Oracle Solaris Third-Party Patch Update : openssl (lucky_thirteen_vulnerability_in_solaris)
medium Nessus Plugin ID 80719
Language:
New! Vulnerability Priority Rating (VPR)
Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.
VPR Score: 3.6
Synopsis
The remote Solaris system is missing a security patch for third-party software.Description
The remote Solaris system is missing necessary patches to address security updates :- OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause a denial of service (NULL pointer dereference and application crash) via an invalid key.
(CVE-2013-0166)
- The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the 'Lucky Thirteen' issue. (CVE-2013-0169)
Solution
Upgrade to Solaris 11.1.7.5.0.See Also
Plugin Details
Severity: Medium
ID: 80719
File Name: solaris11_openssl_20130716.nasl
Version: 1.3
Type: local
Family: Solaris Local Security Checks
Published: 1/19/2015
Updated: 1/14/2021
Dependencies: ssh_get_info.nasl
Risk Information
Risk Factor: Medium
VPR Score: 3.6
CVSS v2.0
Base Score: 5
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Vulnerability Information
CPE: cpe:/o:oracle:solaris:11.1, p-cpe:/a:oracle:solaris:openssl
Required KB Items: Host/local_checks_enabled, Host/Solaris11/release, Host/Solaris11/pkg-list
Patch Publication Date: 7/16/2013
Reference Information
CVE: CVE-2013-0166, CVE-2013-0169