Detections
Analytics
OpenSSL 0.9.8 < 0.9.8k Multiple Vulnerabilities
high Nessus Plugin ID 17763
Language:
Synopsis
The remote service is affected by multiple vulnerabilities.Description
The version of OpenSSL installed on the remote host is prior to 0.9.8k. It is, therefore, affected by multiple vulnerabilities as referenced in the 0.9.8k advisory.- OpenSSL before 0.9.8k on WIN64 and certain other platforms does not properly handle a malformed ASN.1 structure, which allows remote attackers to cause a denial of service (invalid memory access and application crash) by placing this structure in the public key of a certificate, as demonstrated by an RSA public key. (CVE-2009-0789)
- The CMS_verify function in OpenSSL 0.9.8h through 0.9.8j, when CMS is enabled, does not properly handle errors associated with malformed signed attributes, which allows remote attackers to repudiate a signature that originally appeared to be valid but was actually invalid. (CVE-2009-0591)
- The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString or (2) UniversalString with an invalid encoded length. (CVE-2009-0590)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to OpenSSL version 0.9.8k or later.See Also
https://www.cve.org/CVERecord?id=CVE-2009-0590
https://www.cve.org/CVERecord?id=CVE-2009-0591
Plugin Details
Severity: High
ID: 17763
File Name: openssl_0_9_8k.nasl
Version: 1.16
Type: combined
Agent: windows, macosx, unix
Family: Web Servers
Published: 1/4/2012
Updated: 6/7/2024
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Low
Base Score: 2.6
Temporal Score: 1.9
Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2009-0591
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS Score Source: CVE-2009-0590
Vulnerability Information
CPE: cpe:/a:openssl:openssl
Required KB Items: installed_sw/OpenSSL
Exploit Ease: No known exploits are available
Patch Publication Date: 3/25/2009
Vulnerability Publication Date: 3/25/2009