Detections
Analytics

FreeBSD : mbed TLS -- plaintext recovery vulnerabilities (f4876dd4-9ca8-11e8-aa17-0011d823eebd)

medium Nessus Plugin ID 111659

Language:

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

Simon Butcher reports :

- When using a CBC based ciphersuite, a remote attacker can partially recover the plaintext.

- When using a CBC based ciphersuite, an attacker with the ability to execute arbitrary code on the machine under attack can partially recover the plaintext by use of cache based side-channels.

Solution

Update the affected package.

See Also

http://www.nessus.org/u?ec6b7b20

http://www.nessus.org/u?8b4ae5e5

Plugin Details

Severity: Medium

ID: 111659

File Name: freebsd_pkg_f4876dd49ca811e8aa170011d823eebd.nasl

Version: 1.3

Type: local

Published: 8/13/2018

Updated: 11/10/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:mbedtls, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 8/10/2018

Vulnerability Publication Date: 7/24/2018

Reference Information

CVE: CVE-2018-0497, CVE-2018-0498