The version of Cerberus FTP Server on the remote host is version 6.x prior to 6.0.10.0 or version 7.x prior to 7.0.0.3. It is, therefore, affected by the following OpenSSL vulnerabilities :

  - An error exists in the 'ssl3_read_bytes' function     that permits data to be injected into other sessions     or allows denial of service attacks. Note that this     issue is exploitable only if SSL_MODE_RELEASE_BUFFERS     is enabled. (CVE-2010-5298)

  - A buffer overflow error exists related to invalid DTLS     fragment handling that permits the execution of     arbitrary code or allows denial of service attacks.
    Note that this issue only affects OpenSSL when used     as a DTLS client or server. (CVE-2014-0195)

  - An error exists in the 'do_ssl3_write' function that     permits a NULL pointer to be dereferenced, which could     allow denial of service attacks. Note that this issue     is exploitable only if SSL_MODE_RELEASE_BUFFERS is     enabled. (CVE-2014-0198)

  - An error exists related to DTLS handshake handling that     could allow denial of service attacks. Note that this     issue only affects OpenSSL when used as a DTLS client.
    (CVE-2014-0221)

  - An error exists in the processing of ChangeCipherSpec     messages that allows the usage of weak keying material.
    This permits simplified man-in-the-middle attacks to be     done. (CVE-2014-0224)

  - An error exists in the 'dtls1_get_message_fragment'     function related to anonymous ECDH cipher suites. This     could allow denial of service attacks. Note that this     issue only affects OpenSSL TLS clients. (CVE-2014-3470)

Cerberus FTP Server 6.x < 6.0.10.0 / 7.x < 7.0.0.3 Multiple OpenSSL Vulnerabilities

medium Nessus Plugin ID 77004

No changelogs found