Debian DSA-3053-1 : openssl - security update (POODLE)

low Nessus Plugin ID 78520
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote Debian host is missing a security-related update.

Description

Several vulnerabilities have been found in OpenSSL, the Secure Sockets Layer library and toolkit.

- CVE-2014-3513 A memory leak flaw was found in the way OpenSSL parsed the DTLS Secure Real-time Transport Protocol (SRTP) extension data. A remote attacker could send multiple specially crafted handshake messages to exhaust all available memory of an SSL/TLS or DTLS server.

- CVE-2014-3566 ('POODLE') A flaw was found in the way SSL 3.0 handled padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode. This flaw allows a man-in-the-middle (MITM) attacker to decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a victim application to repeatedly send the same data over newly created SSL 3.0 connections.

This update adds support for Fallback SCSV to mitigate this issue.

- CVE-2014-3567 A memory leak flaw was found in the way an OpenSSL handled failed session ticket integrity checks. A remote attacker could exhaust all available memory of an SSL/TLS or DTLS server by sending a large number of invalid session tickets to that server.

- CVE-2014-3568 When OpenSSL is configured with 'no-ssl3' as a build option, servers could accept and complete a SSL 3.0 handshake, and clients could be configured to send them.

Solution

Upgrade the openssl packages.

For the stable distribution (wheezy), these problems have been fixed in version 1.0.1e-2+deb7u13.

See Also

https://security-tracker.debian.org/tracker/CVE-2014-3513

https://security-tracker.debian.org/tracker/CVE-2014-3566

https://security-tracker.debian.org/tracker/CVE-2014-3567

https://security-tracker.debian.org/tracker/CVE-2014-3568

https://packages.debian.org/source/wheezy/openssl

https://www.debian.org/security/2014/dsa-3053

Plugin Details

Severity: Low

ID: 78520

File Name: debian_DSA-3053.nasl

Version: 1.26

Type: local

Agent: unix

Published: 10/17/2014

Updated: 1/11/2021

Dependencies: ssh_get_info.nasl

Risk Information

VPR

Risk Factor: Medium

Score: 5.7

CVSS v2

Risk Factor: High

Base Score: 7.1

Temporal Score: 5.3

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C

Temporal Vector: E:U/RL:OF/RC:C

CVSS v3

Risk Factor: Low

Base Score: 3.4

Temporal Score: 3

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:openssl, cpe:/o:debian:debian_linux:7.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 10/16/2014

Vulnerability Publication Date: 10/15/2014

Reference Information

CVE: CVE-2014-3513, CVE-2014-3566, CVE-2014-3567, CVE-2014-3568

BID: 70574, 70584, 70585, 70586

DSA: 3053