OpenSSL 0.9.6 CA Basic Constraints Validation Vulnerability
High Nessus Plugin ID 17751
SynopsisThe remote server is affected by a certificate validation vulnerability.
DescriptionAccording to its banner, the remote server is running a version of OpenSSL that is earlier than 0.9.7.
Such versions do not verify the Basic Constraint for some certificates. A remote attacker could perform a man-in-the-middle attack.
Details on this weakness are missing. It is related to CVE-2002-0970. OpenSSL 0.9.6 was reported as 'probably' vulnerable.
SolutionUpgrade to OpenSSL 0.9.7 or later.