CVE-2014-3566

In 1999, MITRE created the Common Vulnerabilities and Exposures (CVE) database as a way to standardize the naming of disclosed vulnerabilities. Seventeen years later, the CVE system is faced with bottlenecks and coverage gaps, as thousands of vulnerabilities go without CVE-ID assignments. These gaps are leaving business leaders and security teams exposed to vulnerabilities their […]

Microsoft now allows Internet Explorer 11 users to disable fallback to SSL 3.0 in an effort to protect them against attacks leveraging the recently disclosed vulnerability known as Padding Oracle On Downgraded Legacy Encryption (POODLE).

Communications encrypted with the transport layer security (TLS) protocol are also vulnerable to Padding Oracle On Downgraded Legacy Encryption (POODLE) attacks, researchers said on Monday.

With the release of the stable version of Chrome 39, Google has made several changes to improve stability and performance and has addressed numerous vulnerabilities.

It appears that 2014 will be remembered in the IT industry for several severe and wide-reaching server-side vulnerabilities. In April, a serious flaw ( CVE-2014-0160 ) in the widely-used OpenSSL encryption software that protects website traffic shook the industry (a.k.a. Heartbleed), leaving hundreds of thousands of systems open to attacks from cybercriminals. More than six months later, thousands of websites and devices still remain vulnerable . In September, multiple critical vulnerabilities ( CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277 and CVE 2014-6278 ) were reported in the GNU Bourne-Again Shell (Bash), the common command-line shell used in many Linux / UNIX operating systems and Apple’s Mac OS X. The flaws could allow an attacker to remotely execute shell commands by attaching malicious code in environment variables used by the operating system. Similar to Heartbleed, these flaws affect a broad range of systems, including but not limited to Apache…

Google has released a new network traffic security testing tool that can be used to check if devices and applications are impacted by Transport Layer Security/ Secure Sockets Layer (TLS/SSL) vulnerabilities and if the cryptographic protocols are configured correctly.

Google has decided to make some changes in its Chrome Web browser in order to ensure that users are protected against POODLE attacks.

Cisco has been analyzing its products to determine which of them are affected by the recently disclosed Secure Sockets Layer (SSL) version 3 protocol flaw dubbed Padding Oracle On Downgraded Legacy Encryption ( POODLE ).

Security updates released by Apple last week address a series of vulnerabilities, including the recently uncovered SSL 3.0 flaw (CVE-2014-3566) that can be leveraged to obtain potentially sensitive information from encrypted communications.

1999 was a pretty interesting year for the Internet and security. To jog your memory, here are just a few of the major events from the ultimate (or penultimate, depending on your point of view) year of the last millennium. The Melissa Virus was infecting millions of hosts using malicious e-mails. Both Napster and MySpace

Researchers have disclosed a design flaw ( CVE-2014-3566) in SSL 3.0 which lets attackers extract session cookies and other secrets from encrypted online communications.

There is a critical security vulnerability in SSL 3.0 which allows attackers to calculate the plaintext of encrypted connections, and it will likely spell the end of the use of this particular SSL version. The vulnerability (CVE-2014-3566), discovered by Google security researchers and dubbed POODLE (Padding Oracle On Downgraded Legacy Encryption), is in the design of the protocol. The researchers explained in great technical detail why the flaw exists and how it can be exploited, … More →