Detections
Analytics
OpenSSL < 0.9.8y Multiple Vulnerabilities
low Nessus Plugin ID 64532
Language:
Synopsis
The remote host may be affected by multiple vulnerabilities.Description
According to its banner, the remote web server is running a version of OpenSSL prior to 0.9.8y. The OpenSSL library is, therefore, reportedly affected by the following vulnerabilities :- An error exists related to the handling of OCSP response verification that could allow denial of service attacks.
(CVE-2013-0166)
- An error exists related to the SSL/TLS/DTLS protocols, CBC mode encryption and response time. An attacker could obtain plaintext contents of encrypted traffic via timing attacks. (CVE-2013-0169)
Solution
Upgrade to OpenSSL 0.9.8y or later.See Also
Plugin Details
Severity: Low
ID: 64532
File Name: openssl_0_9_8y.nasl
Version: 1.19
Type: combined
Agent: windows, macosx, unix
Family: Web Servers
Published: 2/9/2013
Updated: 8/22/2023
Supported Sensors: Nessus Agent
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Low
Base Score: 2.6
Temporal Score: 1.9
Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2013-0169
Vulnerability Information
CPE: cpe:/a:openssl:openssl
Required KB Items: installed_sw/OpenSSL
Exploit Ease: No known exploits are available
Patch Publication Date: 2/5/2013
Vulnerability Publication Date: 2/4/2013
Reference Information
CVE: CVE-2013-0166, CVE-2013-0169