OpenSSL < 0.9.8n Multiple Vulnerabilities
Medium Log Correlation Engine Plugin ID 801060
SynopsisThe remote web server is vulnerable to multiple attack vectors.
DescriptionAccording to its banner, the remote web server is running a version of OpenSSL older than 0.9.8n. Such versions have the following vulnerabilities :
- Kerberos-enabled versions of OpenSSL do not check the return value when Kerberos configuration files cannot be opened, leading to a crash. (CVE-2010-0433)
- Rejecting a SSL/TLS record with and incorrect version number can lead to a crash. This only affects version 0.9.8m if a 'short' is 1 bits. Otherwise it affects all versions back to and including 0.9.8f. (CVE-2010-0740)
SolutionUpgrade to OpenSSL 0.9.8n or later.