HP-UX PHSS_30649 : HP-UX Running Apache, Remote Denial of Service (DoS) (HPSBUX01019 SSRT4717 rev.3)

Medium Nessus Plugin ID 17533

Synopsis

The remote HP-UX host is missing a security-related patch.

Description

s700_800 11.04 Webproxy server 2.1 update :

Two potential security vulnerabilities have been identified in OpenSSL by NISCC (224012/1 and 224012/2). The Common Vulnerabilities and Exposures project has referenced them as the following CAN-2004-0079, and CAN-2004-0112. The CERT summary is TA04-078A. 1. The do_change_cipher_spec function in OpenSSL allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that triggers a null dereference. CVE-2004-0079 2. The SSL/TLS handshaking, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that causes an out-of-bounds read. CVE-2004-0112.

Solution

Install patch PHSS_30649 or subsequent.

See Also

http://www.nessus.org/u?6195bc72

Plugin Details

Severity: Medium

ID: 17533

File Name: hpux_PHSS_30649.nasl

Version: Revision: 1.14

Type: local

Published: 2005/03/18

Updated: 2014/05/22

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: cpe:/o:hp:hp-ux

Patch Publication Date: 2004/05/10

Reference Information

CVE: CVE-2003-0020, CVE-2004-0079, CVE-2004-0112, CVE-2004-0113, CVE-2004-0174

HP: emr_na-c00944046, HPSBUX01019, SSRT4717