Detections
Analytics
Scientific Linux Security Update : openssl on SL5.x i386/x86_64 (20150630) (Logjam)
high Nessus Plugin ID 84542
Language:
Synopsis
The remote Scientific Linux host is missing one or more security updates.Description
An out-of-bounds read flaw was found in the X509_cmp_time() function of OpenSSL. A specially crafted X.509 certificate or a Certificate Revocation List (CRL) could possibly cause a TLS/SSL server or client using OpenSSL to crash. (CVE-2015-1789)A NULL pointer dereference was found in the way OpenSSL handled certain PKCS#7 inputs. A specially crafted PKCS#7 input with missing EncryptedContent data could cause an application using OpenSSL to crash. (CVE-2015-1790)
A flaw was found in the way the TLS protocol composes the Diffie-Hellman (DH) key exchange. A man-in-the-middle attacker could use this flaw to force the use of weak 512 bit export-grade keys during the key exchange, allowing them to decrypt all traffic.
(CVE-2015-4000)
Note: This update forces the TLS/SSL client implementation in OpenSSL to reject DH key sizes below 768 bits, which prevents sessions to be downgraded to export-grade keys. Future updates may raise this limit to 1024 bits.
For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.
Solution
Update the affected packages.See Also
Plugin Details
Severity: High
ID: 84542
File Name: sl_20150630_openssl_on_SL5_x.nasl
Version: 2.11
Type: local
Agent: unix
Published: 7/6/2015
Updated: 12/5/2022
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.9
CVSS v2
Risk Factor: Medium
Base Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS v3
Risk Factor: High
Base Score: 7.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability Information
CPE: p-cpe:/a:fermilab:scientific_linux:openssl, p-cpe:/a:fermilab:scientific_linux:openssl-debuginfo, p-cpe:/a:fermilab:scientific_linux:openssl-devel, p-cpe:/a:fermilab:scientific_linux:openssl-perl, x-cpe:/o:fermilab:scientific_linux
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RedHat/release, Host/RedHat/rpm-list
Patch Publication Date: 6/30/2015
Vulnerability Publication Date: 5/21/2015