Mandriva Linux Security Advisory : openssl (MDVSA-2013:052)

Medium Nessus Plugin ID 66066


The remote Mandriva Linux host is missing one or more security updates.


Multiple vulnerabilities has been found and corrected in openssl :

OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid key (CVE-2013-0166).

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the Lucky Thirteen issue (CVE-2013-0169).

The updated packages have been upgraded to the 1.0.0k version which is not vulnerable to these issues.


Update the affected packages.

See Also

Plugin Details

Severity: Medium

ID: 66066

File Name: mandriva_MDVSA-2013-052.nasl

Version: $Revision: 1.13 $

Type: local

Published: 2013/04/20

Modified: 2016/03/14

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 5

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:lib64openssl-devel, p-cpe:/a:mandriva:linux:lib64openssl-engines1.0.0, p-cpe:/a:mandriva:linux:lib64openssl-static-devel, p-cpe:/a:mandriva:linux:lib64openssl1.0.0, p-cpe:/a:mandriva:linux:openssl, cpe:/o:mandriva:business_server:1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2013/04/05

Reference Information

CVE: CVE-2013-0166, CVE-2013-0169

BID: 57778, 60268

OSVDB: 89865, 89848, 113864

MDVSA: 2013:052