The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service (daemon crash) via crafted data from a TLS client.

The remote Solaris system is missing necessary patches to address security updates :

  - The DTLS implementation in OpenSSL before 0.9.8s and 1.x     before 1.0.0f performs a MAC check only if certain     padding is valid, which makes it easier for remote     attackers to recover plaintext via a padding oracle     attack. (CVE-2011-4108)

  - Double free vulnerability in OpenSSL 0.9.8 before     0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows     remote attackers to have an unspecified impact by     triggering failure of a policy check. (CVE-2011-4109)

  - The SSL 3.0 implementation in OpenSSL before 0.9.8s and     1.x before 1.0.0f does not properly initialize data     structures for block cipher padding, which might allow     remote attackers to obtain sensitive information by     decrypting the padding data sent by an SSL peer.
    (CVE-2011-4576)

  - OpenSSL before 0.9.8s and 1.x before 1.0.0f, when RFC     3779 support is enabled, allows remote attackers to     cause a denial of service (assertion failure) via an     X.509 certificate containing certificate-extension data     associated with (1) IP address blocks or (2) Autonomous     System (AS) identifiers. (CVE-2011-4577)

  - The Server Gated Cryptography (SGC) implementation in     OpenSSL before 0.9.8s and 1.x before 1.0.0f does not     properly handle handshake restarts, which allows remote     attackers to cause a denial of service (CPU consumption)     via unspecified vectors. (CVE-2011-4619)

  - The GOST ENGINE in OpenSSL before 1.0.0f does not     properly handle invalid parameters for the GOST block     cipher, which allows remote attackers to cause a denial     of service (daemon crash) via crafted data from a TLS     client. (CVE-2012-0027)

  - OpenSSL 0.9.8s and 1.0.0f does not properly support DTLS     applications, which allows remote attackers to cause a     denial of service (crash) via unspecified vectors     related to an out-of-bounds read. NOTE: this     vulnerability exists because of an incorrect fix for     CVE-2011-4108. (CVE-2012-0050)

Various security vulnerabilities have been fixed in openssl :

  - DTLS plaintext recovery attack (CVE-2011-4108)

  - uninitialized SSL 3.0 padding (CVE-2011-4576)

  - malformed RFC 3779 data can cause assertion failures     (CVE-2011-4577)

  - SGC restart DoS attack (CVE-2011-4619)

  - invalid GOST parameters DoS attack (CVE-2012-0027)

Various security vulnerabilities have been fixed in openssl :

  - DTLS plaintext recovery attack (CVE-2011-4108)

  - uninitialized SSL 3.0 padding (CVE-2011-4576)

  - malformed RFC 3779 data can cause assertion failures     (CVE-2011-4577) 

  - SGC restart DoS attack (CVE-2011-4619)

  - invalid GOST parameters DoS attack (CVE-2012-0027)

openssl was updated to 1.0.0k security release to fix bugs and security issues. (bnc#802648 bnc#802746) The version was upgraded to avoid backporting the large fixes for SSL, TLS and DTLS Plaintext Recovery Attack (CVE-2013-0169) TLS 1.1 and 1.2 AES-NI crash (CVE-2012-2686) OCSP invalid key DoS issue (CVE-2013-0166)

Also the following bugfix was included: bnc#757773 - c_rehash to accept more filename extensions

openssl was prone to several security issues :

  - DTLS Plaintext Recovery Attack (CVE-2011-4108)

  - Uninitialized SSL 3.0 Padding (CVE-2011-4576)

  - Malformed RFC 3779 Data Can Cause Assertion Failures     (CVE-2011-4577)

  - SGC Restart DoS Attack (CVE-2011-4619)

  - Invalid GOST parameters DoS Attack (CVE-2012-0027)

Multiple vulnerabilities has been found and corrected in openssl :

The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack (CVE-2011-4108).

Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check (CVE-2011-4109).

The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer (CVE-2011-4576).

The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors (CVE-2011-4619).

The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service (daemon crash) via crafted data from a TLS client (CVE-2012-0027).

The updated packages have been patched to correct these issues.

According to the web server's banner, the version of HP System Management Homepage (SMH) hosted on the remote host is earlier than 7.1.1 and is, therefore, reportedly affected by the following vulnerabilities :

  - The bundled version of the libxml2 library contains     multiple vulnerabilities. (CVE-2011-1944, CVE-2011-2821,     CVE-2011-2834)

  - The bundled version of PHP contains multiple     vulnerabilities. (CVE-2011-3379, CVE-2011-4153,     CVE-2011-4885, CVE-2012-1823, CVE-2012-0057,     CVE-2012-0830)

  - The bundled version of the Apache HTTP Server contains     multiple vulnerabilities. (CVE-2011-3607, CVE-2011-4317,     CVE-2011-4415, CVE-2012-0021, CVE-2012-0031,     CVE-2012-0053)

  - An issue exists in the 'include/iniset.php' script in     the embedded RoundCube Webmail version that could lead     to a denial of service. (CVE-2011-4078)

  - The bundled version of OpenSSL contains multiple     vulnerabilities. (CVE-2011-4108, CVE-2011-4576,     CVE-2011-4577, CVE-2011-4619, CVE-2012-0027,     CVE-2012-1165)

  - The bundled version of curl and libcurl does not     properly consider special characters during extraction     of a pathname from a URL. (CVE-2012-0036)     
  - An off autocomplete attribute does not exist for     unspecified form fields, which makes it easier for     remote attackers to obtain access by leveraging an     unattended workstation. (CVE-2012-2012)

  - An unspecified vulnerability exists that could allow a     remote attacker to cause a denial of service, or     possibly obtain sensitive information or modify data.
    (CVE-2012-2013)

  - An unspecified vulnerability exists related to improper     input validation. (CVE-2012-2014)

  - An unspecified vulnerability allows remote,     unauthenticated users to gain privileges and obtain     sensitive information. (CVE-2012-2015)

  - An unspecified vulnerability allows local users to     obtain sensitive information via unknown vectors.
    (CVE-2012-2016)

The remote host is affected by the vulnerability described in GLSA-201203-12 (OpenSSL: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in OpenSSL:
      Timing differences for decryption are exposed by CBC mode encryption         in OpenSSL&rsquo;s implementation of DTLS (CVE-2011-4108).
      A policy check failure can result in a double-free error when         X509_V_FLAG_POLICY_CHECK is set (CVE-2011-4109).
      Clients and servers using SSL 3.0 handshakes do not clear the block         cipher padding, allowing a record to contain up to 15 bytes of         uninitialized memory, which could include sensitive information         (CVE-2011-4576).
      Assertion errors can occur during the handling of malformed X.509         certificates when OpenSSL is built with RFC 3779 support         (CVE-2011-4577).
      A resource management error can occur when OpenSSL&rsquo;s server gated         cryptography (SGC) does not properly handle handshake restarts         (CVE-2011-4619).
      Invalid parameters in the GOST block cipher are not properly handled         by the GOST ENGINE(CVE-2012-0027).
      An incorrect fix for CVE-2011-4108 creates an unspecified         vulnerability for DTLS applications using OpenSSL (CVE-2012-0050).
  Impact :

    A remote attacker may be able to cause a Denial of Service or obtain       sensitive information, including plaintext passwords.
  Workaround :

    There is no known workaround at this time.

It was discovered that the elliptic curve cryptography (ECC) subsystem in OpenSSL, when using the Elliptic Curve Digital Signature Algorithm (ECDSA) for the ECDHE_ECDSA cipher suite, did not properly implement curves over binary fields. This could allow an attacker to determine private keys via a timing attack. This issue only affected Ubuntu 8.04 LTS, Ubuntu 10.04 LTS, Ubuntu 10.10 and Ubuntu 11.04. (CVE-2011-1945)

Adam Langley discovered that the ephemeral Elliptic Curve Diffie-Hellman (ECDH) functionality in OpenSSL did not ensure thread safety while processing handshake messages from clients. This could allow a remote attacker to cause a denial of service via out-of-order messages that violate the TLS protocol. This issue only affected Ubuntu 8.04 LTS, Ubuntu 10.04 LTS, Ubuntu 10.10 and Ubuntu 11.04.
(CVE-2011-3210)

Nadhem Alfardan and Kenny Paterson discovered that the Datagram Transport Layer Security (DTLS) implementation in OpenSSL performed a MAC check only if certain padding is valid. This could allow a remote attacker to recover plaintext. (CVE-2011-4108)

Antonio Martin discovered that a flaw existed in the fix to address CVE-2011-4108, the DTLS MAC check failure. This could allow a remote attacker to cause a denial of service. (CVE-2012-0050)

Ben Laurie discovered a double free vulnerability in OpenSSL that could be triggered when the X509_V_FLAG_POLICY_CHECK flag is enabled.
This could allow a remote attacker to cause a denial of service. This issue only affected Ubuntu 8.04 LTS, Ubuntu 10.04 LTS, Ubuntu 10.10 and Ubuntu 11.04. (CVE-2011-4109)

It was discovered that OpenSSL, in certain circumstances involving ECDH or ECDHE cipher suites, used an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves. This could allow a remote attacker to obtain the private key of a TLS server via multiple handshake attempts. This issue only affected Ubuntu 8.04 LTS. (CVE-2011-4354)

Adam Langley discovered that the SSL 3.0 implementation in OpenSSL did not properly initialize data structures for block cipher padding. This could allow a remote attacker to obtain sensitive information.
(CVE-2011-4576)

Andrew Chi discovered that OpenSSL, when RFC 3779 support is enabled, could trigger an assert when handling an X.509 certificate containing certificate-extension data associated with IP address blocks or Autonomous System (AS) identifiers. This could allow a remote attacker to cause a denial of service. (CVE-2011-4577)

Adam Langley discovered that the Server Gated Cryptography (SGC) implementation in OpenSSL did not properly handle handshake restarts.
This could allow a remote attacker to cause a denial of service.
(CVE-2011-4619)

Andrey Kulikov discovered that the GOST block cipher engine in OpenSSL did not properly handle invalid parameters. This could allow a remote attacker to cause a denial of service via crafted data from a TLS client. This issue only affected Ubuntu 11.10. (CVE-2012-0027).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The OpenSSL Team reports :

6 security flaws have been fixed in OpenSSL 1.0.0f :

If X509_V_FLAG_POLICY_CHECK is set in OpenSSL 0.9.8, then a policy check failure can lead to a double-free.

OpenSSL prior to 1.0.0f and 0.9.8s failed to clear the bytes used as block cipher padding in SSL 3.0 records. As a result, in each record, up to 15 bytes of uninitialized memory may be sent, encrypted, to the SSL peer. This could include sensitive contents of previously freed memory.

RFC 3779 data can be included in certificates, and if it is malformed, may trigger an assertion failure. This could be used in a denial-of-service attack.

Support for handshake restarts for server gated cryptograpy (SGC) can be used in a denial-of-service attack.

A malicious TLS client can send an invalid set of GOST parameters which will cause the server to crash due to lack of error checking.
This could be used in a denial-of-service attack.

According to its banner, the remote web server is running a version of OpenSSL 1.x that is earlier than 1.0.0f. Such versions are affected by the following vulnerabilities :

  - The Datagram Transport Layer Security (DTLS)     implementation is vulnerable to plaintext recovery     attacks when decrypting in CBC mode. (CVE-2011-4108)

  - An error exists related to SSLv3.0 records that can     lead to disclosure of uninitialized memory because the     library does not clear all bytes used as block cipher     padding. (CVE-2011-4576)

  - An error exists related to RFC 3779 processing that can     allow denial of service attacks. Note that this     functionality is not enabled by default and must be     configured at compile time via the 'enable-rfc3779'     option. (CVE-2011-4577)

  - An error exists related to handshake restarts for     server gated cryptography (SGC) that can allow denial     of service attacks. (CVE-2011-4619)

  - An error exists in the GOST implementation that can     allow invalid GOST parameters to crash the server.
    (CVE-2012-0027)

Versions of OpenSSL 0.9.8 earlier than 0.9.8s, and 1.0.0 earlier than 1.0.0f are potentially affected by the following vulnerabilities :

  - An extension of the Vaudenay padding oracle attack exists against CBC mode encryption which enables an efficient plaintext recovery attack against the OpenSSL implementation of DTLS. (CVE-2011-4108)

  - If x509_V_FLAG_POLICY_CHECK is set in OpenSSL 0.9.8, then a policy check failure can lead to a double-free. (CVE-2011-4109)

  - OpenSSL fails to clear the bytes used as block cipher padding in SSL 3.0 records.  As a result, in each record, up to 15 bytes of uninitialized memory may be sent, encrypted, to the SSL peer. (CVE-2011-4576)

  - RFC 3779 data can be included in certificates, and if it is malformed, may trigger an assertion failure.  This could be used in a denial-of-service attack. (CVE-2011-4577)

  - Support for handshake restarts for server gated cryptography (SGC) can be used in a denial-of-service attack. (CVE-2011-4619)

  - A malicious TLS client can send an invalid set of GOST parameters which will cause the server to crash due to a lack of error checking. (CVE-2012-0027)

ID	Name	Product	Family	Severity
80715	Oracle Solaris Third-Party Patch Update : openssl (cve_2012_0050_denial_of)	Nessus	Solaris Local Security Checks	high
75908	openSUSE Security Update : libopenssl-devel (openSUSE-SU-2012:0083-1)	Nessus	SuSE Local Security Checks	medium
75598	openSUSE Security Update : libopenssl-devel (openSUSE-SU-2012:0083-1)	Nessus	SuSE Local Security Checks	medium
74901	openSUSE Security Update : openssl (openSUSE-SU-2013:0336-1)	Nessus	SuSE Local Security Checks	high
74722	openSUSE Security Update : openssl (openSUSE-2012-52)	Nessus	SuSE Local Security Checks	medium
61942	Mandriva Linux Security Advisory : openssl (MDVSA-2012:007)	Nessus	Mandriva Local Security Checks	high
59851	HP System Management Homepage < 7.1.1 Multiple Vulnerabilities	Nessus	Web Servers	critical
58222	GLSA-201203-12 : OpenSSL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
57887	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : openssl vulnerabilities (USN-1357-1)	Nessus	Ubuntu Local Security Checks	high
57551	FreeBSD : OpenSSL -- multiple vulnerabilities (78cc8a46-3e56-11e1-89b4-001ec9578670)	Nessus	FreeBSD Local Security Checks	high
57460	OpenSSL 1.x < 1.0.0f Multiple Vulnerabilities	Nessus	Web Servers	medium
801059	OpenSSL 0.9.8 < 0.9.8s / 1.x < 1.0.0f Multiple Vulnerabilities	Log Correlation Engine	Web Servers	high
6129	OpenSSL 0.9.8 < 0.9.8s / 1.x < 1.0.0f Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high

Detections

Analytics

CVE-2012-0027

high

Tenable Plugins

high

medium

medium

high

medium

high

critical

high

high

high

medium

high

high