The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-1335 advisory.

  - The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of     service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString     or (2) UniversalString with an invalid encoded length. (CVE-2009-0590)

  - The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows     remote attackers to cause a denial of service (memory consumption) via a large series of future epoch     DTLS records that are buffered in a queue, aka DTLS record buffer limitation bug. (CVE-2009-1377)

  - Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k     and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via     DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence     numbers, aka DTLS fragment handling memory leak. (CVE-2009-1378)

  - Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL     1.0.0 Beta 2 allows remote attackers to cause a denial of service (openssl s_client crash) and possibly     have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server that uses a     crafted server certificate. (CVE-2009-1379)

  - ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer     dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello.
    (CVE-2009-1386)

  - The dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL before 1.0.0 Beta 2 allows     remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-     sequence DTLS handshake message, related to a fragment bug. (CVE-2009-1387)

  - The mime_hdr_cmp function in crypto/asn1/asn_mime.c in OpenSSL 0.9.8t and earlier allows remote attackers     to cause a denial of service (NULL pointer dereference and application crash) via a crafted S/MIME     message. (CVE-2006-7250)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 5 : openssl (ELSA-2009-1335)

high Nessus Plugin ID 180619

Version 1.2

Version 1.1

Version 1.1

Version 1.0

Version 1.2 Dec 14, 2023, 4:32 PM CVSSv3 score source (changed from "CVE-2009-1386" to none) Plugin Feed: 202312141632
Version 1.1 Sep 8, 2023, 4:12 PM CVSSv3 score source (set to "CVE-2009-1386") Exploit attributes ("Exploit framework core" set to "True") Plugin Feed: 202309081612
Version 1.1 Dec 14, 2023, 2:28 PM CVSSv3 score source (changed from "CVE-2009-1386" to none) Plugin Feed: 202312141428
Version 1.0 Sep 7, 2023, 9:48 PM New Plugin Feed: 202309072148