Mandriva Linux Security Advisory : openssl (MDVSA-2014:106)

This script is Copyright (C) 2014-2015 Tenable Network Security, Inc.


Synopsis :

The remote Mandriva Linux host is missing one or more security
updates.

Description :

Multiple vulnerabilities has been discovered and corrected in
openssl :

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before
0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not
properly validate fragment lengths in DTLS ClientHello messages, which
allows remote attackers to execute arbitrary code or cause a denial of
service (buffer overflow and application crash) via a long non-initial
fragment (CVE-2014-0195).

The dtls1_get_message_fragment function in d1_both.c in OpenSSL before
0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote
attackers to cause a denial of service (recursion and client crash)
via a DTLS hello message in an invalid DTLS handshake (CVE-2014-0221).

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h
does not properly restrict processing of ChangeCipherSpec messages,
which allows man-in-the-middle attackers to trigger use of a
zero-length master key in certain OpenSSL-to-OpenSSL communications,
and consequently hijack sessions or obtain sensitive information, via
a crafted TLS handshake, aka the CCS Injection vulnerability
(CVE-2014-0224).

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL
before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an
anonymous ECDH cipher suite is used, allows remote attackers to cause
a denial of service (NULL pointer dereference and client crash) by
triggering a NULL certificate value (CVE-2014-3470).

The updated packages have been upgraded to the 1.0.0m version where
these security flaws has been fixed.

See also :

https://www.openssl.org/news/secadv/20140605.txt

Solution :

Update the affected packages.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 8.1
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : true

Family: Mandriva Local Security Checks

Nessus Plugin ID: 74415 ()

Bugtraq ID: 67898
67899
67900
67901

CVE ID: CVE-2014-0195
CVE-2014-0221
CVE-2014-0224
CVE-2014-3470

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now