Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

[R2] Nessus 6.10 Fixes Multiple Third-party Library Vulnerabilities

Critical

Synopsis

Nessus 6.9.0 - 6.9.3 is possibly impacted by multiple vulnerabilities reported in OpenSSL. Tenable has not investigated each one to determine if it is exploitable or the vulnerable code path can be reached. Instead, Dev has upgraded the impacted libraries as a faster and safer alternative. Due to the possibility of impacting Nessus users, we strongly encourage you to upgrade.

The following vulnerabilities have been resolved with the updated libraries.

  • OpenSSL crypto/bn/asm/x86_64-mont5.pl Montgomery Squaring Procedure BN_mod_exp Incorrect Results Private Key Derivation Weakness (VulnDB 151020 / CVE-2017-3732)
  • OpenSSL crypto/evp/e_chacha20_poly1305.c CHACHA20-POLY1305 Cipher Packet Handling Out-of-bounds Read Remote DoS (VulnDB 151018 / 2017-3731)
  • OpenSSL crypto/bn/asm/x86_64-mont.pl Montgomery Multiplication Incorrect Results Weakness (VulnDB 147021 / CVE-2016-7055)

Nessus 6.5.0 - 6.9.3 is possibly impacted by multiple vulnerabilities reported in Libxml2. Tenable has not investigated each one to determine if it is exploitable or the vulnerable code path can be reached. Instead, Dev has upgraded the impacted libraries as a faster and safer alternative. Due to the number of library issues and the potential for any of these issues to impact Nessus users, we strongly encourage you to upgrade. Note that two of these issues do not have CVE assignments.

  • Libxml2 parser.c XML Handling Unspecified Issue (VulnDB 130538 / CVE-2015-7499)
  • Libxml2 parser.c Entity Boundary Handling Unspecified Memory Access Issue (VulnDB 130539 / CVE-2015-7500)
  • Libxml2 dict.c xmlDictComputeFastQKey() Function Heap Buffer Overflow (VulnDB 130535 / CVE-2015-7497)
  • Libxml2 parser.c Unspecified XML External Entity (XXE) Injection Issue (VulnDB 130536 / CVE-2015-5312)
  • Libxml2 Encoding Conversion Failure Entity Processing Unspecified Issue (VulnDB 130543 / CVE-2015-7498)
  • Libxml2 xzlib.c xz_decomp() Function Infinite Loop DoS Weakness (VulnDB 129696 / CVE-2015-8035)
  • Libxml2 SAX2.c xmlSAX2TextNode() Function Out-of-bounds Read Issue (VulnDB 130292 / CVE-2015-8242)
  • Libxml2 parser.c xmlParseMarkupDecl() Function Out-of-bounds Read Issue (VulnDB 130435 / CVE-2015-8241)
  • Libxml2 parser.c xmlParseEncodingDecl() Function Encoding Value Handling Out-of-bounds Read Issue (VulnDB 130641 / CVE-2015-8317)
  • Libxml2 parser.c xmlParseEncodingDecl() Function Input Stream Conversion Handling Out-of-bounds Read Issue (VulnDB 130642 / CVE-2015-8317)
  • Libxml2 XML External Entity (XXE) Expansion Resource Exhaustion Remote DoS (VulnDB 120600 / CVE-2015-1819)
  • Libxml2 parser.c xmlParseConditionalSections() Function Out-of-bounds Read Issue (VulnDB 121175 / CVE-2015-7941 / CVE-2015-7942)
  • Libxml2 Multiple Functionality Format Strings (VulnDB 138966 / CVE-2016-4448)
  • Libxml2 parser.c xmlParseElementDecl() / xmlParseConditionalSections() Functions Out-of-bounds Read Issue (VulnDB 138928 / CVE-2016-4447)
  • Libxml2 parser.c xmlStringLenDecodeEntities() Function Unspecified XML External Entity (XXE) Injection Issue (VulnDB 138926 / CVE-2016-4449)
  • Libxml2 xmlregexp.c xmlFAParseCharRange() Function Heap Buffer Overflow (VulnDB 138572 / CVE-2016-1840)
  • Libxml2 parser.c xmlParseStartTag2() Function Heap Use-after-free (VulnDB 138567 / CVE-2016-1835)
  • Libxml2 xmlstring.c xmlStrncatNew() Function Heap Buffer Overflow (VulnDB 138566 / CVE-2016-1834)
  • Libxml2 parser.c xmlParseNCNameComplex() Function Heap Use-after-free (VulnDB 138568 / CVE-2016-1836)
  • Libxml2 HTMLparser.c htmlParseSystemLiteral() / htmlParsePubidLiteral() Functions Heap Buffer Overflow (VulnDB 138569 / CVE-2016-1837)
  • Libxml2 xmlsave.c xmlBufAttrSerializeTxtContent() Function Recover Mode XML Content Handling Out-of-bounds Read Issue (VulnDB 137965 / CVE-2016-4483)
  • Libxml2 parser.c Multiple Function Recursive xmlStringDecodeEntities() Call Handling Stack Overflow DoS (VulnDB 137962 / CVE-2016-3705)
  • Libxml2 HTMLparser.c htmlParseName() / htmlParseNameComplex() Functions Out-of-bounds Read Issue (VulnDB 134833 / CVE-2016-1839)
  • Libxml2 parser.c xmlParserEntityCheck() Function Recovery Mode XML Content Parsing Recursion DoS (VulnDB 136194 / CVE-2016-3627)
  • Libxml2 parser.c xmlParseEndTag2() Function Out-of-bounds Read Issue (VulnDB 130651 / CVE-2016-1838 / CVE-2016-1695)
  • Libxml2 parserInternals.c xmlNextChar() Function Out-of-bounds Read Issue (VulnDB 130653 / CVE-2016-1833)
  • Libxml2 uri.c xmlParse3986Port() Function Port Argument Handling Integer Overflow Unspecified Issue (VulnDB 138921)
  • Libxml2 HTMLparser.c htmlParseNameComplex() Function HTML File Encoding Detection Failure (VulnDB 138927)

Please note that Tenable strongly recommends that Nessus be installed on a subnet that is not Internet addressable.

Solution

Tenable has released Nessus version 6.10 that corresponds to the supported operating systems and architectures. To update your Nessus installation, follow these steps:

This page contains information regarding security vulnerabilities that may impact Tenable's products. This may include issues specific to our software, or due to the use of third-party libraries within our software. Tenable strongly encourages users to ensure that they upgrade or apply relevant patches in a timely manner.

Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.

For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.

If you have questions or corrections about this advisory, please email [email protected]