jetlib.sec » Tags » padding

Feeds

133445 items (0 unread) in 27 feeds

• 1337day (was: Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

26 items tagged "padding"

Related tags: openssl [+], mandriva linux [+], mac check [+], mac [+], implementation [+], oracle [+], asp [+], linux security [+], invalid parameters [+], attack [+], vulnerability [+], tgz [+], proof of concept [+], poet [+], exploits [+], chotext [+], aspx [+], web applications [+], waisman [+], thai duong [+], thai [+], signature forgery [+], rizzo [+], read [+], pkcs [+], nicolas waisman [+], juliano [+], darknet [+], ExploitsVulnerabilities [+], net [+], microsoft [+], microsoft net framework [+], information disclosure vulnerability [+], framework [+]

• January 16, 2012
• 17:20

  Mandriva Linux Security Advisory 2012-007

   » ‎ Packet Storm Security Advisories
  Mandriva Linux Security Advisory 2012-007 - The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack. Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check. The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer. The Server Gated Cryptography implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors. The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service via crafted data from a TLS client. The updated packages have been patched to correct these issues.

  Tags:  padding openssl implementation mac mandriva-linux invalid-parameters mac-check  

• 17:20

  Mandriva Linux Security Advisory 2012-007

   » ‎ Packet Storm Security Recent Files
  Mandriva Linux Security Advisory 2012-007 - The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack. Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check. The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer. The Server Gated Cryptography implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors. The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service via crafted data from a TLS client. The updated packages have been patched to correct these issues.

  Tags:  padding openssl implementation mac mandriva-linux invalid-parameters mac-check  

• 17:20

  Mandriva Linux Security Advisory 2012-007

   » ‎ Packet Storm Security Misc. Files
  Mandriva Linux Security Advisory 2012-007 - The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack. Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check. The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer. The Server Gated Cryptography implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors. The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service via crafted data from a TLS client. The updated packages have been patched to correct these issues.

  Tags:  padding openssl implementation mac mandriva-linux invalid-parameters mac-check  

• 17:20

  Mandriva Linux Security Advisory 2012-006

   » ‎ Packet Storm Security Advisories
  Mandriva Linux Security Advisory 2012-006 - The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack. Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check. The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer. The Server Gated Cryptography implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors. The updated packages have been patched to correct these issues.

  Tags:  padding openssl implementation mac mandriva-linux mac-check linux-security  

• 17:20

  Mandriva Linux Security Advisory 2012-006

   » ‎ Packet Storm Security Recent Files
  Mandriva Linux Security Advisory 2012-006 - The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack. Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check. The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer. The Server Gated Cryptography implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors. The updated packages have been patched to correct these issues.

  Tags:  padding openssl implementation mac mandriva-linux mac-check linux-security  

• 17:20

  Mandriva Linux Security Advisory 2012-006

   » ‎ Packet Storm Security Misc. Files
  Mandriva Linux Security Advisory 2012-006 - The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack. Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check. The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer. The Server Gated Cryptography implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors. The updated packages have been patched to correct these issues.

  Tags:  padding openssl implementation mac mandriva-linux mac-check linux-security  

• December 23, 2010
• 21:25

  [Slides] Padding Oracle for the Masses

   » ‎ SecDocs
  Authors: Nicolas Waisman
  Tags: vulnerability ASP.NET
  Event: Ruxcon 2010
  Abstract: In September Juliano Rizzo and Thai Duong unveiled their latest masterpiece: A padding oracle attack on the crypto implementation of the ASP.net framework allowed them to download any file. Their original presentation did not fully unveil how to practically implement the attack. This hands-on presentation is the result of our notes and experience in developing a reliable exploit for the padding oracle attack against ASP.net. It takes you from a simple CAPTCHA crack to a fully optimized padding oracle attack against ASP.net that bypasses all typical workarounds.

  Tags:  padding asp oracle nicolas-waisman thai rizzo thai-duong waisman juliano  

• December 14, 2010
• 0:00

  Vuln: Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability

  Tags:  framework microsoft net information-disclosure-vulnerability microsoft-net-framework padding  

• October 20, 2010
• 0:00

  Vuln: Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability

  Tags:  framework microsoft net information-disclosure-vulnerability microsoft-net-framework padding  

• October 18, 2010
• 0:00

  Vuln: Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability

  Tags:  framework microsoft net information-disclosure-vulnerability microsoft-net-framework padding  

• October 17, 2010
• 17:01

  aspx_po_chotext_attack.rb.txt

   » ‎ Packet Storm Security Recent Files
  Microsoft ASPX padding Oracle proof of concept exploit.

  Tags:  aspx attack chotext proof-of-concept padding  

• 17:01

  aspx_po_chotext_attack.rb.txt

   » ‎ Packet Storm Security Exploits
  Microsoft ASPX padding Oracle proof of concept exploit.

  Tags:  aspx attack chotext proof-of-concept padding  

• 14:00

  [remote exploits] - MS10-070 ASP.NET Padding Oracle File Download

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [remote exploits] - MS10-070 ASP.NET Padding Oracle File Download

  Tags:  padding asp exploits oracle  

• October 06, 2010
• 14:00

  [remote exploits] - ASP.NET Padding Oracle Vulnerability (MS10-070)

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [remote exploits] - ASP.NET Padding Oracle Vulnerability (MS10-070)

  Tags:  padding asp net exploits vulnerability  

• 0:00

  Vuln: Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability

  Tags:  framework microsoft net information-disclosure-vulnerability microsoft-net-framework padding  

• October 04, 2010
• 0:00

  Vuln: Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability

  Tags:  framework microsoft net information-disclosure-vulnerability microsoft-net-framework padding  

• September 28, 2010
• 0:00

  Vuln: Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability

  Tags:  framework microsoft net information-disclosure-vulnerability microsoft-net-framework padding  

• September 27, 2010
• 0:00

  Vuln: Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability

  Tags:  framework microsoft net information-disclosure-vulnerability microsoft-net-framework padding  

• September 24, 2010
• 3:50

  Microsoft Warns Of ASP.Net Vulnerability In The Wild – Cryptographic Padding Attack

   » ‎ Darknet
  There seems to be a fairly serious attack being exploited in the wild that targets vulnerable ASP.Net web applications, so far there is a temporary fix but no official announcement on when a patch will be issued. The next scheduled patches should be pushed out on October 12th. If you had set up your server [...]
  
  Read the full post at darknet.org.uk

  
  

  

  Tags:  microsoft asp attack read darknet padding web-applications ExploitsVulnerabilities  

• 0:00

  Vuln: Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability

  Tags:  framework microsoft net information-disclosure-vulnerability microsoft-net-framework padding  

• September 21, 2010
• 0:00

  Vuln: Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability

  Tags:  framework microsoft net information-disclosure-vulnerability microsoft-net-framework padding  

• September 20, 2010
• 0:00

  Vuln: Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability

  Tags:  framework microsoft net information-disclosure-vulnerability microsoft-net-framework padding  

• September 18, 2010
• 0:00

  Vuln: Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability

  Tags:  framework microsoft net information-disclosure-vulnerability microsoft-net-framework padding  

• June 07, 2010
• 21:01

  poet-1.0.0-all.tgz

   » ‎ Packet Storm Security Tools
  Padding Oracle Exploit Tool (POET). This tool demonstrates a powerful side-channel attack known as the padding oracle attack.

  Tags:  padding oracle poet tgz  

• 21:00

  poet-1.0.0-all.tgz

   » ‎ Packet Storm Security Recent Files
  Padding Oracle Exploit Tool (POET). This tool demonstrates a powerful side-channel attack known as the padding oracle attack.

  Tags:  padding oracle poet tgz  

• February 12, 2010
• 0:00

  Vuln: OpenSSL PKCS Padding RSA Signature Forgery Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL PKCS Padding RSA Signature Forgery Vulnerability

  Tags:  padding pkcs openssl signature-forgery vulnerability