This script is Copyright (C) 2009-2016 Tenable Network Security, Inc.
The remote Gentoo host is missing one or more security-related
The remote host is affected by the vulnerability described in GLSA-200912-01
(OpenSSL: Multiple vulnerabilities)
Multiple vulnerabilities have been reported in OpenSSL:
Marsh Ray of PhoneFactor and Martin Rex of SAP independently
reported that the TLS protocol does not properly handle session
renegotiation requests (CVE-2009-3555).
The MD2 hash algorithm is no longer considered to be
cryptographically strong, as demonstrated by Dan Kaminsky. Certificates
using this algorithm are no longer accepted (CVE-2009-2409).
Daniel Mentz and Robin Seggelmann reported the following
vulnerabilities related to DTLS: A use-after-free flaw (CVE-2009-1379)
and a NULL pointer dereference (CVE-2009-1387) in the
dtls1_retrieve_buffered_fragment() function in src/d1_both.c, multiple
memory leaks in the dtls1_process_out_of_seq_message() function in
src/d1_both.c (CVE-2009-1378), and a processing error related to a
large amount of DTLS records with a future epoch in the
dtls1_buffer_record() function in ssl/d1_pkt.c
A remote unauthenticated attacker, acting as a Man in the Middle, could
inject arbitrary plain text into a TLS session, possibly leading to the
ability to send requests as if authenticated as the victim. A remote
attacker could furthermore send specially crafted DTLS packages to a
service using OpenSSL for DTLS support, possibly resulting in a Denial
of Service. Also, a remote attacker might be able to create rogue
certificates, facilitated by a MD2 collision. NOTE: The amount of
computation needed for this attack is still very large.
There is no known workaround at this time.
See also :
All OpenSSL users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose '>=dev-libs/openssl-0.9.8l-r2'
Risk factor :
Medium / CVSS Base Score : 5.8
CVSS Temporal Score : 5.0
Public Exploit Available : false
Family: Gentoo Local Security Checks
Nessus Plugin ID: 42968 (gentoo_GLSA-200912-01.nasl)
Bugtraq ID: 35001351383541736935
CVE ID: CVE-2009-1377CVE-2009-1378CVE-2009-1379CVE-2009-1387CVE-2009-2409CVE-2009-3555
The cookie settings on this website are set to 'allow all cookies' to give you the very best website experience. If you continue without changing these settings, you consent to this - but if you want, you can opt out of all cookies by clicking below.