Apache mod_dav format string bug updated since 18.02.2003
Published:		19.02.2003
Source:		BUGTRAQ
SecurityVulns ID:		2600
Type:		remote
Level:		5/10
Description:		ap_log_rerror() format string bug.

Affected:

APACHE : mod_dav 1.0

Original document		APACHE, Re: CSSA-2003-007.0 Advisory withdrawn. (19.02.2003)
		CALDERA, Security Update: [CSSA-2003-007.0] Linux: Apache mod_dav module format string vulnerability (18.02.2003)

Discuss:

Read or add your comments to this news (0 comments)

Open SSL timing attack updated since 19.02.2003
Published:		22.03.2003
Source:		BUGTRAQ
SecurityVulns ID:		2604
Type:		remote
Level:		7/10
Description:		Because of timing difference it's possible to distinguish between bad padding and a MAC verification error. It's also possible to recover RSA secret.

Affected:		OPENSSL : OpenSSL 0.9
		STUNNEL : stunnel 3.22
		STUNNEL : stunnel 4.04

Original document		Brian Hatch, Stunnel: RSA timing attacks / key discovery (22.03.2003)
		Ben Laurie, [ADVISORY] Timing Attack on OpenSSL (18.03.2003)
		David Brumley, Vulnerability in OpenSSL (15.03.2003)
		Jonas Eriksson, OpenSSL 0.9.7a and 0.9.6i released (19.02.2003)

Files:		TLS timing attack on OpenSSL [can-2003-78] [bid 6884] exploit
		OpenSSL timing attacks
Discuss:		Read or add your comments to this news (0 comments)