GLSA-200912-01 : OpenSSL: Multiple vulnerabilities

This script is Copyright (C) 2009-2014 Tenable Network Security, Inc.


Synopsis :

The remote Gentoo host is missing one or more security-related
patches.

Description :

The remote host is affected by the vulnerability described in GLSA-200912-01
(OpenSSL: Multiple vulnerabilities)

Multiple vulnerabilities have been reported in OpenSSL:
Marsh Ray of PhoneFactor and Martin Rex of SAP independently
reported that the TLS protocol does not properly handle session
renegotiation requests (CVE-2009-3555).
The MD2 hash algorithm is no longer considered to be
cryptographically strong, as demonstrated by Dan Kaminsky. Certificates
using this algorithm are no longer accepted (CVE-2009-2409).
Daniel Mentz and Robin Seggelmann reported the following
vulnerabilities related to DTLS: A use-after-free flaw (CVE-2009-1379)
and a NULL pointer dereference (CVE-2009-1387) in the
dtls1_retrieve_buffered_fragment() function in src/d1_both.c, multiple
memory leaks in the dtls1_process_out_of_seq_message() function in
src/d1_both.c (CVE-2009-1378), and a processing error related to a
large amount of DTLS records with a future epoch in the
dtls1_buffer_record() function in ssl/d1_pkt.c
(CVE-2009-1377).

Impact :

A remote unauthenticated attacker, acting as a Man in the Middle, could
inject arbitrary plain text into a TLS session, possibly leading to the
ability to send requests as if authenticated as the victim. A remote
attacker could furthermore send specially crafted DTLS packages to a
service using OpenSSL for DTLS support, possibly resulting in a Denial
of Service. Also, a remote attacker might be able to create rogue
certificates, facilitated by a MD2 collision. NOTE: The amount of
computation needed for this attack is still very large.

Workaround :

There is no known workaround at this time.

See also :

http://www.gentoo.org/security/en/glsa/glsa-200912-01.xml

Solution :

All OpenSSL users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose '>=dev-libs/openssl-0.9.8l-r2'

Risk factor :

Medium / CVSS Base Score : 5.8
(CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P)
CVSS Temporal Score : 5.0
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : true

Family: Gentoo Local Security Checks

Nessus Plugin ID: 42968 (gentoo_GLSA-200912-01.nasl)

Bugtraq ID: 35001
35138
36935

CVE ID: CVE-2009-1377
CVE-2009-1378
CVE-2009-1379
CVE-2009-1387
CVE-2009-2409
CVE-2009-3555