遠端主機受到 GLSA-201110-01 中所述的弱點影響 (OpenSSL：多個弱點)

在 OpenSSL 中發現多個弱點。如需詳細資訊，請檢閱以下提及的 CVE 識別碼。
 影響：

內容相依的攻擊者可造成拒絕服務、可能執行任意程式碼、繞過預定金鑰需求、強制降級至非預定加密、繞過知悉共用私密並成功驗證的需要、繞過 CRL 驗證，或取得使用 OpenSSL 之應用程式的敏感資訊。
 因應措施：

目前尚無已知的因應措施。

OpenSSL 的內部憑證驗證常式可錯誤接受其 nextUpdate 欄位為過去的 CRL (CVE-2011-3207)。

ECDH 的伺服器程式碼可在收到特製的交握訊息時損毀 (CVE-2011-3210)。

根據 web 伺服器的標題，遠端主機上承載的 HP System Management Homepage (SMH) 版本比 7.0 舊。因此，據報會受到以下弱點影響：

- 隨附的 libxslt 程式庫中的「generate-id」函式存在一個錯誤，其允許洩漏堆積記憶體位址。(CVE-2011-0195)

- 存在一個不明的輸入驗證錯誤，可允許跨網站要求偽造攻擊。(CVE-2011-3846)

- 存在不明錯誤，可允許攻擊者透過不明向量發動拒絕服務攻擊。
 (CVE-2012-0135、CVE-2012-1993)

- 隨附的 PHP 版本存有多個弱點。(CVE-2010-3436、CVE-2010-4409、CVE-2010-4645、CVE-2011-1148、CVE-2011-1153、CVE-2011-1464、CVE-2011-1467、CVE-2011-1468、CVE-2011-1470、CVE-2011-1471、CVE-2011-1938、CVE-2011-2202、CVE-2011-2483、CVE-2011-3182、CVE-2011-3189、CVE-2011-3267、CVE-2011-3268)

- 隨附的 Apache 版本存有多個弱點。(CVE-2010-1452、CVE-2010-1623、CVE-2010-2068、CVE-2010-2791、CVE-2011-0419、CVE-2011-1928、CVE-2011-3192、CVE-2011-3348、CVE-2011-3368、CVE-2011-3639)

- 數個隨附元件含有 OpenSSL 程式庫，其中存在多個弱點。
 (CVE-2011-0014、CVE-2011-1468、CVE-2011-1945、CVE-2011-3207、CVE-2011-3210)

- 數個隨附元件含有 Curl 程式庫，其中存在多個弱點。
 (CVE-2009-0037、CVE-2010-0734、CVE-2011-2192)

The remote host is running a version of Mac OS X 10.8 that is older than 10.8.4. The newer version contains numerous security-related fixes :

  - A local security-bypass vulnerability exists that affects the Disk Management component. The issue can be exploited by an unauthorized attacker to disable FileVault using the command-line. (CVE-2013-0985)

  - A security-bypass vulnerability in SMB file sharing can occur whereby an authenticated attacker can write files outside the shared directory. (CVE-2013-0990)

  - A remote buffer-overflow vulnerability exists when handling certain PICT images. (CVE-2013-0975)

  - A security-bypass vulnerability exists whereby an attacker with access to a user's session may be able to log into previously accessed sites. An attacker can exploit this issue even if Private Browsing was used. (CVE-2013-0982)

  - A remote-code execution issue affects the text glyphs because of an unbounded stack allocation when handling maliciously crafted URLs. (CVE-2013-0983)

  - A remote-code execution vulnerability exists due to improper handling of text tracks. (CVE-2013-1024)

  - A buffer-overflow vulnerability exists in the Directory Service daemon that can be exploited via a specially crafted network message. (CVE-2013-0984)

Versions of OpenSSL 1.0.0 earlier than and 1.0.0e are potentially affected by the following vulnerabilities : 

  - An error exists in the internal certificate verification process that can allow improper acceptance of a certificate revolcation list (CRL) if the lists's 'nextUpdate' field contains a date in teh past.  Note that this internal CRL checking is not enabled by defaut. (CVE-2011-3207)

  - An error exists in the code for the ephemeral (EC)DH ciphersuites that can allow a remote attacker to crash the process. (CVE-2011-3210)

ID	Name	Product	Family	Published	Updated	Severity
56425	GLSA-201110-01 : OpenSSL：多個弱點	Nessus	Gentoo Local Security Checks	10/10/2011	1/6/2021	critical
75597	openSUSE 安全性更新：libopenssl-devel (openSUSE-SU-2011:1144-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	medium
58811	HP System Management Homepage < 7.0 多種弱點	Nessus	Web Servers	4/20/2012	4/11/2022	critical
6857	Mac OS X 10.8 < 10.8.4 Multiple Vulnerabilities (Security Update 2013-002)	Nessus Network Monitor	Web Clients	6/5/2013	3/6/2019	critical
6022	OpenSSL 1.x < 1.0.0e Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	9/6/2011	3/6/2019	medium
801065	OpenSSL 1.x < 1.0.0e Multiple Vulnerabilities	Log Correlation Engine	Web Servers	9/6/2011		medium
801016	Mac OS X 10.8 < 10.8.4 Multiple Vulnerabilities (Security Update 2013-002)	Log Correlation Engine	Operating System Detection	6/5/2013		high

Detections

Analytics

Plugins Search

critical

medium

critical

critical

medium

medium

high