OpenSSL < 0.9.8y / 1.0.1d / 1.0.0k Multiple Vulnerabilities
medium Nessus Network Monitor Plugin ID 6868
Synopsis
The remote web server is running an OpenSSL instance that may be affected by multiple vulnerabilities.Description
Versions of OpenSSL prior to 0.9.8y are reportedly affected by the following vulnerabilities :- An error exists related to the handling of OCSP response verification that could allow denial of service attacks. (CVE-2013-0166)
- An error exists related to the SSL/TLS/DTLS protocols, CBC mode encryption and response time. An attacker could obtain plaintext contents of encrypted traffic via timing attacks. (CVE-2013-0169)
Solution
Upgrade to OpenSSL version 0.9.8y / 1.0.1d / 1.0.0k or later.See Also
Plugin Details
Severity: Medium
ID: 6868
Family: Web Servers
Published: 6/11/2013
Updated: 3/6/2019
Dependencies: 5563
Nessus ID: 64532
Risk Information
Risk Factor: Medium
CVSS v2.0
Base Score: 4.3
Temporal Score: 3.6
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P
Temporal Vector: CVSS2#E:F/RL:OF/RC:C
CVSS v3.0
Base Score: 3.7
Temporal Score: 3.5
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
Patch Publication Date: 6/3/2013
Vulnerability Publication Date: 6/3/2013
Reference Information
BID: 60268