FreeBSD : suricata -- TLS/DER Parser Bug (DoS) (fe910ed6-f88d-11e4-9ae3-0050562a4d7b)

This script is Copyright (C) 2015 Tenable Network Security, Inc.


Synopsis :

The remote FreeBSD host is missing a security-related update.

Description :

OISF Development Team reports :

The OISF development team is pleased to announce Suricata 2.0.8. This
release fixes a number of issues in the 2.0 series.

The most important issue is a bug in the DER parser which is used to
decode SSL/TLS certificates could crash Suricata. This issue was
reported by Kostya Kortchinsky of the Google Security Team and was
fixed by Pierre Chifflier of ANSSI.

Those processing large numbers of (untrusted) pcap files need to
update as a malformed pcap could crash Suricata. Again, credits go to
Kostya Kortchinsky.

See also :

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0971
http://www.nessus.org/u?d8569e01
http://www.nessus.org/u?7f409c45

Solution :

Update the affected package.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)

Family: FreeBSD Local Security Checks

Nessus Plugin ID: 83390 ()

Bugtraq ID:

CVE ID: CVE-2015-0971

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now