Detections
Analytics
OpenSSL < 0.9.7l / 0.9.8d Multiple Vulnerabilities
critical Nessus Plugin ID 17757
Language:
Synopsis
The remote server is affected by multiple vulnerabilities.Description
According to its banner, the remote server is running a version of OpenSSL that is earlier than 0.9.7l or 0.9.8d. As such, it is affected by multiple vulnerabilities :- A remote attacker could trigger a denial of service, either via malformed ASN.1 structures or specially crafted public keys. (CVE-2006-2937, CVE-2006-3738)
- A remote attacker could execute arbitrary code on the remote server by exploiting a buffer overflow in the SSL_get_shared_ciphers function. (CVE-2006-2940)
- A remote attacker could crash a client by sending an invalid server Hello. (CVE-2006-4343)
Solution
Upgrade to OpenSSL 0.9.7l / 0.9.8d or later.See Also
Plugin Details
Severity: Critical
ID: 17757
File Name: openssl_0_9_7l_0_9_8d.nasl
Version: 1.11
Type: remote
Family: Web Servers
Published: 1/4/2012
Updated: 11/15/2018
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:openssl:openssl
Required KB Items: openssl/port
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 9/28/2006
Vulnerability Publication Date: 9/28/2006
Reference Information
CVE: CVE-2006-2937, CVE-2006-2940, CVE-2006-3738, CVE-2006-4343