According to its self-reported version, the version of IVE / UAC OS running on the remote host may be affected by multiple vulnerabilities :

  - Remote attackers may be able to trigger buffer overflow     vulnerabilities on the OpenSSL libraries by sending     specially crafted DER data, resulting in memory     corruption. (CVE-2012-2131)

  - A weakness in the OpenSSL library leaves it vulnerable     to an attack that could allow a third party to recover     (fully or partially) the plaintext from encrypted     traffic. (CVE-2013-0169)

  - A flaw in OCSP signature verification in the OpenSSL     library allows remote OCSP servers to cause a denial of     service condition with an invalid key. (CVE-2013-0166)

Multiple vulnerabilities have been found in OpenSSL. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2012-0884     Ivan Nestlerode discovered a weakness in the CMS and     PKCS #7 implementations that could allow an attacker to     decrypt data via a Million Message Attack (MMA).

  - CVE-2012-1165     It was discovered that a NULL pointer could be     dereferenced when parsing certain S/MIME messages,     leading to denial of service.

  - CVE-2012-2110     Tavis Ormandy, Google Security Team, discovered a     vulnerability in the way DER-encoded ASN.1 data is     parsed that can result in a heap overflow.

Additionally, the fix for CVE-2011-4619 has been updated to address an issue with SGC handshakes.

Tomas Hoger, Red Hat, discovered that the fix for CVE-2012-2110 for the 0.9.8 series of OpenSSL was incomplete. It has been assigned the CVE-2012-2131 identifier.

The remote host is running a version of Mac OS X 10.6 or 10.7 that does not have Security Update 2013-002 applied.  This update contains numerous security-related fixes for the following components :

  - CoreMedia Playback (10.7 only)
  - Directory Service (10.6 only)
  - OpenSSL
  - QuickDraw Manager
  - QuickTime
  - Ruby (10.6 only)
  - SMB (10.7 only)

It was discovered that the fix for CVE-2012-2110 (MDVSA-2012:060) was not sufficient to correct the issue for OpenSSL 0.9.8.

The updated packages have been upgraded to the 0.9.8w version which is not vulnerable to this issue.

According to its self-reported version number, the remote Junos router is using an outdated version of OpenSSL. Parsing malformed ASN.1 encoded data can result in memory corruption. This vulnerability can be triggered by attempting to parse untrusted data (e.g., an X.509 certificate).

The version of OpenSSL running on the remote host is affected by the following vulnerabilities :

  - The implementation of Cryptographic Message Syntax (CMS)     and PKCS #7 in OpenSSL does not properly restrict     certain oracle behavior, which makes it easier for     context-dependent attackers to decrypt data via a     Million Message Attack (MMA) adaptive chosen ciphertext     attack. (CVE-2012-0884)

  - The mime_param_cmp function in crypto/asn1/asn_mime.c in     OpenSSL allows remote attackers to cause a denial of     service (NULL pointer dereference and application crash)     via a crafted S/MIME message, a different vulnerability     than CVE-2006-7250. (CVE-2012-1165)

  - The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c     in OpenSSL does not properly interpret integer data,     which allows remote attackers to conduct buffer overflow     attacks, and cause a denial of service (memory     corruption) or possibly have unspecified other impact,     via crafted DER data, as demonstrated by an X.509     certificate or an RSA public key. (CVE-2012-2110)

  - Multiple integer signedness errors in     crypto/buffer/buffer.c in OpenSSL allow remote attackers     to conduct buffer overflow attacks, and cause a denial     of service (memory corruption) or possibly have     unspecified other impact, via crafted DER data, as     demonstrated by an X.509 certificate or an RSA public     key. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2012-2110. (CVE-2012-2131)

  - Integer underflow in OpenSSL when TLS 1.1, TLS 1.2, or     DTLS is used with CBC encryption, allows remote     attackers to cause a denial of service (buffer over-     read) or possibly have unspecified other impact via a     crafted TLS packet that is not properly handled during a     certain explicit IV calculation. (CVE-2012-2333)

This update of openssl fixes an integer conversation issue which could cause a heap-based memory corruption. (CVE-2012-2110)

Additionally, a check for negative buffer length values was added (CVE-2012-2131) and a memory leak when creating public keys fixed.

ID	Name	Product	Family	Published	Updated	Severity
69987	Junos Pulse Secure IVE / UAC OS Multiple SSL Vulnerabilities	Nessus	Misc.	9/19/2013	12/5/2022	high
58804	Debian DSA-2454-2 : openssl - multiple vulnerabilities	Nessus	Debian Local Security Checks	4/20/2012	1/11/2021	high
66809	Mac OS X Multiple Vulnerabilities (Security Update 2013-002)	Nessus	MacOS X Local Security Checks	6/5/2013	5/28/2024	critical
58865	Mandriva Linux Security Advisory : openssl0.9.8 (MDVSA-2012:064)	Nessus	Mandriva Local Security Checks	4/25/2012	1/6/2021	high
59989	Juniper Junos OpenSSL ASN.1 Memory Corruption (PSN-2012-07-645)	Nessus	Junos Local Security Checks	7/17/2012	7/12/2018	high
73562	AIX OpenSSL Advisory : openssl_advisory4.asc	Nessus	AIX Local Security Checks	4/16/2014	4/21/2023	high
59237	SuSE 10 Security Update : openssl (ZYPP Patch Number 8112)	Nessus	SuSE Local Security Checks	5/23/2012	1/19/2021	high

Detections

Analytics

Plugins Search

high

high

critical

high

high

high

high