According to its banner, the version of HP System Management Homepage (SMH) hosted on the remote web server is affected by the following vulnerabilities :

  - A denial of service vulnerability exists in the Apache     HTTP Server due to the lack of the mod_reqtimeout     module. An unauthenticated, remote attacker can exploit     this, via a saturation of partial HTTP requests, to     cause a daemon outage. (CVE-2007-6750)

  - A cross-site scripting (XSS) vulnerability exists in     jQuery when using location.hash to select elements. An     unauthenticated, remote attacker can exploit this, via     a specially crafted tag, to inject arbitrary script     code or HTML into the user's browser session.
    (CVE-2011-4969)

  - A NULL pointer dereference flaw exists in file     rsa_ameth.c due to improper handling of ASN.1 signatures     that are missing the PSS parameter. A remote attacker     can exploit this to cause the signature verification     routine to crash, resulting in a denial of service     condition. (CVE-2015-3194)

  - A flaw exists in the ASN1_TFLG_COMBINE implementation in     file tasn_dec.c related to handling malformed     X509_ATTRIBUTE structures. A remote attacker can exploit     this to cause a memory leak by triggering a decoding     failure in a PKCS#7 or CMS application, resulting in a     denial of service. (CVE-2015-3195)

  - An out-of-bounds read error exists in cURL and libcurl     within the smb_request_state() function due to improper     bounds checking. An unauthenticated, remote attacker     can exploit this, using a malicious SMB server and     crafted length and offset values, to disclose sensitive     memory information or to cause a denial of service     condition. (CVE-2015-3237)

  - A flaw exists in libxslt in the xsltStylePreCompute()     function within file preproc.c due to a failure to check     if the parent node is an element. An unauthenticated,     remote attacker can exploit this, via a specially     crafted XML file, to cause a denial of service     condition. (CVE-2015-7995)

  - An infinite loop condition exists in the xz_decomp()     function within file xzlib.c when handling xz compressed     XML content due to a failure to detect compression     errors. An unauthenticated, remote attacker can exploit     this, via specially crafted XML data, to cause a denial     of service condition. (CVE-2015-8035)

  - A double-free error exists due to improper validation of     user-supplied input when parsing malformed DSA private     keys. A remote attacker can exploit this to corrupt     memory, resulting in a denial of service condition or     the execution of arbitrary code. (CVE-2016-0705)

  - An out-of-bounds read error exists in the fmtstr()     function within file crypto/bio/b_print.c when printing     very long strings due to a failure to properly calculate     string lengths. An unauthenticated, remote attacker can     exploit this, via a long string, to cause a denial of     service condition, as demonstrated by a large amount of     ASN.1 data. (CVE-2016-0799)

  - An unspecified flaw exists that allows a local attacker     to impact the confidentiality and integrity of the     system. No other details are available. (CVE-2016-2015)

  - A flaw exists in the doapr_outch() function within file     crypto/bio/b_print.c due to a failure to verify that a     certain memory allocation succeeds. An unauthenticated,     remote attacker can exploit this, via a long string,     to cause a denial of service condition, as demonstrated     by a large amount of ASN.1 data. (CVE-2016-2842)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2830-1 advisory.

    Guy Leaver discovered that OpenSSL incorrectly handled a ServerKeyExchange for an anonymous DH ciphersuite     with the value of p set to 0. A remote attacker could possibly use this issue to cause OpenSSL to crash,     resulting in a denial of service. This issue only applied to Ubuntu 15.10. (CVE-2015-1794)

    Hanno Bck discovered that the OpenSSL Montgomery squaring procedure algorithm may produce incorrect     results when being used on x86_64. A remote attacker could possibly use this issue to break encryption.
    This issue only applied to Ubuntu 15.10. (CVE-2015-3193)

    Loc Jonas Etienne discovered that OpenSSL incorrectly handled ASN.1 signatures with a missing PSS     parameter. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a     denial of service. (CVE-2015-3194)

    Adam Langley discovered that OpenSSL incorrectly handled malformed X509_ATTRIBUTE structures. A remote     attacker could possibly use this issue to cause OpenSSL to consume resources, resulting in a denial of     service. (CVE-2015-3195)

    It was discovered that OpenSSL incorrectly handled PSK identity hints. A remote attacker could possibly     use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only applied to     Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-3196)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New openssl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

OpenSSL was update to fix security issues and bugs :

CVE-2016-0800 aka the 'DROWN' attack (bsc#968046): OpenSSL was vulnerable to a cross-protocol attack that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. This update changes the OpenSSL library to :

Disable SSLv2 protocol support by default. This can be overridden by setting the environment variable 'OPENSSL_ALLOW_SSL2' or by using SSL_CTX_clear_options using the SSL_OP_NO_SSLv2 flag. Note that various services and clients had already disabled SSL protocol 2 by default previously.

Disable all weak EXPORT ciphers by default. These can be re-enabled if required by old legacy software using the environment variable 'OPENSSL_ALLOW_EXPORT'.

CVE-2016-0797 (bsc#968048): The BN_hex2bn() and BN_dec2bn() functions had a bug that could result in an attempt to de-reference a NULL pointer leading to crashes. This could have security consequences if these functions were ever called by user applications with large untrusted hex/decimal data. Also, internal usage of these functions in OpenSSL uses data from config files or application command line arguments. If user developed applications generated config file data based on untrusted data, then this could have had security consequences as well.

CVE-2016-0799 (bsc#968374): On many 64 bit systems, the internal fmtstr() and doapr_outch() functions could miscalculate the length of a string and attempt to access out-of-bounds memory locations. These problems could have enabled attacks where large amounts of untrusted data is passed to the BIO_*printf functions. If applications use these functions in this way then they could have been vulnerable. OpenSSL itself uses these functions when printing out human-readable dumps of ASN.1 data. Therefore applications that print this data could have been vulnerable if the data is from untrusted sources. OpenSSL command line applications could also have been vulnerable when they print out ASN.1 data, or if untrusted data is passed as command line arguments.
Libssl is not considered directly vulnerable.

CVE-2015-3197 (bsc#963415): The SSLv2 protocol did not block disabled ciphers.

CVE-2015-3195 (bsc#957812): An X509_ATTRIBUTE memory leak was fixed.

Fixed a regression caused by the openssl-CVE-2015-0287.patch (bsc#937492)

Note that the March 1st 2016 release also references following CVEs that were fixed by us with CVE-2015-0293 in 2015 :

CVE-2016-0703 (bsc#968051): This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above 'DROWN' attack much easier.

CVE-2016-0704 (bsc#968053): 'Bleichenbacher oracle in SSLv2' This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above 'DROWN' attack much easier.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X version 10.11.x prior to 10.11.4 and is affected by multiple vulnerabilities in the following components :

 - apache_mod_php
 - AppleRAID
 - AppleUSBNetworking
 - Bluetooth
 - Carbon
 - dyld
 - FontParser
 - HTTPProtocol
 - Intel Graphics Driver
 - IOFireWireFamily
 - IOGraphics
 - IOHIDFamily
 - IOUSBFamily
 - Kernel
 - libxml2
 - Messages
 - NVIDIA Graphics Drivers
 - OpenSSH
 - OpenSSL
 - Python
 - QuickTime
 - Reminders
 - Ruby
 - Security
 - Tcl
 - TrueTypeScaler
 - Wi-Fi

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The version of MySQL installed on the remote host is 5.5.x prior to 5.5.48, 5.6.x prior to 5.6.29, or 5.7.x prior to 5.7.11, and is affected by vulnerabilities in the following components :

 - Data Manipulation Language
 - Data Definition Language
 - Full-Text Search
 - MyISAM
 - PeopleSoft
 - Performance Schema
 - Pluggable Authentication
 - Replication
 - Server Connection
 - Server:Security
 - Server:InnoDB
 - Server:Optimizer
 - Server:Options


The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	Name	Product	Family	Published	Updated	Severity
91222	HP System Management Homepage Multiple Vulnerabilities (HPSBMU03593)	Nessus	Web Servers	5/18/2016	4/11/2022	critical
87236	Ubuntu 14.04 LTS : OpenSSL vulnerabilities (USN-2830-1)	Nessus	Ubuntu Local Security Checks	12/8/2015	8/27/2024	high
87378	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : openssl (SSA:2015-349-04)	Nessus	Slackware Local Security Checks	12/16/2015	1/14/2021	high
89731	SUSE SLES10 Security Update : OpenSSL (SUSE-SU-2016:0678-1) (DROWN)	Nessus	SuSE Local Security Checks	3/8/2016	1/6/2021	critical
9327	Mac OS X 10.11.x < 10.11.4 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	5/27/2016	3/6/2019	critical
9259	Oracle MySQL 5.5.x < 5.5.48 / 5.6.x < 5.6.29 / 5.7.x < 5.7.11 Multiple Vulnerabilities	Nessus Network Monitor	Database	4/18/2016	3/6/2019	medium
503118	Siemens SCALANCE X-200RNA Switch Devices Exposure of Sensitive Information to an Unauthorized Actor (CVE-2015-3195)	Tenable OT Security	Tenable.ot	3/13/2025	3/13/2025	medium

Detections

Analytics

Plugins Search

critical

high

high

critical

critical

medium

medium