The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages from clients, which allows remote attackers to cause a denial of service (daemon crash) via out-of-order messages that violate the TLS protocol.

According to the versions of the openssl098e package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The DTLS implementation in OpenSSL before 1.1.0 does     not properly restrict the lifetime of queue entries     associated with unused out-of-order messages, which     allows remote attackers to cause a denial of service     (memory consumption) by maintaining many crafted DTLS     sessions simultaneously, related to d1_lib.c,     statem_dtls.c, statem_lib.c, and     statem_srvr.c.(CVE-2016-2179)

  - OpenSSL before 0.9.8s and 1.x before 1.0.0f, when RFC     3779 support is enabled, allows remote attackers to     cause a denial of service (assertion failure) via an     X.509 certificate containing certificate-extension data     associated with (1) IP address blocks or (2) Autonomous     System (AS) identifiers.(CVE-2011-4577)

  - Memory leak in the dtls1_buffer_record function in     d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1     before 1.0.1k allows remote attackers to cause a denial     of service (memory consumption) by sending many     duplicate records for the next epoch, leading to     failure of replay detection.(CVE-2015-0206)

  - The ephemeral ECDH ciphersuite functionality in OpenSSL     0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not     ensure thread safety during processing of handshake     messages from clients, which allows remote attackers to     cause a denial of service (daemon crash) via     out-of-order messages that violate the TLS     protocol.(CVE-2011-3210)

  - The X509_NAME_oneline function in     crypto/x509/x509_obj.c in OpenSSL before 1.0.1t and     1.0.2 before 1.0.2h allows remote attackers to obtain     sensitive information from process stack memory or     cause a denial of service (buffer over-read) via     crafted EBCDIC ASN.1 data.(CVE-2016-2176)

  - The ssl3_get_cert_verify function in s3_srvr.c in     OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k     accepts client authentication with a Diffie-Hellman     (DH) certificate without requiring a CertificateVerify     message, which allows remote attackers to obtain access     without knowledge of a private key via crafted TLS     Handshake Protocol traffic to a server that recognizes     a Certification Authority with DH     support.(CVE-2015-0205)

  - The ssl3_get_key_exchange function in s3_clnt.c in     OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1     before 1.0.1k allows remote SSL servers to conduct     ECDHE-to-ECDH downgrade attacks and trigger a loss of     forward secrecy by omitting the ServerKeyExchange     message.(CVE-2014-3572)

  - Memory leak in d1_both.c in the DTLS implementation in     OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and     1.0.1 before 1.0.1i allows remote attackers to cause a     denial of service (memory consumption) via zero-length     DTLS fragments that trigger improper handling of the     return value of a certain insert     function.(CVE-2014-3507)

  - The ssl23_get_client_hello function in s23_srvr.c in     OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle     attackers to force the use of TLS 1.0 by triggering     ClientHello message fragmentation in communication     between a client and server that both support later TLS     versions, related to a 'protocol downgrade'     issue.(CVE-2014-3511)

  - The ssl3_send_client_key_exchange function in s3_clnt.c     in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and     1.0.1 before 1.0.1h, when an anonymous ECDH cipher     suite is used, allows remote attackers to cause a     denial of service (NULL pointer dereference and client     crash) by triggering a NULL certificate     value.(CVE-2014-3470)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

OpenSSL's internal certificate verification routines could incorrectly accept a CRL whose nextUpdate field is in the past (CVE-2011-3207).

Server code for ECDH could crash if it received a specially crafted handshake message (CVE-2011-3210).

The remote host is running a version of Mac OS X 10.8 that is older than 10.8.4. The newer version contains numerous security-related fixes :

  - A local security-bypass vulnerability exists that affects the Disk Management component. The issue can be exploited by an unauthorized attacker to disable FileVault using the command-line. (CVE-2013-0985)

  - A security-bypass vulnerability in SMB file sharing can occur whereby an authenticated attacker can write files outside the shared directory. (CVE-2013-0990)

  - A remote buffer-overflow vulnerability exists when handling certain PICT images. (CVE-2013-0975)

  - A security-bypass vulnerability exists whereby an attacker with access to a user's session may be able to log into previously accessed sites. An attacker can exploit this issue even if Private Browsing was used. (CVE-2013-0982)

  - A remote-code execution issue affects the text glyphs because of an unbounded stack allocation when handling maliciously crafted URLs. (CVE-2013-0983)

  - A remote-code execution vulnerability exists due to improper handling of text tracks. (CVE-2013-1024)

  - A buffer-overflow vulnerability exists in the Directory Service daemon that can be exploited via a specially crafted network message. (CVE-2013-0984)

The remote host is running a version of Mac OS X 10.6 or 10.7 that does not have Security Update 2013-002 applied.  This update contains numerous security-related fixes for the following components :

  - CoreMedia Playback (10.7 only)
  - Directory Service (10.6 only)
  - OpenSSL
  - QuickDraw Manager
  - QuickTime
  - Ruby (10.6 only)
  - SMB (10.7 only)

The remote host is running a version of Mac OS X 10.8.x that is prior to 10.8.4. The newer version contains multiple security-related fixes for the following components :

  - CFNetwork
  - CoreAnimation
  - CoreMedia Playback
  - CUPS
  - Disk Management
  - OpenSSL
  - QuickDraw Manager
  - QuickTime
  - SMB

According to the web server's banner, the version of HP System Management Homepage (SMH) hosted on the remote host is earlier than 7.0.  As such, it is reportedly affected by the following vulnerabilities :

 - An error exists in the 'generate-id' function in the    bundled libxslt library that can allow disclosure of    heap memory addresses. (CVE-2011-0195)

 - An unspecified input validation error exists and can    allow cross-site request forgery attacks. (CVE-2011-3846)

 - Unspecified errors can allow attackers to carry out    denial of service attacks via unspecified vectors.
   (CVE-2012-0135, CVE-2012-1993)

 - The bundled version of PHP contains multiple    vulnerabilities. (CVE-2010-3436, CVE-2010-4409,    CVE-2010-4645, CVE-2011-1148, CVE-2011-1153,    CVE-2011-1464, CVE-2011-1467, CVE-2011-1468,    CVE-2011-1470, CVE-2011-1471, CVE-2011-1938,    CVE-2011-2202, CVE-2011-2483, CVE-2011-3182,    CVE-2011-3189, CVE-2011-3267, CVE-2011-3268)

 - The bundled version of Apache contains multiple    vulnerabilities. (CVE-2010-1452, CVE-2010-1623,    CVE-2010-2068,  CVE-2010-2791, CVE-2011-0419,    CVE-2011-1928, CVE-2011-3192, CVE-2011-3348,    CVE-2011-3368, CVE-2011-3639)

 - OpenSSL libraries are contained in several of the    bundled components and contain multiple vulnerabilities.
   (CVE-2011-0014, CVE-2011-1468, CVE-2011-1945,    CVE-2011-3207,CVE-2011-3210)

 - Curl libraries are contained in several of the bundled    components and contain multiple vulnerabilities.
   (CVE-2009-0037, CVE-2010-0734, CVE-2011-2192)

It was discovered that the elliptic curve cryptography (ECC) subsystem in OpenSSL, when using the Elliptic Curve Digital Signature Algorithm (ECDSA) for the ECDHE_ECDSA cipher suite, did not properly implement curves over binary fields. This could allow an attacker to determine private keys via a timing attack. This issue only affected Ubuntu 8.04 LTS, Ubuntu 10.04 LTS, Ubuntu 10.10 and Ubuntu 11.04. (CVE-2011-1945)

Adam Langley discovered that the ephemeral Elliptic Curve Diffie-Hellman (ECDH) functionality in OpenSSL did not ensure thread safety while processing handshake messages from clients. This could allow a remote attacker to cause a denial of service via out-of-order messages that violate the TLS protocol. This issue only affected Ubuntu 8.04 LTS, Ubuntu 10.04 LTS, Ubuntu 10.10 and Ubuntu 11.04.
(CVE-2011-3210)

Nadhem Alfardan and Kenny Paterson discovered that the Datagram Transport Layer Security (DTLS) implementation in OpenSSL performed a MAC check only if certain padding is valid. This could allow a remote attacker to recover plaintext. (CVE-2011-4108)

Antonio Martin discovered that a flaw existed in the fix to address CVE-2011-4108, the DTLS MAC check failure. This could allow a remote attacker to cause a denial of service. (CVE-2012-0050)

Ben Laurie discovered a double free vulnerability in OpenSSL that could be triggered when the X509_V_FLAG_POLICY_CHECK flag is enabled.
This could allow a remote attacker to cause a denial of service. This issue only affected Ubuntu 8.04 LTS, Ubuntu 10.04 LTS, Ubuntu 10.10 and Ubuntu 11.04. (CVE-2011-4109)

It was discovered that OpenSSL, in certain circumstances involving ECDH or ECDHE cipher suites, used an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves. This could allow a remote attacker to obtain the private key of a TLS server via multiple handshake attempts. This issue only affected Ubuntu 8.04 LTS. (CVE-2011-4354)

Adam Langley discovered that the SSL 3.0 implementation in OpenSSL did not properly initialize data structures for block cipher padding. This could allow a remote attacker to obtain sensitive information.
(CVE-2011-4576)

Andrew Chi discovered that OpenSSL, when RFC 3779 support is enabled, could trigger an assert when handling an X.509 certificate containing certificate-extension data associated with IP address blocks or Autonomous System (AS) identifiers. This could allow a remote attacker to cause a denial of service. (CVE-2011-4577)

Adam Langley discovered that the Server Gated Cryptography (SGC) implementation in OpenSSL did not properly handle handshake restarts.
This could allow a remote attacker to cause a denial of service.
(CVE-2011-4619)

Andrey Kulikov discovered that the GOST block cipher engine in OpenSSL did not properly handle invalid parameters. This could allow a remote attacker to cause a denial of service via crafted data from a TLS client. This issue only affected Ubuntu 11.10. (CVE-2012-0027).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Server code for ECDH could have crashed if it received a specially crafted handshake message (CVE-2011-3210). This has been fixed.

The remote host is affected by the vulnerability described in GLSA-201110-01 (OpenSSL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenSSL. Please review       the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could cause a Denial of Service, possibly       execute arbitrary code, bypass intended key requirements, force the       downgrade to unintended ciphers, bypass the need for knowledge of shared       secrets and successfully authenticate, bypass CRL validation, or obtain       sensitive information in applications that use OpenSSL.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities has been discovered and corrected in openssl :

The elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm (ECDSA) is used for the ECDHE_ECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine private keys via a timing attack and a lattice calculation (CVE-2011-1945).

crypto/x509/x509_vfy.c in OpenSSL 1.0.x before 1.0.0e does not initialize certain structure members, which makes it easier for remote attackers to bypass CRL validation by using a nextUpdate value corresponding to a time in the past (CVE-2011-3207).

The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8s and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages, which allows remote attackers to cause a denial of service (application crash) via out-of-order messages that violate the TLS protocol (CVE-2011-3210).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct these issues.

The version of OpenSSL installed on the remote host is prior to 1.0.0e. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.0e advisory.

  - The BN_GF2m_mod_inv function in crypto/bn/bn_gf2m.c in OpenSSL before 0.9.8s, 1.0.0 before 1.0.0e, 1.0.1     before 1.0.1n, and 1.0.2 before 1.0.2b does not properly handle ECParameters structures in which the curve     is over a malformed binary polynomial field, which allows remote attackers to cause a denial of service     (infinite loop) via a session that uses an Elliptic Curve algorithm, as demonstrated by an attack against     a server that supports client authentication. (CVE-2015-1788)

  - The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does     not ensure thread safety during processing of handshake messages from clients, which allows remote     attackers to cause a denial of service (daemon crash) via out-of-order messages that violate the TLS     protocol. (CVE-2011-3210)

  - crypto/x509/x509_vfy.c in OpenSSL 1.0.x before 1.0.0e does not initialize certain structure members, which     makes it easier for remote attackers to bypass CRL validation by using a nextUpdate value corresponding to     a time in the past. (CVE-2011-3207)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

OpenSSL Team reports :

Two security flaws have been fixed in OpenSSL 1.0.0e

Under certain circumstances OpenSSL's internal certificate verification routines can incorrectly accept a CRL whose nextUpdate field is in the past. (CVE-2011-3207)

OpenSSL server code for ephemeral ECDH ciphersuites is not thread-safe, and furthermore can crash if a client violates the protocol by sending handshake messages in incorrect order.
(CVE-2011-3210)

Versions of OpenSSL 1.0.0 earlier than and 1.0.0e are potentially affected by the following vulnerabilities : 

  - An error exists in the internal certificate verification process that can allow improper acceptance of a certificate revolcation list (CRL) if the lists's 'nextUpdate' field contains a date in teh past.  Note that this internal CRL checking is not enabled by defaut. (CVE-2011-3207)

  - An error exists in the code for the ephemeral (EC)DH ciphersuites that can allow a remote attacker to crash the process. (CVE-2011-3210)

ID	Name	Product	Family	Severity
137479	EulerOS 2.0 SP2 : openssl098e (EulerOS-SA-2020-1637)	Nessus	Huawei Local Security Checks	high
75907	openSUSE Security Update : libopenssl-devel (openSUSE-SU-2011:1144-1)	Nessus	SuSE Local Security Checks	medium
75597	openSUSE Security Update : libopenssl-devel (openSUSE-SU-2011:1144-1)	Nessus	SuSE Local Security Checks	medium
801016	Mac OS X 10.8 < 10.8.4 Multiple Vulnerabilities (Security Update 2013-002)	Log Correlation Engine	Operating System Detection	high
6857	Mac OS X 10.8 < 10.8.4 Multiple Vulnerabilities (Security Update 2013-002)	Nessus Network Monitor	Web Clients	critical
66809	Mac OS X Multiple Vulnerabilities (Security Update 2013-002)	Nessus	MacOS X Local Security Checks	critical
66808	Mac OS X 10.8.x < 10.8.4 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
58811	HP System Management Homepage < 7.0 Multiple Vulnerabilities	Nessus	Web Servers	critical
57887	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : openssl vulnerabilities (USN-1357-1)	Nessus	Ubuntu Local Security Checks	high
57235	SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 7760)	Nessus	SuSE Local Security Checks	medium
57116	SuSE 11.1 Security Update : libopenssl (SAT Patch Number 5160)	Nessus	SuSE Local Security Checks	medium
56612	SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 7766)	Nessus	SuSE Local Security Checks	medium
56425	GLSA-201110-01 : OpenSSL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
56325	Mandriva Linux Security Advisory : openssl (MDVSA-2011:137)	Nessus	Mandriva Local Security Checks	medium
56162	OpenSSL 1.0.0 < 1.0.0e Multiple Vulnerabilities	Nessus	Web Servers	medium
56117	FreeBSD : OpenSSL -- multiple vulnerabilities (2ecb7b20-d97e-11e0-b2e2-00215c6a37bb)	Nessus	FreeBSD Local Security Checks	medium
801065	OpenSSL 1.x < 1.0.0e Multiple Vulnerabilities	Log Correlation Engine	Web Servers	medium
6022	OpenSSL 1.x < 1.0.0e Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2011-3210

high

Tenable Plugins

high

medium

medium

high

critical

critical

high

critical

high

medium

medium

medium

critical

medium

medium

medium

medium

medium