FreeBSD : OpenSSL -- multiple vulnerabilities (9d15355b-ce7c-11e4-9db0-d050992ecde8) (FREAK)

High Nessus Plugin ID 81962


The remote FreeBSD host is missing one or more security-related updates.


OpenSSL project reports :

- Reclassified: RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204). OpenSSL only.

- Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286)

- ASN.1 structure reuse memory corruption (CVE-2015-0287)

- PKCS#7 NULL pointer dereferences (CVE-2015-0289)

- Base64 decode (CVE-2015-0292). OpenSSL only.

- DoS via reachable assert in SSLv2 servers (CVE-2015-0293). OpenSSL only.

- Use After Free following d2i_ECPrivatekey error (CVE-2015-0209)

- X509_to_X509_REQ NULL pointer deref (CVE-2015-0288)


Update the affected packages.

See Also

Plugin Details

Severity: High

ID: 81962

File Name: freebsd_pkg_9d15355bce7c11e49db0d050992ecde8.nasl

Version: $Revision: 1.14 $

Type: local

Published: 2015/03/20

Modified: 2017/07/06

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:libressl, p-cpe:/a:freebsd:freebsd:linux-c6-openssl, p-cpe:/a:freebsd:freebsd:mingw32-openssl, p-cpe:/a:freebsd:freebsd:openssl, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 2015/03/19

Vulnerability Publication Date: 2015/03/19

Reference Information

CVE: CVE-2015-0204, CVE-2015-0209, CVE-2015-0286, CVE-2015-0287, CVE-2015-0288, CVE-2015-0289, CVE-2015-0292, CVE-2015-0293

FreeBSD: SA-15:06.openssl