Detections
Analytics

OpenSSL < 0.9.8p / 1.0.0b Buffer Overflow

high Nessus Plugin ID 17766

Language:

Synopsis

The remote server is affected by a buffer overflow vulnerability.

Description

According to its banner, the remote server is running a version of OpenSSL that is earlier than 0.9.8p / 1.0.0b.

If a TLS server is multithreaded and uses the SSL cache, a remote attacker could trigger a buffer overflow and crash the server or run arbitrary code.

Solution

Upgrade to OpenSSL 0.9.8p / 1.0.0b or later.

See Also

https://www.openssl.org/news/secadv/20101116.txt

Plugin Details

Severity: High

ID: 17766

File Name: openssl_0_9_8p_1_0_0b.nasl

Version: 1.10

Type: remote

Family: Web Servers

Published: 1/4/2012

Updated: 7/16/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:openssl:openssl

Required KB Items: openssl/port

Exploit Ease: No known exploits are available

Patch Publication Date: 11/16/2010

Vulnerability Publication Date: 11/16/2010

Reference Information

CVE: CVE-2010-3864

BID: 44884