Detections
Analytics

HP-UX PHSS_30648 : s700_800 11.04 Virtualvault 4.5 OWS update

medium Nessus Plugin ID 17532

Synopsis

The remote HP-UX host is missing a security-related patch.

Description

s700_800 11.04 Virtualvault 4.5 OWS update :

The remote HP-UX host is affected by multiple vulnerabilities :

 - Two potential security vulnerabilities have been identified in OpenSSL by NISCC (224012/1 and 224012/2).
 The Common Vulnerabilities and Exposures project has referenced them as the following CAN-2004-0079, and CAN-2004-0112. The CERT summary is TA04-078A. 1. The do_change_cipher_spec function in OpenSSL allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that triggers a null dereference.
 CVE-2004-0079 2. The SSL/TLS handshaking, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that causes an out-of-bounds read. CVE-2004-0112. (HPSBUX01019 SSRT4717)

 - A potential security vulnerability has been identified with Apache running on HP-UX where a buffer overflow could be exploited remotely to execute arbitrary code.

 - A potential security vulnerability has been identified with HP-UX running Apache where the vulnerability could be exploited remotely to create a Denial of Service (DoS) or to execute arbitrary code.

 - A potential security vulnerability has been identified with Apache running on HP-UX where the vulnerability could be exploited remotely to create a Denial of Service (DoS) or to bypass access restrictions.

Solution

Install patch PHSS_30648 or subsequent.

See Also

http://www.nessus.org/u?6195bc72

Plugin Details

Severity: Medium

ID: 17532

File Name: hpux_PHSS_30648.nasl

Version: 1.17

Type: local

Published: 3/18/2005

Updated: 1/11/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: cpe:/o:hp:hp-ux

Required KB Items: Host/local_checks_enabled, Host/HP-UX/version, Host/HP-UX/swlist

Patch Publication Date: 6/29/2004

Reference Information

CVE: CVE-2003-0020, CVE-2004-0079, CVE-2004-0112, CVE-2004-0113, CVE-2004-0174

HP: HPSBUX01019, HPSBUX01057, HPSBUX01068, HPSBUX01069, SSRT4717, emr_na-c00944046