OpenSSL 0.9.8 < 0.9.8u / 1.0.0 < 1.0.0h Multiple Vulnerabilities
medium Log Correlation Engine Plugin ID 801067
Synopsis
The remote web server is affected by multiple vulnerabilities.Description
OpenSSL versions earlier than 0.9.8u and 1.0.0h are potentially affected by multiple vulnerabilities :- A NULL pointer dereference flaw exists in mime_param_cmp. A specially crafted S/MIME input header could cause an application to crash during S/MIME message verification or decryption. (CVE-2012-1165)
- A weakness in the OpenSSL CMS and PKCS 7 code can be exploited using Bleichenbacher's attack on PKCS 1 v1.5 RSA padding. Note that only users of CMS, PKCS 7, or S/MIME decryption operations are affected.
Solution
Upgrade to OpenSSL 0.9.8u, 1.0.0h, or later.See Also
Plugin Details
Severity: Medium
ID: 801067
Family: Web Servers
Published: 3/29/2012
Updated: 3/29/2012
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
Temporal Vector: CVSS2#E:U/RL:OF/RC:C
Vulnerability Information
Patch Publication Date: 3/12/2012
Vulnerability Publication Date: 3/12/2012
Reference Information
CVE: CVE-2012-0884, CVE-2012-1165