Handler on Duty: Johannes Ullrich
Threat Level: green
Loading...
|
|
Submitted By | Date |
---|---|
Comment | |
Sunny Dhbahai | 2013-03-05 13:43:50 |
Redis Server Port which client can run queries. Default Port Exposed to Internet Could Face Brute Force Attacks. Nmap Brute Force Script For Radis: http://nmap.org/nsedoc/scripts/redis-brute.html | |
Alexander Dupuy | 2010-11-23 14:17:15 |
UDP/443 is typically Skype traffic. From http://download.skype.com/share/business/guides/skype-it-administrators-guide.pdf (p.10 section 2.1.2 Operations): "It also uses UDP 443 to test network connectivity." These network probes typically have 18 byte payloads from the client (dst port UDP/443) and 26 byte payloads from the server (src port UDP/443) |
CVE # | Description |
---|---|
CVE-2014-0160 | The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug. |
CVE-2014-0224 | OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability. |
CVE-2014-6321 | |
CVE-2016-8610 | A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. |