OpenSSL < 0.9.8k Multiple Vulnerabilities
medium Nessus Plugin ID 17763
Language:
Synopsis
The remote server is affected by multiple vulnerabilities.Description
According to its banner, the remote server is running a version of OpenSSL prior to 0.9.8k. It is, therefore, affected by multiple vulnerabilities :- A denial of service vulnerability exists in the ASN1_STRING_print_ex() function due to improper string handling. A remote attacker can exploit this to cause an invalid memory access and application crash.
(CVE-2009-0590)
- A flaw exists in the CMS_verify() function due to improper handling of errors associated with malformed signed attributes. A remote attacker can exploit this to repudiate a signature that originally appeared to be valid but was actually invalid. (CVE-2009-0591)
- A denial of service vulnerability exists due to improper handling of malformed ASN.1 structures. A remote attacker can exploit this to cause an invalid memory access and application crash. (CVE-2009-0789)
- A memory leak exists in the SSL_free() function in ssl_lib.c. A remote attacker can exploit this to exhaust memory resources, resulting in a denial of service condition. (CVE-2009-5146)
Solution
Upgrade to OpenSSL version 0.9.8k or later.See Also
Plugin Details
Severity: Medium
ID: 17763
File Name: openssl_0_9_8k.nasl
Version: 1.13
Type: remote
Family: Web Servers
Published: 1/4/2012
Updated: 7/16/2018
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Temporal Vector: E:U/RL:OF/RC:C
Vulnerability Information
CPE: cpe:/a:openssl:openssl
Required KB Items: openssl/port
Exploit Ease: No known exploits are available
Patch Publication Date: 3/25/2009
Vulnerability Publication Date: 3/25/2009
Reference Information
CVE: CVE-2009-0590, CVE-2009-0591, CVE-2009-0789, CVE-2009-5146