Announces Update For OpenSSL Vulnerability

The OpenSSL developers have updated announced that will fix a vulnerability in versions 1.0.2d and 1.0.1p software. Versions 1.0.0 or 0.9.8 are not vulnerable. The leak is classified as "high", which is the highest level for vulnerabilities that uses OpenSSL.

This relates to vulnerabilities allowing attackers to cause a denial of service, a large amount of server memory may leak or an attacker could execute arbitrary code remotely. What exactly will the announced update remedy has not been disclosed.OpenSSL is one of the most widely used software for encrypting Internet connections, for example between websites and their visitors. Last April the Heart Bleed very serious bug was discovered in OpenSSL, allowing attackers memory information from Web servers to steal, such as passwords. The update is available from Thursday, July 9th.

Password Manager Uses Fake Passwords As Security

Password Managers are a convenient way for users to use different passwords for various websites without which to remember, but one of the biggest problems is the master password that they use. An attacker who steal the password safe with passwords collected knows can then try to crack the master password.

In the case to trace the attacker knows the master password, he can access all stored passwords. Researchers from the University of Wisconsin, Stanford University and Cornell Tech have therefore devised a clever password manager called NoCrack ( pdf ). "This is a new kind of password manager passwords with a master password to encrypt, but is resistant to offline brute-force decryption" says researcher Rahul Chatterjee .

According to the researcher dictionary attacks on stolen password vaults increasingly powerful. In addition, attackers would also be helped in that a large part of the Internet users still choose a simple and weak passwords, which simplifies the dictionary attacks. NoCrack provides protection against false by a login attempt with the wrong master password, but plausible passwords display.

"Unlike traditional password vaults will always decrypt the content and passwords always display that seem right," said Chatterjee. The researchers will present their findings next week at the Symposium on Security and Privacy present .Researcher Joseph Bonneau late in this research paper ( pdf ) that a prototype of NoCrack to the public will be made ​​available.

Important Security Update For OpenSSL Announced

The OpenSSL developers have an important security announced Thursday that appears and fixes multiple vulnerabilities. One of these vulnerabilities as "high" classified, which the highest level for vulnerabilities that uses OpenSSL.

It is about vulnerabilities allowing attackers to cause a denial of service, a large amount of server memory leak or an attacker could execute arbitrary code remotely. What exactly the announced update will remedy is not yet published. OpenSSL is one of the most widely used software for encrypting Internet connections, for example between websites and their visitors. Last April the very serious Heartbleed bug was discovered in OpenSSL, which attackers information from the memory of web servers could steal, such as passwords.

Mark Cox OpenSSL lets via Twitter that the critical vulnerability is only present in OpenSSL 1.0.2. The problems in the other versions of OpenSSL as "moderate" and "low" rated and therefore also have a much lower impact. OpenSSL 1.0.2 is a new version on January 22 appeared and packed with new features. On many systems, this particular version is installed is unknown.