Next Page >>
PUBLIC KEY
2) Server generates per-session RSA keypair with e = 0x10001 and
random primes p and q.
3) Server sends client the HTML form, the jCryption JavaScript
code and the per-session RSA public key (e, n).
4) Client encrypts form data as follows:
checksum = checksum(plaintext);
ciphertext = RSA_encrypt(checksum || plaintext);
using modulus n, exponent e, deterministic checksum function
Aruba Networks Security Advisory
Title: Management User Authentication Bypass Vulnerability When Using
Public Key Based SSH Authentication.
Aruba Advisory ID: AID-42309
Revision: 1.0
For Public Release on 4/23/2009
OpenOffice is a opensource suite containing several programs to
handle Office documents like text documents or spreadsheets.
The latest version uses an XML based document format (ODF).
OpenOffice allows documents to be digitally signed by authors
using certified keys, allowing viewers to verify the integrity
and the origin based on the author's public key.
The author's public-key certificate, which can come from
a trusted third party, is embedded in the signed document.
II. Problem Description
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
CVE requests can be sent to cve@mitre.org or to me directly. My PGP
key is below, or accessible from the MIT public key server.
Alternately, you can request them from Candidate Numbering Authorities
(CNAs) which include the security teams at Red Hat, Microsoft, and
Debian, or third-party coordinators including iDefense and CERT/CC.
The amount of information you need to provide can vary and is somewhat
eBusiness CA-1
Validity
Not Before: Jul 31 00:00:01 2004 GMT
Not After : Sep 2 00:00:01 2004 GMT
Subject: CN=MD5 Collisions Inc. (http://www.phreedom.org/md5)
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (1024 bit)
Modulus (1024 bit):
00:ba:a6:59:c9:2c:28:d6:2a:b0:f8:ed:9f:46:a4:
a4:37:ee:0e:19:68:59:d1:b3:03:99:51:d6:16:9a:
*Report Timeline*
*2007-08-21*: Initial report to AOL Product Vulnerabilities Team (PVT)
requesting acknowledgement within 2 business days, advisory publication
date tentatively set to September 24th.
*2007-08-22*: Received an acknowledgement and PGP public key from AOL's
PVT. AOL's PVT indicates that upon reception of vulnerability details and
bug confirmation, expectations should be to allow for two business weeks
for an estimated timeline to resolution. Core's PGP/GPG key requested.
*2007-08-23*: Draft advisory and GPG public key sent to AOL's PVT.
*2007-08-31*: Acknowledgement from AOL confirming the existence of the
SUMMARY
=======
The MIT Kerberos 5 Key Distribution Center (KDC) daemon is vulnerable
to a double-free condition if the Public Key Cryptography for Initial
Authentication (PKINIT) capability is enabled, resulting in daemon
crash or arbitrary code execution (which is believed to be difficult).
IMPACT
======
3) (e*d) mod t = 1 mod t
4) a^e mod m = b
5) b^d mod m = a
e = public key
d = private key
RSA strength
*Report Timeline*
*2007-08-21*: Initial report to AOL Product Vulnerabilities Team (PVT)
requesting acknowledgement within 2 business days, advisory publication
date tentatively set to September 24th.
*2007-08-22*: Received an acknowledgement and PGP public key from AOL's
PVT. AOL's PVT indicates that upon reception of vulnerability details and
bug confirmation, expectations should be to allow for two business weeks
for an estimated timeline to resolution. Core's PGP/GPG key requested.
*2007-08-23*: Draft advisory and GPG public key sent to AOL's PVT.
*2007-08-31*: Acknowledgement from AOL confirming the existence of the
Details follow:
Cameron Meadors discovered that the MIT Kerberos 5 Key Distribution
Center (KDC) daemon is vulnerable to a double-free condition if
the Public Key Cryptography for Initial Authentication (PKINIT)
capability is enabled. This could allow a remote attacker to cause
a denial of service.
Updated packages for Ubuntu 9.10:
wj8DBQFH+eM+zuoR/xLtCioRAhKKAJ4nkA8EGap6fZ+xvRJSNpCDlcanwQCglsYb
p8LCGeXrEnMoshPDBVB4dOc=
=OZDe
-----END PGP SIGNATURE-----
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: PGP Desktop 9.7.1 (Build 1503)
mQGiBD6QuAoRBADBP14ij7t8YnnD0O1PMkWzsq/SXhui0UtBl4QSdPNvogdhKm3U
Vp4Pl6ABj7ROxVAabvqZPgY8qOsWIQEbcc9fqQtgMAKVWImKeC2o0fWnG4/7Ba7u
elOpXzFiVdF9aBKrlwwT4YF2rem9xPhuyxcFRPV4aDNH6VdnFK/0qQSKlwCg/2tt
quick response to me.
Secure email delivery:
======================
If you need something to say and want a secure communication, please
download my Public Key from the following URL:
http://advisory.sectester.net/chr1x_publickey.asc
Shouts:
======
Once upon a time Netscape thought it would be a great idea to add the keygen tag
(<keygen>) as a feature to their Browser. The keygen tag offers a simple way
of automatically generating key material using various algorithms. For instance
it is possible to generate RSA, DSA and EC key material.
"The public key and challenge string are DER encoded as PublicKeyAndChallenge and
then digitally signed with the private key to produce a SignedPublicKeyAndChallenge.
The SignedPublicKeyAndChallenge is base64 encoded, and the ASCII data is finally
submitted to the server as the value of a name-value pair, where the name is
specified by the NAME attribute of the KEYGEN tag."
Problem Description:
A vulnerability was discovered and corrected in krb5:
The MIT Kerberos 5 Key Distribution Center (KDC) daemon is vulnerable
to a double-free condition if the Public Key Cryptography for Initial
Authentication (PKINIT) capability is enabled, resulting in daemon
crash or arbitrary code execution (which is believed to be difficult)
(CVE-2011-0284).
The updated packages have been patched to correct this issue.
+ You want to speak!
- Please send the above information to
cfp2010 (at) recon.cx by 15 May, 2010
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.10 (Darwin)
mQENBEtqMN4BCADBIBOf6mK+H2QwfQYouyR5kkk5Imr3KmKzd/eGimX9srBeCauJ
vKb6K1ENxwSna58gwdW/UZ5oNauyDuin3JLYR0mDgxUo8s7cXwf0vltcR5LWDr49
cz3DC7rY2TPLDLO6PR6lNyFbtRE+UZ/OqwWrN9yNkyLfj+L2L4MDbscHsEA+Hlur
05/05/2009 - IBM first response
05/05/2009 - Autonomy POC request
05/05/2009 - IBM POC request
05/06/2009 - Autonomy clarification request
05/06/2009 - Symantec clarification request
05/06/2009 - Request public key from Autonomy
05/06/2009 - Sent POC to IBM, Symantec
05/06/2009 - Symantec requests resend
05/06/2009 - Resent POC to Symantec
05/06/2009 - Autonomy sends public key
05/06/2009 - Sent POC to Autonomy
cfp2012 (at) recon.cx
+ Recon registration opens March 5
- http://recon.cx
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.11 (Darwin)
mQENBE9K0KIBCAD0FeGl+KL9VrqHMU2SNh7MA5RlyJ4Tn4fM3JjEWJh2Hu2NoERs
gF+TrVvxIp8QXN9B9VibfZTY7OzQTZeEwb+u2MqjncIujmj/RIFICGIFNzpCN0mS
6YYnBt+6C2OF47ftyN2+azC3ulsrQJQmsOYVP/iEsB/iuEljB4zoDlg1/dazCS4y
Mitigating Factors
None that may be relied on.
Rsyncrypto does not broadcast the public key used to encrypt the file.
This makes an attacker's life harder, as she has to guess the key length
as well as the actual key. Be warned, however, that small files leak the
length of the key by nature of their size. Encrypting an empty file, for
example, will always result in a same size cypher text file. Also notice
that key lengths are rarely an arbitrary number. They are usually either
fixes in current (2007-12-09) gpg plugin snapshots.
Affected versions: 2.0, 2.0.1 and 2.1
Fix: http://www.topolis.lt/bugtraq/gpg_encrypt.php.diff.gz
2 issue - Unsanitized display of public keys
SquirrelMail GPG plugin does not sanitize imported public key
information. It allows attacker to inject custom html tags in
SquirrelMail message display.
Microsoft Office allows documents to be digitally signed by
authors using certified keys, allowing viewers to verify the
integrity and the origin based on the author's public key.
The author's public key certificate, which can come from a
trusted third party, is embedded in the signed document.
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2009.html
CVE-2009-0991 Listener vulnerability was discovered by me, and here is
attached PoC for it (Python code).
- --
My PGP public key: http://yurichev.com/dennis.yurichev.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkns7r4ACgkQ1YPmFmJG++NmCQCfUPIljnrwnXkGvBA7XtcjVyEx
> secure@pandasoftware.com to be forwarded to
> secure@pandasecurity.com, don't you think so?
Re: secure@pandasoftware.com & secure@pandasecurity.com, it's the
same contact mailbox at the Panda HQ domain in Spain (.es), not
Sweden (.se). Public key attached.
Regards,
- ----------------------------------------------
Pedro Bustamante
Zusatzinformation 4: e02f83123de2633d9cdeb87470e7443f
Application Crash-Log:
[2012.04.28 20:49:12] New connection received
[2012.04.28 20:49:12] Accepted connection from user AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
[2012.04.28 20:49:12] Sending public key to user AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
[2012.04.28 20:49:12] Connection to user AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA lost
Debug-Log:
ModLoad: 00400000 0059a000 C:/Programme/LAN Messenger/lmc.exe
ModLoad: 7c910000 7c9c9000 C:/WINDOWS/system32/ntdll.dll
Microsoft Office is a suite containing several programs to
handle Office documents like text documents or spreadsheets.
The latest version uses an XML based document format.
Microsoft Office allows documents to be digitally signed by
authors using certified keys, allowing viewers to verify the
integrity and the origin based on the author's public key.
The author's public key certificate, which can come from a
trusted third party, is embedded in the signed document.
It is XML DSig based.
Hello,
I have informed the responsible institutions 6 months ago before posting
this message on public key cryptography.
Below, I'm presenting an introduction to R-sequence theory, allowing more
accurate analysis of verification of groups of primes (and more) and
distribution of primes.
No direct algorithm is enclosed. Equivalence Conjecture might still be
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1252
Description:
Previous versions of the ntp package contain an ntpd daemon which,
in a non-default configuration (using public key cryptography for
ntp packet authentication), a remote attacker could cause the ntpd
daemon to crash (or, in rPath Linux 1, possibly execute remote code).
http://wiki.rpath.com/Advisories:rPSA-2009-0092
ftp://ftp.dlink.pl/dir/dir-600/driver_software/DIR-600_fw_revB_2-05B01_all_en_20101213.zip
- --
Greetings, Karol Celiński.
My GPG public key http://www.celin.pl/pub.asc
Pentester/Researcher @ Safe Computing
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEARECAAYFAk0J/Q8ACgkQ4hKaO1FYep3fiwCgkbYKz4+4ovTt2qkeSwzCT6Fm
----------------------------------------------------------------------
Jon Lewis | I route
Senior Network Engineer | therefore you are
Atlantic Net |
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________
_______________________________________________________________________
Vendor communication:
2008/11/10 Initial notification to Opera including n.runs RFP and
n.runs PGP public key
2008/11/12 Opera response and remarks to agree in general with
n.runs RFP but depending on the issue the timeline for a
fix might have to be longer than the one mentioned in
n.runs RFP (30 days)
2008/11/12 n.runs replies and outlines following a responsible
advantage today, and have the foundation for the emerging Web solutions
of tomorrow. Akamai is "The Trusted Choice for Online Business." For
more information, visit www.akamai.com.
Our GPG public key:
http://www.akamai.com/dl/akamai/Akamai_Security_General.pub
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (Darwin)
iQIcBAEBAgAGBQJISVLQAAoJEEngXEVbkoPOu3IQAJ4gOT9aCwG+f1ZJYLReUC8Y
Next Page>>
|
