During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause OpenSSL 1.1.0 before 1.1.0e to crash (dependent on ciphersuite). Both clients and servers are affected.

The version of Oracle VM VirtualBox running on the remote host is 5.1.x prior to 5.1.30. It is, therefore, affected by multiple vulnerabilities as noted in the October 2017 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information.

Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote host is prior to 1.1.0e. It is, therefore, affected by a vulnerability as referenced in the 1.1.0e advisory.

  - During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the     original handshake (or vice-versa) then this can cause OpenSSL 1.1.0 before 1.1.0e to crash (dependent on     ciphersuite). Both clients and servers are affected. (CVE-2017-3733)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its banner, the version of OpenSSL on the remote host is version 1.1.0 prior to 1.1.0e and is affected by a flaw that is triggered when handling renegotiation handshakes where the 'Encrypt-Then-Mac' extension is negotiated when it was not in the initial handshake, or vice versa. This may allow a remote attacker to cause OpenSSL to crash.

The OpenSSL project reports :

Severity: High During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause OpenSSL to crash (dependent on ciphersuite). Both clients and servers are affected. This issue does not affect OpenSSL version 1.0.2.

ID	Name	Product	Family	Severity
103930	Oracle VM VirtualBox 5.1.x < 5.1.30 (October 2017 CPU)	Nessus	Misc.	critical
97328	OpenSSL 1.1.0 < 1.1.0e Vulnerability	Nessus	Web Servers	high
9971	OpenSSL 1.1.0 < 1.1.0e DoS	Nessus Network Monitor	Web Servers	high
97219	FreeBSD : openssl -- crash on handshake (1a802ba9-f444-11e6-9940-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-3733

high

Tenable Plugins

critical

high

high

high