 49760
Posted Jun 29, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - Ubuntu has issued an update for python-crypto. This fixes a weakness, which can be exploited by malicious people to conduct brute force attacks.

tags | advisory, crypto, python
systems | linux, ubuntu
SHA-256 | bc029fce5673bf2054a75e646770f76352b50f52789172738c802ace6abce190
Ubuntu Security Notice USN-1484-1
Posted Jun 29, 2012
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1484-1 - It was discovered that PyCrypto produced inappropriate prime numbers when generating ElGamal keys. An attacker could use this flaw to facilitate brute-forcing of ElGamal encryption keys.

tags | advisory
systems | linux, ubuntu
advisories | CVE-2012-2417
SHA-256 | 04fbced1a91721f7ab5f380ac1b24b6b95bb3cc42c528814abcc82b70cc1f2dd
Mod_auth_pubtkt 0.8
Posted Jun 28, 2012
Site neon1.net

mod_auth_pubtkt is a simple Web single sign-on (SSO) solution for Apache. It validates authentication tickets provided by the client in a cookie using public-key cryptography (DSA or RSA). Thus, only the login server that generates the tickets needs to possess the private key, while Web servers can verify tickets given only the public key. The implementation of the login server is left to the user, but an example and a library in PHP are provided with the distribution.

Changes: A new option and corresponding field in the ticket ("bauth") make it possible to specify the Basic authorization username/password in the ticket (e.g., when reverse proxying to a third party system which cannot use mod_auth_pubtkt). The credentials can optionally be encrypted in the ticket.
tags | web, php
systems | unix
SHA-256 | 6243e220a650147a49269970cfc1491e6c727f6e9ef4eb34673909783bc258b2
Efficient Padding Oracle Attacks On Cryptographic Hardware
Posted Jun 27, 2012
Authored by Riccardo Focardi, Graham Steel, Joe-Kai Tsay, Lorenzo Simionato, Yusuke Kawamoto, Romain Bardou

This paper demonstrates how to exploit the encrypted key import functions of a variety of different cryptographic devices to reveal the imported key. The attacks are padding oracle attacks, where error messages resulting from incorrectly padded plaintexts are used as a side channel. This is the paper that made headlines regarding RSA tokens being cracked in 13 minutes.

tags | paper
SHA-256 | 2f956e99861dabc4d9e263529db1992adcbe71b48930cc4158b998b604dc42b0
Red Hat Security Advisory 2012-1037-01
Posted Jun 25, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-1037-01 - PostgreSQL is an advanced object-relational database management system. A flaw was found in the way the crypt() password hashing function from the optional PostgreSQL pgcrypto contrib module performed password transformation when used with the DES algorithm. If the password string to be hashed contained the 0x80 byte value, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. This made brute-force guessing more efficient as the whole password was not required to gain access to protected resources.

tags | advisory
systems | linux, redhat
advisories | CVE-2012-2143, CVE-2012-2655
SHA-256 | 43dd84d900e99c3f1b88175c8d6cb0d767071c6eb772b1ec31adf8ed1f003585
Red Hat Security Advisory 2012-1036-01
Posted Jun 25, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-1036-01 - PostgreSQL is an advanced object-relational database management system. A flaw was found in the way the crypt() password hashing function from the optional PostgreSQL pgcrypto contrib module performed password transformation when used with the DES algorithm. If the password string to be hashed contained the 0x80 byte value, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. This made brute-force guessing more efficient as the whole password was not required to gain access to protected resources.

tags | advisory
systems | linux, redhat
advisories | CVE-2012-2143
SHA-256 | 91db521987a8f25ecabb7834e60cc56577345d64eb97ff886fb0176153721100
Secunia Security Advisory 49703
Posted Jun 25, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - Gentoo has issued an update for pycrypto. This fixes a weakness, which can be exploited by malicious people to conduct brute force attacks.

tags | advisory
systems | linux, gentoo
SHA-256 | dc80a711afd55aafd17392796551661a3994f9eb6a158c8fb0274f68b5cf4ed5
Secunia Security Advisory 49559
Posted Jun 25, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - Debian has issued an update for python-crypto. This fixes a weakness, which can be exploited by malicious people to conduct brute force attacks.

tags | advisory, crypto, python
systems | linux, debian
SHA-256 | 1da34bccbc972e9e82edbd3e546f7e6ed908bd526a4ef4849070525b4e3c5e6a
Gentoo Linux Security Advisory 201206-23
Posted Jun 24, 2012
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201206-23 - PyCrypto generates weak ElGamal keys. Versions less than 2.6 are affected.

tags | advisory
systems | linux, gentoo
advisories | CVE-2012-2417
SHA-256 | 14546806126e183ad80b1ab1d5a94616b305357e865f36bf6b75eb0ea38f9a96
Debian Security Advisory 2502-1
Posted Jun 24, 2012
Authored by Debian | Site debian.org

Debian Linux Security Advisory 2502-1 - It was discovered that that the ElGamal code in PythonCrypto, a collection of cryptographic algorithms and protocols for Python used insecure insufficient prime numbers in key generation, which lead to a weakened signature or public key space, allowing easier brute force attacks on such keys.

tags | advisory, protocol, python
systems | linux, debian
advisories | CVE-2012-2417
SHA-256 | 6d4508421551948092f3a47c494a7261e2fff7ccbfc0297c1626d54727c95efa
Mandriva Linux Security Advisory 2012-092
Posted Jun 16, 2012
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2012-092 - Multiple vulnerabilities has been discovered and corrected in postgresql. Fix incorrect password transformation in contrib/pgcrypto's DES crypt() function (Solar Designer). If a password string contained the byte value 0x80, the remainder of the password was ignored, causing the password to be much weaker than it appeared. With this fix, the rest of the string is properly included in the DES hash. Any stored password values that are affected by this bug will thus no longer match, so the stored values may need to be updated. Ignore SECURITY DEFINER and SET attributes for a procedural language's call handler (Tom Lane). Applying such attributes to a call handler could crash the server. This advisory provides the latest versions of PostgreSQL that is not vulnerable to these issues.

tags | advisory, vulnerability
systems | linux, mandriva
advisories | CVE-2012-2143, CVE-2012-2655
SHA-256 | 1edfeb5c298d59aca21fc94dd3d94074bf90df118aaad1545a26a577513db22c
OpenSSL Toolkit 1.0.1c
Posted Jun 7, 2012
Site openssl.org

OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide.

Changes: Record length are now sanity checked before skipping explicit IV in TLS 1.2, 1.1, and DTLS, to avoid possible DoS attacks. A possible deadlock when decoding public keys has been fixed. The TLS 1.0 record version number is no longer used in the initial client hello if renegotiating. tkeylen in now initialized properly when encrypting CMS messages. In FIPS mode, composite ciphers are no longer used, as they are not approved.
tags | tool, encryption, protocol
systems | unix
advisories | CVE-2012-2333
SHA-256 | 2a9eb3cd4e8b114eb9179c0d3884d61658e7d8e8bf4984798a5f5bd48e325ebe
Mod_auth_pubtkt 0.7
Posted Jun 4, 2012
Site neon1.net

mod_auth_pubtkt is a simple Web single sign-on (SSO) solution for Apache. It validates authentication tickets provided by the client in a cookie using public-key cryptography (DSA or RSA). Thus, only the login server that generates the tickets needs to possess the private key, while Web servers can verify tickets given only the public key. The implementation of the login server is left to the user, but an example and a library in PHP are provided with the distribution.

Changes: The public key can be set per directory instead of only globally. The login URL is now optional, and a new TKTAuthBadIPURL option has been added. Furthermore, the module now compiles with Apache 2.4 and includes a Perl ticket generation module.
tags | web, php
systems | unix
SHA-256 | 8ff3de9c5acc026c6fd74fd8e599c0c2659cd29c51693dbf67a8bf8c609be94e
Red Hat Security Advisory 2012-0699-01
Posted May 29, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-0699-01 - OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. An integer underflow flaw, leading to a buffer over-read, was found in the way OpenSSL handled DTLS application data record lengths when using a block cipher in CBC mode. A malicious DTLS client or server could use this flaw to crash its DTLS connection peer.

tags | advisory, protocol
systems | linux, redhat
advisories | CVE-2012-2333
SHA-256 | c06ac1424785317703c7aa22ceb6c44b036fc510567d485d7bf8e44c5ffb7b08
Ubuntu Security Notice USN-1451-1
Posted May 25, 2012
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1451-1 - Ivan Nestlerode discovered that the Cryptographic Message Syntax (CMS) and PKCS #7 implementations in OpenSSL returned early if RSA decryption failed. This could allow an attacker to expose sensitive information via a Million Message Attack (MMA). It was discovered that an integer underflow was possible when using TLS 1.1, TLS 1.2, or DTLS with CBC encryption. This could allow a remote attacker to cause a denial of service. Various other issues were also addressed.

tags | advisory, remote, denial of service
systems | linux, ubuntu
advisories | CVE-2012-0884, CVE-2012-2333, CVE-2012-0884, CVE-2012-2333
SHA-256 | c2d728621ad0692803f2775f1741405360b7d473c41ea474fa8427075d3d957a
Secunia Security Advisory 49263
Posted May 25, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - A weakness has been reported in PyCrypto, which can be exploited by malicious people to conduct brute force attacks.

tags | advisory
SHA-256 | 5f2d792f0678900743f9df4aa9e9530a0e4003f8e23b1989f7e10265d0d39e33
Page 1 of 4
Back1234Next

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    13 Files
  • 10
    Aug 10th
    34 Files
  • 11
    Aug 11th
    16 Files
  • 12
    Aug 12th
    5 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    25 Files
  • 16
    Aug 16th
    3 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close