OpenSSL < 0.9.8n Multiple Vulnerabilities
Medium Nessus Plugin ID 45359
Synopsis
The remote web server has multiple SSL-related vulnerabilities.
Description
According to its banner, the remote web server is running a version of OpenSSL older than 0.9.8n. Such versions have the following vulnerabilities :
- Kerberos-enabled versions of OpenSSL do not check the return value when Kerberos configuration files cannot be opened, leading to a crash. (CVE-2010-0433)
- Rejecting a SSL/TLS record with an incorrect version number can lead to a crash. This only affects version 0.9.8m if a 'short' is 16 bits. Otherwise, it affects all versions back to and including 0.9.8f. (CVE-2010-0740)
Solution
Upgrade to OpenSSL 0.9.8n or later.