OracleVM 3.2 : onpenssl (OVMSA-2014-0008)

This script is Copyright (C) 2014-2017 Tenable Network Security, Inc.


Synopsis :

The remote OracleVM host is missing a security update.

Description :

The remote OracleVM system is missing necessary patches to address
critical security updates :

- fix for CVE-2014-0224 - SSL/TLS MITM vulnerability

- replace expired GlobalSign Root CA certificate in
ca-bundle.crt

- fix for CVE-2013-0169 - SSL/TLS CBC timing attack
(#907589)

- fix for CVE-2013-0166 - DoS in OCSP signatures checking
(#908052)

- enable compression only if explicitly asked for or
OPENSSL_DEFAULT_ZLIB environment variable is set (fixes
CVE-2012-4929 #857051)

- use __secure_getenv everywhere instead of getenv
(#839735)

- fix for CVE-2012-2333 - improper checking for record
length in DTLS (#820686)

- fix for CVE-2012-2110 - memory corruption in
asn1_d2i_read_bio (#814185)

- fix problem with the SGC restart patch that might
terminate handshake incorrectly

- fix for CVE-2012-0884 - MMA weakness in CMS and PKCS#7
code (#802725)

- fix for CVE-2012-1165 - NULL read dereference on bad
MIME headers (#802489)

- fix for CVE-2011-4108 & CVE-2012-0050 - DTLS plaintext
recovery vulnerability and additional DTLS fixes
(#771770)

- fix for CVE-2011-4109 - double free in policy checks
(#771771)

- fix for CVE-2011-4576 - uninitialized SSL 3.0 padding
(#771775)

- fix for CVE-2011-4619 - SGC restart DoS attack (#771780)

- add known answer test for SHA2 algorithms (#740866)

- make default private key length in certificate Makefile
2048 bits (can be changed with PRIVATE_KEY_BITS setting)
(#745410)

- fix incorrect return value in parse_yesno (#726593)

- added DigiCert CA certificates to ca-bundle (#735819)

- added a new section about error states to README.FIPS
(#628976)

- add missing DH_check_pub_key call when DH key is
computed (#698175)

- presort list of ciphers available in SSL (#688901)

- accept connection in s_server even if getaddrinfo fails
(#561260)

- point to openssl dgst for list of supported digests
(#608639)

- fix handling of future TLS versions (#599112)

- added VeriSign Class 3 Public Primary Certification
Authority - G5 and StartCom Certification Authority
certs to ca-bundle (#675671, #617856)

- upstream fixes for the CHIL engine (#622003, #671484)

- add SHA-2 hashes in SSL_library_init (#676384)

- fix CVE-2010-4180 - completely disable code for
SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (#659462)

- fix CVE-2009-3245 - add missing bn_wexpand return checks
(#570924)

- fix CVE-2010-0433 - do not pass NULL princ to
krb5_kt_get_entry which in the RHEL-5 and newer versions
will crash in such case (#569774)

- fix CVE-2009-3555 - support the safe renegotiation
extension and do not allow legacy renegotiation on the
server by default (#533125)

- fix CVE-2009-2409 - drop MD2 algorithm from EVP tables
(#510197)

- fix CVE-2009-4355 - do not leak memory when
CRYPTO_cleanup_all_ex_data is called prematurely by
application (#546707)

See also :

https://oss.oracle.com/pipermail/oraclevm-errata/2014-June/000208.html

Solution :

Update the affected openssl package.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.8
(CVSS2#E:POC/RL:OF/RC:C)
Public Exploit Available : true