HP-UX PHSS_30648 : s700_800 11.04 Virtualvault 4.5 OWS update

Medium Nessus Plugin ID 17532

Synopsis

The remote HP-UX host is missing a security-related patch.

Description

s700_800 11.04 Virtualvault 4.5 OWS update :

The remote HP-UX host is affected by multiple vulnerabilities :

- Two potential security vulnerabilities have been identified in OpenSSL by NISCC (224012/1 and 224012/2).
The Common Vulnerabilities and Exposures project has referenced them as the following CAN-2004-0079, and CAN-2004-0112. The CERT summary is TA04-078A. 1. The do_change_cipher_spec function in OpenSSL allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that triggers a null dereference.
CVE-2004-0079 2. The SSL/TLS handshaking, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that causes an out-of-bounds read. CVE-2004-0112. (HPSBUX01019 SSRT4717)

- A potential security vulnerability has been identified with Apache running on HP-UX where a buffer overflow could be exploited remotely to execute arbitrary code.

- A potential security vulnerability has been identified with HP-UX running Apache where the vulnerability could be exploited remotely to create a Denial of Service (DoS) or to execute arbitrary code.

- A potential security vulnerability has been identified with Apache running on HP-UX where the vulnerability could be exploited remotely to create a Denial of Service (DoS) or to bypass access restrictions.

Solution

Install patch PHSS_30648 or subsequent.

See Also

http://www.nessus.org/u?6195bc72

Plugin Details

Severity: Medium

ID: 17532

File Name: hpux_PHSS_30648.nasl

Version: Revision: 1.16

Type: local

Published: 2005/03/18

Updated: 2014/05/22

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: cpe:/o:hp:hp-ux

Patch Publication Date: 2004/06/29

Reference Information

CVE: CVE-2003-0020, CVE-2004-0079, CVE-2004-0112, CVE-2004-0113, CVE-2004-0174

HP: emr_na-c00944046, HPSBUX01019, HPSBUX01057, HPSBUX01068, HPSBUX01069, SSRT4717