OpenSSL < 0.9.5a /dev/random Check Failure

Medium Nessus Plugin ID 17707


The remote host uses a version of OpenSSL that may have weak encryption keys.


According to its banner, the version of OpenSSL running on the remote host is less than 0.9.5a. On a FreeBSD system running on the Alpha architecture, versions earlier than that may not use the /dev/random and /dev/urandom devices to provide a strong source of cryptographic entropy, which could lead to the generation of keys with weak cryptographic strength.


Upgrade OpenSSL to version 0.9.5a or higher and re-generate encryption keys.

See Also

Plugin Details

Severity: Medium

ID: 17707

File Name: openssl_0_9_5a.nasl

Version: $Revision: 1.5 $

Type: remote

Family: Web Servers

Published: 2011/11/18

Modified: 2016/11/02

Dependencies: 10107

Risk Information

Risk Factor: Medium


Base Score: 5.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N

Temporal Vector: CVSS2#E:H/RL:U/RC:ND

Vulnerability Information

CPE: cpe:/a:openssl:openssl

Required KB Items: Settings/ParanoidReport

Patch Publication Date: 2010/05/10

Vulnerability Publication Date: 2010/06/12

Reference Information

CVE: CVE-2000-0535

BID: 1340

OSVDB: 3938