The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2830-1 advisory.

    Guy Leaver discovered that OpenSSL incorrectly handled a ServerKeyExchange for an anonymous DH ciphersuite     with the value of p set to 0. A remote attacker could possibly use this issue to cause OpenSSL to crash,     resulting in a denial of service. This issue only applied to Ubuntu 15.10. (CVE-2015-1794)

    Hanno Bck discovered that the OpenSSL Montgomery squaring procedure algorithm may produce incorrect     results when being used on x86_64. A remote attacker could possibly use this issue to break encryption.
    This issue only applied to Ubuntu 15.10. (CVE-2015-3193)

    Loc Jonas Etienne discovered that OpenSSL incorrectly handled ASN.1 signatures with a missing PSS     parameter. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a     denial of service. (CVE-2015-3194)

    Adam Langley discovered that OpenSSL incorrectly handled malformed X509_ATTRIBUTE structures. A remote     attacker could possibly use this issue to cause OpenSSL to consume resources, resulting in a denial of     service. (CVE-2015-3195)

    It was discovered that OpenSSL incorrectly handled PSK identity hints. A remote attacker could possibly     use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only applied to     Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-3196)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS : OpenSSL vulnerabilities (USN-2830-1)

high Nessus Plugin ID 87236

Version 2.19