OracleVM 3.2 : openssl (OVMSA-2016-0071)

Medium Nessus Plugin ID 91751


The remote OracleVM host is missing a security update.


The remote OracleVM system is missing necessary patches to address critical security updates :

- To disable SSLv2 client connections create the file /etc/sysconfig/openssl-ssl-client-kill-sslv2 (John Haxby) [orabug 21673934]

- Backport openssl 08-Jan-2015 security fixes (John Haxby) [orabug 20409893]

- fix CVE-2014-3570 - Bignum squaring may produce incorrect results

- fix CVE-2014-3571 - DTLS segmentation fault in dtls1_get_record

- fix CVE-2014-3572 - ECDHE silently downgrades to ECDH [Client]

- fix CVE-2016-0797 - heap corruption in BN_hex2bn and BN_dec2bn

- fix CVE-2015-3197 - SSLv2 ciphersuite enforcement

- disable SSLv2 in the generic TLS method (can be reenabled by setting environment variable OPENSSL_ENABLE_SSL2)

- fix CVE-2015-3195 - X509_ATTRIBUTE memory leak


Update the affected openssl package.

See Also

Plugin Details

Severity: Medium

ID: 91751

File Name: oraclevm_OVMSA-2016-0071.nasl

Version: $Revision: 2.4 $

Type: local

Published: 2016/06/22

Modified: 2017/02/14

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:F/RL:OF/RC:ND


Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability Information

CPE: p-cpe:/a:oracle:vm:openssl, cpe:/o:oracle:vm_server:3.2

Required KB Items: Host/local_checks_enabled, Host/OracleVM/release, Host/OracleVM/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2016/06/21

Reference Information

CVE: CVE-2014-3570, CVE-2014-3571, CVE-2014-3572, CVE-2015-3195, CVE-2015-3197, CVE-2016-0797

BID: 71937, 71939, 71942, 74107, 75769

OSVDB: 116793, 116795, 116796, 131039, 133715, 135121