Oracle Solaris Third-Party Patch Update : openssl (multiple_vulnerabilities_in_openssl4) (Heartbleed)

This script is Copyright (C) 2015-2016 Tenable Network Security, Inc.


Synopsis :

The remote Solaris system is missing a security patch for third-party
software.

Description :

The remote Solaris system is missing necessary patches to address
security updates :

- The ssl3_take_mac function in ssl/s3_both.c in OpenSSL
1.0.1 before 1.0.1f allows remote TLS servers to cause a
denial of service (NULL pointer dereference and
application crash) via a crafted Next Protocol
Negotiation record in a TLS handshake. (CVE-2013-4353)

- The ssl_get_algorithm2 function in ssl/s3_lib.c in
OpenSSL before 1.0.2 obtains a certain version number
from an incorrect data structure, which allows remote
attackers to cause a denial of service (daemon crash)
via crafted traffic from a TLS 1.2 client.
(CVE-2013-6449)

- The DTLS retransmission implementation in OpenSSL 1.0.0
before 1.0.0l and 1.0.1 before 1.0.1f does not properly
maintain data structures for digest and encryption
contexts, which might allow man-in-the-middle attackers
to trigger the use of a different context and cause a
denial of service (application crash) by interfering
with packet delivery, related to ssl/d1_both.c and ssl/
t1_enc.c. (CVE-2013-6450)

- The Montgomery ladder implementation in OpenSSL through
1.0.0l does not ensure that certain swap operations have
a constant-time behavior, which makes it easier for
local users to obtain ECDSA nonces via a FLUSH+RELOAD
cache side-channel attack. (CVE-2014-0076)

- The (1) TLS and (2) DTLS implementations in OpenSSL
1.0.1 before 1.0.1g do not properly handle Heartbeat
Extension packets, which allows remote attackers to
obtain sensitive information from process memory via
crafted packets that trigger a buffer over-read, as
demonstrated by reading private keys, related to
d1_both.c and t1_lib.c, aka the Heartbleed bug.
(CVE-2014-0160)

See also :

http://www.nessus.org/u?b5f8def1
http://www.nessus.org/u?3cb907b0
http://www.nessus.org/u?ed7e2eda

Solution :

Upgrade to Solaris 11.2.

Risk factor :

High / CVSS Base Score : 9.4
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N)
Public Exploit Available : true

Family: Solaris Local Security Checks

Nessus Plugin ID: 80721 ()

Bugtraq ID:

CVE ID: CVE-2013-4353
CVE-2013-6449
CVE-2013-6450
CVE-2014-0076
CVE-2014-0160

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now