The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - openssl: doapr_outch function does not verify that certain memory allocation succeeds (CVE-2016-2842)

  - OpenSSL before 0.9.8j, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not prevent     modification of the ciphersuite in the session cache, which allows remote attackers to force the use of a     disabled cipher via vectors involving sniffing network traffic to discover a session identifier, a     different vulnerability than CVE-2010-4180. (CVE-2008-7270)

  - OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled,     does not properly prevent modification of the ciphersuite in the session cache, which allows remote     attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to     discover a session identifier. (CVE-2010-4180)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - openssl: doapr_outch function does not verify that certain memory allocation succeeds (CVE-2016-2842)

  - The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and     1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via     a DTLS hello message in an invalid DTLS handshake. (CVE-2014-0221)

  - The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n,     and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of '\0' characters,     which allows context-dependent attackers to obtain sensitive information from process stack memory by     reading output from X509_name_oneline, X509_name_print_ex, and unspecified other functions.
    (CVE-2014-3508)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the openssl098e package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The Anti-Replay feature in the DTLS implementation in     OpenSSL before 1.1.0 mishandles early use of a new     epoch number in conjunction with a large sequence     number, which allows remote attackers to cause a denial     of service (false-positive packet drops) via spoofed     DTLS records, related to rec_layer_d1.c and     ssl3_record.c.(CVE-2016-2181)

  - The DES and Triple DES ciphers, as used in the TLS,     SSH, and IPSec protocols and other protocols and     products, have a birthday bound of approximately four     billion blocks, which makes it easier for remote     attackers to obtain cleartext data via a birthday     attack against a long-duration encrypted session, as     demonstrated by an HTTPS session using Triple DES in     CBC mode, aka a 'Sweet32' attack.(CVE-2016-2183)

  - The dtls1_clear_queues function in ssl/d1_lib.c in     OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1     before 1.0.1h frees data structures without considering     that application data can arrive between a     ChangeCipherSpec message and a Finished message, which     allows remote DTLS peers to cause a denial of service     (memory corruption and application crash) or possibly     have unspecified other impact via unexpected     application data.(CVE-2014-8176)

  - The TLS protocol 1.2 and earlier, when a DHE_EXPORT     ciphersuite is enabled on a server but not on a client,     does not properly convey a DHE_EXPORT choice, which     allows man-in-the-middle attackers to conduct     cipher-downgrade attacks by rewriting a ClientHello     with DHE replaced by DHE_EXPORT and then rewriting a     ServerHello with DHE_EXPORT replaced by DHE, aka the     'Logjam' issue.(CVE-2015-4000)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the openssl098e package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The OpenSSL toolkit provides support for secure     communications between machines. OpenSSL includes a     certificate management tool and shared libraries which     provide various cryptographic algorithms and     protocols.Security Fix(es):The TLS protocol 1.2 and     earlier, when a DHE_EXPORT ciphersuite is enabled on a     server but not on a client, does not properly convey a     DHE_EXPORT choice, which allows man-in-the-middle     attackers to conduct cipher-downgrade attacks by     rewriting a ClientHello with DHE replaced by DHE_EXPORT     and then rewriting a ServerHello with DHE_EXPORT     replaced by DHE, aka the 'Logjam'     issue.(CVE-2015-4000)The dsa_sign_setup function in     crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does     not properly ensure the use of constant-time     operations, which makes it easier for local users to     discover a DSA private key via a timing side-channel     attack.(CVE-2016-2178)While parsing an IPAddressFamily     extension in an X.509 certificate, it is possible to do     a one-byte overread. This would result in an incorrect     text display of the certificate. This bug has been     present since 2006 and is present in all versions of     OpenSSL before 1.0.2m and 1.1.0g.(CVE-2017-3735)The     Anti-Replay feature in the DTLS implementation in     OpenSSL before 1.1.0 mishandles early use of a new     epoch number in conjunction with a large sequence     number, which allows remote attackers to cause a denial     of service (false-positive packet drops) via spoofed     DTLS records, related to rec_layer_d1.c and     ssl3_record.c.(CVE-2016-2181)The SSL protocol 3.0, as     used in OpenSSL through 1.0.1i and other products, uses     nondeterministic CBC padding, which makes it easier for     man-in-the-middle attackers to obtain cleartext data     via a padding-oracle attack, aka the 'POODLE'     issue.(CVE-2014-3566)OpenStack Identity (Keystone)     before 2014.1.1 does not properly handle when a role is     assigned to a group that has the same ID as a user,     which allows remote authenticated users to gain     privileges that are assigned to a group with the same     ID.(CVE-2014-0204)Double free vulnerability in     d1_both.c in the DTLS implementation in OpenSSL 0.9.8     before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before     1.0.1i allows remote attackers to cause a denial of     service (application crash) via crafted DTLS packets     that trigger an error     condition.(CVE-2014-3505)d1_both.c in the DTLS     implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0     before 1.0.0n, and 1.0.1 before 1.0.1i allows remote     attackers to cause a denial of service (memory     consumption) via crafted DTLS handshake messages that     trigger memory allocations corresponding to large     length values.(CVE-2014-3506)The BN_sqr implementation     in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and     1.0.1 before 1.0.1k does not properly calculate the     square of a BIGNUM value, which might make it easier     for remote attackers to defeat cryptographic protection     mechanisms via unspecified vectors, related to     crypto/bn/asm/mips.pl, crypto/bn/asm/x86_64-gcc.c, and     crypto/bn/bn_asm.c.(CVE-2014-3570)The OBJ_obj2txt     function in crypto/objects/obj_dat.c in OpenSSL 0.9.8     before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before     1.0.1i, when pretty printing is used, does not ensure     the presence of '\0' characters, which allows     context-dependent attackers to obtain sensitive     information from process stack memory by reading output     from X509_name_oneline, X509_name_print_ex, and     unspecified other functions.(CVE-2014-3508)The     dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL     before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before     1.0.1h frees data structures without considering that     application data can arrive between a ChangeCipherSpec     message and a Finished message, which allows remote     DTLS peers to cause a denial of service (memory     corruption and application crash) or possibly have     unspecified other impact via unexpected application     data.(CVE-2014-8176)The DES and Triple DES ciphers, as     used in the TLS, SSH, and IPSec protocols and other     protocols and products, have a birthday bound of     approximately four billion blocks, which makes it     easier for remote attackers to obtain cleartext data     via a birthday attack against a long-duration encrypted     session, as demonstrated by an HTTPS session using     Triple DES in CBC mode, aka a 'Sweet32'     attack.(CVE-2016-2183)The ASN1_item_ex_d2i function in     crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0     before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before     1.0.2a does not reinitialize CHOICE and ADB data     structures, which might allow attackers to cause a     denial of service (invalid write operation and memory     corruption) by leveraging an application that relies on     ASN.1 structure reuse.(CVE-2015-0287)The     dtls1_get_message_fragment function in d1_both.c in     OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1     before 1.0.1h allows remote attackers to cause a denial     of service (recursion and client crash) via a DTLS     hello message in an invalid DTLS     handshake.(CVE-2014-0221)The     ssl3_send_client_key_exchange function in s3_clnt.c in     OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and     1.0.1 before 1.0.1i allows remote DTLS servers to cause     a denial of service (NULL pointer dereference and     client application crash) via a crafted handshake     message in conjunction with a (1) anonymous DH or (2)     anonymous ECDH ciphersuite.(CVE-2014-3510)The     X509_to_X509_REQ function in crypto/x509/x509_req.c in     OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1     before 1.0.1m, and 1.0.2 before 1.0.2a might allow     attackers to cause a denial of service (NULL pointer     dereference and application crash) via an invalid     certificate key.(CVE-2015-0288)The PKCS#7     implementation in OpenSSL before 0.9.8zf, 1.0.0 before     1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a     does not properly handle a lack of outer ContentInfo,     which allows attackers to cause a denial of service     (NULL pointer dereference and application crash) by     leveraging an application that processes arbitrary     PKCS#7 data and providing malformed data with ASN.1     encoding, related to crypto/pkcs7/pk7_doit.c and     crypto/pkcs7/pk7_lib.c.(CVE-2015-0289)The     PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in     OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1     before 1.0.1n, and 1.0.2 before 1.0.2b allows remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) via a PKCS#7 blob     that uses ASN.1 encoding and lacks inner     EncryptedContent data.(CVE-2015-1790)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A race condition was found in the session handling code     of OpenSSL. This issue could possibly cause a     multi-threaded TLS/SSL client using OpenSSL to double     free session ticket data and crash.(CVE-2015-1791)

  - An out-of-bounds read flaw was found in the     X509_cmp_time() function of OpenSSL, which is used to     test the expiry dates of SSL/TLS certificates. An     attacker could possibly use a specially crafted SSL/TLS     certificate or CRL (Certificate Revocation List), which     when parsed by an application would cause that     application to crash.(CVE-2015-1789)

  - The ASN1_STRING_print_ex function in OpenSSL before     0.9.8k allows remote attackers to cause a denial of     service (invalid memory access and application crash)     via vectors that trigger printing of a (1) BMPString or     (2) UniversalString with an invalid encoded     length.(CVE-2009-0590)

  - An invalid-free flaw was found in the way OpenSSL     handled certain DTLS handshake messages. A malicious     DTLS client or server could send a specially crafted     message to the peer, which could cause the application     to crash or potentially result in arbitrary code     execution.(CVE-2014-8176)

  - The DTLS implementation in OpenSSL before 0.9.8s and     1.x before 1.0.0f performs a MAC check only if certain     padding is valid, which makes it easier for remote     attackers to recover plaintext via a padding oracle     attack.(CVE-2011-4108)

  - Off-by-one error in the SSL_get_shared_ciphers function     in OpenSSL 0.9.7 up to 0.9.7l, and 0.9.8 up to 0.9.8f,     might allow remote attackers to execute arbitrary code     via a crafted packet that triggers a one-byte buffer     underflow. NOTE: this issue was introduced as a result     of a fix for CVE-2006-3738. As of 20071012, it is     unknown whether code execution is     possible.(CVE-2007-5135)

  - A NULL pointer dereference flaw was found in the DTLS     implementation of OpenSSL. A remote attacker could send     a specially crafted DTLS message, which would cause an     OpenSSL server to crash.(CVE-2014-3571)

  - The asn1_d2i_read_bio function in     crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0     before 1.0.0i, and 1.0.1 before 1.0.1a does not     properly interpret integer data, which allows remote     attackers to conduct buffer overflow attacks, and cause     a denial of service (memory corruption) or possibly     have unspecified other impact, via crafted DER data, as     demonstrated by an X.509 certificate or an RSA public     key.(CVE-2012-2110)

  - It was discovered that the SSLv2 servers using OpenSSL     accepted SSLv2 connection handshakes that indicated     non-zero clear key length for non-export cipher suites.
    An attacker could use this flaw to decrypt recorded     SSLv2 sessions with the server by using it as a     decryption oracle.(CVE-2016-0703)

  - ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote     attackers to cause a denial of service (NULL pointer     dereference and daemon crash) via a DTLS     ChangeCipherSpec packet that occurs before     ClientHello.(CVE-2009-1386)

  - Memory leak in the zlib_stateful_finish function in     crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and     1.0.0 Beta through Beta 4 allows remote attackers to     cause a denial of service (memory consumption) via     vectors that trigger incorrect calls to the     CRYPTO_cleanup_all_ex_data function, as demonstrated by     use of SSLv3 and PHP with the Apache HTTP Server, a     related issue to CVE-2008-1678.(CVE-2009-4355)

  - A flaw was discovered in the way OpenSSL handled DTLS     packets. A remote attacker could use this flaw to cause     a DTLS server or client using OpenSSL to crash or use     excessive amounts of memory.(CVE-2014-3507)

  - The dtls1_buffer_record function in ssl/d1_pkt.c in     OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote     attackers to cause a denial of service (memory     consumption) via a large series of 'future epoch' DTLS     records that are buffered in a queue, aka 'DTLS record     buffer limitation bug.'(CVE-2009-1377)

  - A use-after-free flaw was found in the way OpenSSL     imported malformed Elliptic Curve private keys. A     specially crafted key file could cause an application     using OpenSSL to crash when imported.(CVE-2015-0209)

  - A denial of service flaw was found in the way OpenSSL     verified certain signed messages using CMS     (Cryptographic Message Syntax). A remote attacker could     cause an application using OpenSSL to use excessive     amounts of memory by sending a specially crafted     message for verification.(CVE-2015-1792)

  - A denial of service flaw was found in the way OpenSSL     handled SSLv2 handshake messages. A remote attacker     could use this flaw to cause a TLS/SSL server using     OpenSSL to exit on a failed assertion if it had both     the SSLv2 protocol and EXPORT-grade cipher suites     enabled.(CVE-2015-0293)

  - An invalid pointer use flaw was found in OpenSSL's     ASN1_TYPE_cmp() function. A remote attacker could crash     a TLS/SSL client or server using OpenSSL via a     specially crafted X.509 certificate when the     attacker-supplied certificate was verified by the     application.(CVE-2015-0286)

  - Multiple flaws were found in the way OpenSSL parsed     X.509 certificates. An attacker could use these flaws     to modify an X.509 certificate to produce a certificate     with a different fingerprint without invalidating its     signature, and possibly bypass fingerprint-based     blacklisting in applications.(CVE-2014-8275)

  - If an application encounters a fatal protocol error and     then calls SSL_shutdown() twice (once to send a     close_notify, and once to receive one) then OpenSSL can     respond differently to the calling application if a 0     byte record is received with invalid padding compared     to if a 0 byte record is received with an invalid MAC.
    If the application then behaves differently based on     that in a way that is detectable to the remote peer,     then this amounts to a padding oracle that could be     used to decrypt data. In order for this to be     exploitable 'non-stitched' ciphersuites must be in use.
    Stitched ciphersuites are optimised implementations of     certain commonly used ciphersuites. Also the     application must call SSL_shutdown() twice even if a     protocol error has occurred (applications should not do     this but some do anyway). Fixed in OpenSSL 1.0.2r     (Affected 1.0.2-1.0.2q).(CVE-2019-1559)

  - A flaw was found in the way the TLS protocol composes     the Diffie-Hellman exchange (for both export and     non-export grade cipher suites). An attacker could use     this flaw to downgrade a DHE connection to use     export-grade key sizes, which could then be broken by     sufficient pre-computation. This can lead to a passive     man-in-the-middle attack in which the attacker is able     to decrypt all traffic.(CVE-2015-4000)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the remote pfSense install is prior to 2.2.3. It is, therefore, affected by multiple vulnerabilities as stated in the referenced vendor advisories.

The Cisco Application Control Engine (ACE) software installed on the remote Cisco ACE 4710 device or ACE30 module is version A5 prior to A5(3.3). It is, therefore, affected by multiple vulnerabilities :

  - An invalid free memory error exists due to improper     validation of user-supplied input when a DTLS peer     receives application data between ChangeCipherSpec and     Finished messages. A remote attacker can exploit this to     corrupt memory, resulting in a denial of service or     the execution of arbitrary code. (CVE-2014-8176)

  - A denial of service vulnerability exists when processing     an ECParameters structure due to an infinite loop that     occurs when a specified curve is over a malformed binary     polynomial field. A remote attacker can exploit this to     perform a denial of service against any system that     processes public keys, certificate requests, or     certificates. This includes TLS clients and TLS servers     with client authentication enabled. (CVE-2015-1788)

  - A denial of service vulnerability exists due to improper     validation of the content and length of the ASN1_TIME     string by the X509_cmp_time() function. A remote     attacker can exploit this, via a malformed certificate     and CRLs of various sizes, to cause a segmentation     fault, resulting in a denial of service condition. TLS     clients that verify CRLs are affected. TLS clients and     servers with client authentication enabled may be     affected if they use custom verification callbacks.
    (CVE-2015-1789)

  - A NULL pointer dereference flaw exists in the PKCS#7     parsing code due to incorrect handling of missing inner     'EncryptedContent'. This allows a remote attacker, via     specially crafted ASN.1-encoded PKCS#7 blobs with     missing content, to cause a denial of service condition     or other potential unspecified impacts. (CVE-2015-1790)

  - A double-free error exists due to a race condition that     occurs when a NewSessionTicket is received by a     multi-threaded client when attempting to reuse a     previous ticket. A remote attacker can exploit this to     cause a denial of service condition or other potential     unspecified impact. (CVE-2015-1791)

  - A denial of service vulnerability exists in the CMS code     due to an infinite loop that occurs when verifying a     signedData message. A remote attacker can exploit this     to cause a denial of service condition. (CVE-2015-1792)

  - The symmetric-key feature in the receive function     requires a correct message authentication code (MAC)     only if the MAC field has a nonzero length. This makes     it easier for a man-in-the-middle attacker to spoof     packets by omitting the MAC. (CVE-2015-1798)

  - A flaw exists in the symmetric-key feature in the     receive function when handling a specially crafted     packet sent to one of two hosts that are peering with     each other. This allows an attacker to cause the next     attempt by the servers to synchronize to fail.
    (CVE-2015-1799)

  - A man-in-the-middle vulnerability, known as Logjam,     exists due to a flaw in the SSL/TLS protocol. A remote     attacker can exploit this flaw to downgrade connections     using ephemeral Diffie-Hellman key exchange to 512-bit     export-grade cryptography. (CVE-2015-4000)

  - A flaw exists in the TLS 1.x implementation in the     Cavium SDK due to a failure to check the first byte of     the padding bytes. A man-in-the-middle attacker can     exploit this, by sending specially crafted requests to     the server, to induce requests that allow determining     the plaintext chunks of data. This vulnerability is a     variant of the POODLE attack. (CVE-2015-4595)

libressl was updated to version 2.2.1 to fix 16 security issues.

LibreSSL is a fork of OpenSSL. Because of that CVEs affecting OpenSSL often also affect LibreSSL.

These security issues were fixed :

  - CVE-2014-3570: The BN_sqr implementation in OpenSSL     before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before     1.0.1k did not properly calculate the square of a BIGNUM     value, which might make it easier for remote attackers     to defeat cryptographic protection mechanisms via     unspecified vectors, related to crypto/bn/asm/mips.pl,     crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c     (bsc#912296).

  - CVE-2014-3572: The ssl3_get_key_exchange function in     s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before     1.0.0p, and 1.0.1 before 1.0.1k allowed remote SSL     servers to conduct ECDHE-to-ECDH downgrade attacks and     trigger a loss of forward secrecy by omitting the     ServerKeyExchange message (bsc#912015).

  - CVE-2015-1792: The do_free_upto function in     crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0     before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before     1.0.2b allowed remote attackers to cause a denial of     service (infinite loop) via vectors that trigger a NULL     value of a BIO data structure, as demonstrated by an     unrecognized X.660 OID for a hash function (bsc#934493).

  - CVE-2014-8275: OpenSSL before 0.9.8zd, 1.0.0 before     1.0.0p, and 1.0.1 before 1.0.1k did not enforce certain     constraints on certificate data, which allowed remote     attackers to defeat a fingerprint-based     certificate-blacklist protection mechanism by including     crafted data within a certificate's unsigned portion,     related to crypto/asn1/a_verify.c,     crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and     crypto/x509/x_all.c (bsc#912018).

  - CVE-2015-0209: Use-after-free vulnerability in the     d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in     OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1     before 1.0.1m, and 1.0.2 before 1.0.2a might allowed     remote attackers to cause a denial of service (memory     corruption and application crash) or possibly have     unspecified other impact via a malformed Elliptic Curve     (EC) private-key file that is improperly handled during     import (bsc#919648).

  - CVE-2015-1789: The X509_cmp_time function in     crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0     before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before     1.0.2b allowed remote attackers to cause a denial of     service (out-of-bounds read and application crash) via a     crafted length field in ASN1_TIME data, as demonstrated     by an attack against a server that supports client     authentication with a custom verification callback     (bsc#934489).

  - CVE-2015-1788: The BN_GF2m_mod_inv function in     crypto/bn/bn_gf2m.c in OpenSSL before 0.9.8s, 1.0.0     before 1.0.0e, 1.0.1 before 1.0.1n, and 1.0.2 before     1.0.2b did not properly handle ECParameters structures     in which the curve is over a malformed binary polynomial     field, which allowed remote attackers to cause a denial     of service (infinite loop) via a session that used an     Elliptic Curve algorithm, as demonstrated by an attack     against a server that supports client authentication     (bsc#934487).

  - CVE-2015-1790: The PKCS7_dataDecodefunction in     crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0     before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before     1.0.2b allowed remote attackers to cause a denial of     service (NULL pointer dereference and application crash)     via a PKCS#7 blob that used ASN.1 encoding and lacks     inner EncryptedContent data (bsc#934491).

  - CVE-2015-0287: The ASN1_item_ex_d2i function in     crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0     before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before     1.0.2a did not reinitialize CHOICE and ADB data     structures, which might allowed attackers to cause a     denial of service (invalid write operation and memory     corruption) by leveraging an application that relies on     ASN.1 structure reuse (bsc#922499).

  - CVE-2015-0286: The ASN1_TYPE_cmp function in     crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0     before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before     1.0.2a did not properly perform boolean-type     comparisons, which allowed remote attackers to cause a     denial of service (invalid read operation and     application crash) via a crafted X.509 certificate to an     endpoint that used the certificate-verification feature     (bsc#922496).

  - CVE-2015-0289: The PKCS#7 implementation in OpenSSL     before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before     1.0.1m, and 1.0.2 before 1.0.2a did not properly handle     a lack of outer ContentInfo, which allowed attackers to     cause a denial of service (NULL pointer dereference and     application crash) by leveraging an application that     processes arbitrary PKCS#7 data and providing malformed     data with ASN.1 encoding, related to     crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c     (bsc#922500).

  - CVE-2015-0288: The X509_to_X509_REQ function in     crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0     before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before     1.0.2a might allowed attackers to cause a denial of     service (NULL pointer dereference and application crash)     via an invalid certificate key (bsc#920236).

  - CVE-2014-8176: The dtls1_clear_queues function in     ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before     1.0.0m, and 1.0.1 before 1.0.1h frees data structures     without considering that application data can arrive     between a ChangeCipherSpec message and a Finished     message, which allowed remote DTLS peers to cause a     denial of service (memory corruption and application     crash) or possibly have unspecified other impact via     unexpected application data (bsc#934494).

  - CVE-2015-4000: The TLS protocol 1.2 and earlier, when a     DHE_EXPORT ciphersuite is enabled on a server but not on     a client, did not properly convey a DHE_EXPORT choice,     which allowed man-in-the-middle attackers to conduct     cipher-downgrade attacks by rewriting a ClientHello with     DHE replaced by DHE_EXPORT and then rewriting a     ServerHello with DHE_EXPORT replaced by DHE, aka the     'Logjam' issue (bsc#931600).

  - CVE-2015-0205: The ssl3_get_cert_verify function in     s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1     before 1.0.1k accepts client authentication with a     Diffie-Hellman (DH) certificate without requiring a     CertificateVerify message, which allowed remote     attackers to obtain access without knowledge of a     private key via crafted TLS Handshake Protocol traffic     to a server that recognizes a Certification Authority     with DH support (bsc#912293).

  - CVE-2015-0206: Memory leak in the dtls1_buffer_record     function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and     1.0.1 before 1.0.1k allowed remote attackers to cause a     denial of service (memory consumption) by sending many     duplicate records for the next epoch, leading to failure     of replay detection (bsc#912292).

According to its self-reported version number, the Puppet Enterprise application running on the remote host is 3.x prior to 3.8.1. It is, therefore, affected by the following vulnerabilities :

  - An XML external entity injection (XXE) flaw exists in     the Apache ActiveMQ component due to a faulty     configuration that allows an XML parser to accept XML     external entities from untrusted sources. A remote     attacker, by sending crafted XML data, can exploit this     to disclose arbitrary files. (CVE-2014-3600)

  - An authentication bypass vulnerability exists in the     Apache ActiveMQ component due to a flaw in the     LDAPLoginModule implementation. A remote attacker can     exploit this to bypass authentication mechanisms.
    (CVE-2014-3612)

  - Multiple cross-site scripting vulnerabilities exist in     the administrative console of Apache ActiveMQ that allow     a remote attacker to inject arbitrary HTML or web     scripts. (CVE-2014-8110)

  - An invalid free memory error exists due to improper     validation of user-supplied input when a DTLS peer     receives application data between ChangeCipherSpec and     Finished messages. A remote attacker can exploit this to     corrupt memory, resulting in a denial of service or     the execution of arbitrary code. (CVE-2014-8176)

  - A denial of service vulnerability exists when processing     an ECParameters structure due to an infinite loop that     occurs when a specified curve is over a malformed binary     polynomial field. A remote attacker can exploit this to     perform a denial of service against any system that     processes public keys, certificate requests, or     certificates. This includes TLS clients and TLS servers     with client authentication enabled. (CVE-2015-1788)

  - A denial of service vulnerability exists due to improper     validation of the content and length of the ASN1_TIME     string by the X509_cmp_time() function. A remote     attacker can exploit this, via a malformed certificate     and CRLs of various sizes, to cause a segmentation     fault, resulting in a denial of service condition. TLS     clients that verify CRLs are affected. TLS clients and     servers with client authentication enabled may be     affected if they use custom verification callbacks.
    (CVE-2015-1789)

  - A NULL pointer dereference flaw exists in the PKCS#7     parsing code due to incorrect handling of missing inner     'EncryptedContent'. This allows a remote attacker, via     specially crafted ASN.1-encoded PKCS#7 blobs with     missing content, to cause a denial of service condition     or other potential unspecified impacts. (CVE-2015-1790)

  - A double-free error exists due to a race condition that     occurs when a NewSessionTicket is received by a     multi-threaded client when attempting to reuse a     previous ticket. (CVE-2015-1791)

  - A denial of service vulnerability exists in the CMS code     due to an infinite loop that occurs when verifying a     signedData message. A remote attacker can exploit this     to cause a denial of service condition. (CVE-2015-1792)

  - A double-free memory flaw exists in PostgreSQL due to     a timeout interrupt occurring partway in the session     shutdown sequence. A remote attacker, by closing     an SSL session when the authentication timeout expires,     can exploit this flaw to cause a denial of service.
    (CVE-2015-3165)

  - An out-of-memory condition exists in the printf()     functions in PostgreSQL due to a failure to check for     errors. A remote attacker can exploit this to access     sensitive information. (CVE-2015-3166)

  - A flaw exists in contrib/pgcrypto in PostgreSQL due     to cases of decryption reporting other error message     texts, which a remote attacker can use to recover     keys from other systems. (CVE-2015-3167)

  - A man-in-the-middle vulnerability, known as Logjam,     exists due to a flaw in the SSL/TLS protocol. A remote     attacker can exploit this flaw to downgrade connections     using ephemeral Diffie-Hellman key exchange to 512-bit     export-grade cryptography. (CVE-2015-4000)

The version of OpenSSL installed on the remote AIX host is affected by multiple vulnerabilities :

  - An invalid free memory error exists due to improper     validation of user-supplied input when a DTLS peer     receives application data between ChangeCipherSpec and     Finished messages. A remote attacker can exploit this to     corrupt memory, resulting in a denial of service or     the execution of arbitrary code. (CVE-2014-8176)

  - A denial of service vulnerability exists when processing     an ECParameters structure due to an infinite loop that     occurs when a specified curve is over a malformed binary     polynomial field. A remote attacker can exploit this to     perform a denial of service against any system that     processes public keys, certificate requests, or     certificates. This includes TLS clients and TLS servers     with client authentication enabled. (CVE-2015-1788)

  - A denial of service vulnerability exists due to improper     validation of the content and length of the ASN1_TIME     string by the X509_cmp_time() function. A remote     attacker can exploit this, via a malformed certificate     and CRLs of various sizes, to cause a segmentation     fault, resulting in a denial of service condition. TLS     clients that verify CRLs are affected. TLS clients and     servers with client authentication enabled may be     affected if they use custom verification callbacks.
    (CVE-2015-1789)

  - A NULL pointer dereference flaw exists in the PKCS#7     parsing code due to incorrect handling of missing inner     'EncryptedContent'. This allows a remote attacker, via     specially crafted ASN.1-encoded PKCS#7 blobs with     missing content, to cause a denial of service condition     or other potential unspecified impacts. (CVE-2015-1790)

  - A double-free error exists due to a race condition that     occurs when a NewSessionTicket is received by a     multi-threaded client when attempting to reuse a     previous ticket. (CVE-2015-1791)

  - A denial of service vulnerability exists in the CMS code     due to an infinite loop that occurs when verifying a     signedData message. A remote attacker can exploit this     to cause a denial of service condition. (CVE-2015-1792)

  - A man-in-the-middle vulnerability, known as Logjam,     exists due to a flaw in the SSL/TLS protocol. A remote     attacker can exploit this flaw to downgrade connections     using ephemeral Diffie-Hellman key exchange to 512-bit     export-grade cryptography. (CVE-2015-4000)

The remote host is affected by the vulnerability described in GLSA-201506-02 (OpenSSL: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in OpenSSL. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker can cause Denial of Service and information       disclosure.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities were discovered in OpenSSL, a Secure Sockets Layer toolkit.

CVE-2014-8176

Praveen Kariyanahalli, Ivan Fratric and Felix Groebert discovered that an invalid memory free could be triggered when buffering DTLS data.
This could allow remote attackers to cause a denial of service (crash) or potentially execute arbitrary code. This issue only affected the oldstable distribution (wheezy).

CVE-2015-1789

Robert Swiecki and Hanno B??ck discovered that the X509_cmp_time function could read a few bytes out of bounds. This could allow remote attackers to cause a denial of service (crash) via crafted certificates and CRLs.

CVE-2015-1790

Michal Zalewski discovered that the PKCS#7 parsing code did not properly handle missing content which could lead to a NULL pointer dereference. This could allow remote attackers to cause a denial of service (crash) via crafted ASN.1-encoded PKCS#7 blobs.

CVE-2015-1791

Emilia K??sper discovered that a race condition could occur due to incorrect handling of NewSessionTicket in a multi-threaded client, leading to a double free. This could allow remote attackers to cause a denial of service (crash).

CVE-2015-1792

Johannes Bauer discovered that the CMS code could enter an infinite loop when verifying a signedData message, if presented with an unknown hash function OID. This could allow remote attackers to cause a denial of service.

Additionally OpenSSL will now reject handshakes using DH parameters shorter than 768 bits as a countermeasure against the Logjam attack (CVE-2015-4000).

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

LOGJAM: A flaw was found in the way the TLS protocol composes the Diffie-Hellman exchange (for both export and non-export grade cipher suites). An attacker could use this flaw to downgrade a DHE connection to use export-grade key sizes, which could then be broken by sufficient pre-computation. This can lead to a passive man-in-the-middle attack in which the attacker is able to decrypt all traffic. (CVE-2015-4000)

An out-of-bounds read flaw was found in the X509_cmp_time() function of OpenSSL, which is used to test the expiry dates of SSL/TLS certificates. An attacker could possibly use a specially crafted SSL/TLS certificate or CRL (Certificate Revocation List), which when parsed by an application would cause that application to crash.
(CVE-2015-1789)

A NULL pointer dereference was found in the way OpenSSL handled certain PKCS#7 inputs. An attacker able to make an application using OpenSSL verify, decrypt, or parse a specially crafted PKCS#7 input could cause that application to crash. TLS/SSL clients and servers using OpenSSL were not affected by this flaw. (CVE-2015-1790)

A race condition was found in the session handling code of OpenSSL. An attacker could cause a multi-threaded SSL/TLS server to crash.
(CVE-2015-1791)

A denial of service flaw was found in OpenSSL in the way it verified certain signed messages using CMS (Cryptographic Message Syntax). A remote attacker could cause an application using OpenSSL to use excessive amounts of memory by sending a specially crafted message for verification. (CVE-2015-1792)

An invalid-free flaw was found in the way OpenSSL handled certain DTLS handshake messages. A malicious DTLS client or server could send a specially crafted message to the peer, which could cause the application to crash or potentially cause arbitrary code execution.
(CVE-2014-8176)

A regression was found in the ssleay_rand_bytes() function. This could lead a multi-threaded application to crash. (CVE-2015-3216)

An invalid free flaw was found in the way OpenSSL handled certain DTLS handshake messages. A malicious DTLS client or server could cause a DTLS server or client using OpenSSL to crash or, potentially, execute arbitrary code. (CVE-2014-8176)

A flaw was found in the way the OpenSSL packages shipped with Scientific Linux 6 and 7 performed locking in the ssleay_rand_bytes() function. This issue could possibly cause a multi-threaded application using OpenSSL to perform an out-of-bounds read and crash.
(CVE-2015-3216)

An out-of-bounds read flaw was found in the X509_cmp_time() function of OpenSSL. A specially crafted X.509 certificate or a Certificate Revocation List (CRL) could possibly cause a TLS/SSL server or client using OpenSSL to crash. (CVE-2015-1789)

A race condition was found in the session handling code of OpenSSL.
This issue could possibly cause a multi-threaded TLS/SSL client using OpenSSL to double free session ticket data and crash. (CVE-2015-1791)

A flaw was found in the way OpenSSL handled Cryptographic Message Syntax (CMS) messages. A CMS message with an unknown hash function identifier could cause an application using OpenSSL to enter an infinite loop. (CVE-2015-1792)

A NULL pointer dereference was found in the way OpenSSL handled certain PKCS#7 inputs. A specially crafted PKCS#7 input with missing EncryptedContent data could cause an application using OpenSSL to crash. (CVE-2015-1790)

For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.

Updated openssl packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library.

An invalid free flaw was found in the way OpenSSL handled certain DTLS handshake messages. A malicious DTLS client or server could cause a DTLS server or client using OpenSSL to crash or, potentially, execute arbitrary code. (CVE-2014-8176)

A flaw was found in the way the OpenSSL packages shipped with Red Hat Enterprise Linux 6 and 7 performed locking in the ssleay_rand_bytes() function. This issue could possibly cause a multi-threaded application using OpenSSL to perform an out-of-bounds read and crash.
(CVE-2015-3216)

An out-of-bounds read flaw was found in the X509_cmp_time() function of OpenSSL. A specially crafted X.509 certificate or a Certificate Revocation List (CRL) could possibly cause a TLS/SSL server or client using OpenSSL to crash. (CVE-2015-1789)

A race condition was found in the session handling code of OpenSSL.
This issue could possibly cause a multi-threaded TLS/SSL client using OpenSSL to double free session ticket data and crash. (CVE-2015-1791)

A flaw was found in the way OpenSSL handled Cryptographic Message Syntax (CMS) messages. A CMS message with an unknown hash function identifier could cause an application using OpenSSL to enter an infinite loop. (CVE-2015-1792)

A NULL pointer dereference was found in the way OpenSSL handled certain PKCS#7 inputs. A specially crafted PKCS#7 input with missing EncryptedContent data could cause an application using OpenSSL to crash. (CVE-2015-1790)

Red Hat would like to thank the OpenSSL project for reporting CVE-2014-8176, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791 and CVE-2015-1792 flaws. Upstream acknowledges Praveen Kariyanahalli and Ivan Fratric as the original reporters of CVE-2014-8176, Robert Swiecki and Hanno Bock as the original reporters of CVE-2015-1789, Michal Zalewski as the original reporter of CVE-2015-1790, Emilia Kasper as the original report of CVE-2015-1791 and Johannes Bauer as the original reporter of CVE-2015-1792.

All openssl users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - improved fix for (CVE-2015-1791)

  - add missing parts of CVE-2015-0209 fix for corectness     although unexploitable

  - fix CVE-2014-8176 - invalid free in DTLS buffering code

  - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time

  - fix CVE-2015-1790 - PKCS7 crash with missing     EncryptedContent

  - fix CVE-2015-1791 - race condition handling     NewSessionTicket

  - fix CVE-2015-1792 - CMS verify infinite loop with     unknown hash function

  - fix CVE-2015-3216 - regression in RAND locking that can     cause segfaults on read in multithreaded applications

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1115 advisory.

    - improved fix for CVE-2015-1791
    - add missing parts of CVE-2015-0209 fix for corectness although unexploitable
    - fix CVE-2014-8176 - invalid free in DTLS buffering code
    - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time
    - fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent
    - fix CVE-2015-1791 - race condition handling NewSessionTicket
    - fix CVE-2015-1792 - CMS verify infinite loop with unknown hash function

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities were discovered in OpenSSL, a Secure Sockets Layer toolkit.

  - CVE-2014-8176     Praveen Kariyanahalli, Ivan Fratric and Felix Groebert     discovered that an invalid memory free could be     triggered when buffering DTLS data. This could allow     remote attackers to cause a denial of service (crash) or     potentially execute arbitrary code. This issue only     affected the oldstable distribution (wheezy).

  - CVE-2015-1788     Joseph Barr-Pixton discovered that an infinite loop     could be triggered due to incorrect handling of     malformed ECParameters structures. This could allow     remote attackers to cause a denial of service.

  - CVE-2015-1789     Robert Swiecki and Hanno Bock discovered that the     X509_cmp_time function could read a few bytes out of     bounds. This could allow remote attackers to cause a     denial of service (crash) via crafted certificates and     CRLs.

  - CVE-2015-1790     Michal Zalewski discovered that the PKCS#7 parsing code     did not properly handle missing content which could lead     to a NULL pointer dereference. This could allow remote     attackers to cause a denial of service (crash) via     crafted ASN.1-encoded PKCS#7 blobs.

  - CVE-2015-1791     Emilia Kasper discovered that a race condition could     occur due to incorrect handling of NewSessionTicket in a     multi-threaded client, leading to a double free. This     could allow remote attackers to cause a denial of     service (crash).

  - CVE-2015-1792     Johannes Bauer discovered that the CMS code could enter     an infinite loop when verifying a signedData message, if     presented with an unknown hash function OID. This could     allow remote attackers to cause a denial of service.

Additionally OpenSSL will now reject handshakes using DH parameters shorter than 768 bits as a countermeasure against the Logjam attack (CVE-2015-4000 ).

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2639-1 advisory.

    Praveen Kariyanahalli, Ivan Fratric and Felix Groebert discovered that OpenSSL incorrectly handled memory     when buffering DTLS data. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a     denial of service, or possibly execute arbitrary code. (CVE-2014-8176)

    Joseph Barr-Pixton discovered that OpenSSL incorrectly handled malformed ECParameters structures. A remote     attacker could use this issue to cause OpenSSL to hang, resulting in a denial of service. (CVE-2015-1788)

    Robert Swiecki and Hanno Bck discovered that OpenSSL incorrectly handled certain ASN1_TIME strings. A     remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service.
    (CVE-2015-1789)

    Michal Zalewski discovered that OpenSSL incorrectly handled missing content when parsing ASN.1-encoded     PKCS#7 blobs. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of     service. (CVE-2015-1790)

    Emilia Ksper discovered that OpenSSL incorrectly handled NewSessionTicket when being used by a multi-     threaded client. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial     of service. (CVE-2015-1791)

    Johannes Bauer discovered that OpenSSL incorrectly handled verifying signedData messages using the CMS     code. A remote attacker could use this issue to cause OpenSSL to hang, resulting in a denial of service.
    (CVE-2015-1792)

    As a security improvement, this update also modifies OpenSSL behaviour to reject DH key sizes below 768     bits, preventing a possible downgrade attack.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The OpenSSL team reports :

- Missing DHE man-in-the-middle protection (Logjam) (CVE-2015-4000)

- Malformed ECParameters causes infinite loop (CVE-2015-1788)

- Exploitable out-of-bounds read in X509_cmp_time (CVE-2015-1789)

- PKCS#7 crash with missing EnvelopedContent (CVE-2015-1790)

- CMS verify infinite loop with unknown hash function (CVE-2015-1792)

- Race condition handling NewSessionTicket (CVE-2015-1791)

- Invalid free in DTLS (CVE-2014-8176)

The version of OpenSSL installed on the remote host is prior to 1.0.1h. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.1h advisory.

  - The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1     before 1.0.1h frees data structures without considering that application data can arrive between a     ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of     service (memory corruption and application crash) or possibly have unspecified other impact via unexpected     application data. (CVE-2014-8176)

  - Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding     implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote     attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via     crafted base64 data that triggers a buffer overflow. (CVE-2015-0292)

  - OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing     of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length     master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain     sensitive information, via a crafted TLS handshake, aka the CCS Injection vulnerability. (CVE-2014-0224)

  - The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and     1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via     a DTLS hello message in an invalid DTLS handshake. (CVE-2014-0221)

  - The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and     1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows     remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application     crash) via a long non-initial fragment. (CVE-2014-0195)

  - The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m,     and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a     denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.
    (CVE-2014-3470)

  - The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is     enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote     attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that     trigger an alert condition. (CVE-2014-0198)

  - Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when     SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a     denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.
    (CVE-2010-5298)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote host is prior to 0.9.8za. It is, therefore, affected by multiple vulnerabilities as referenced in the 0.9.8za advisory.

  - The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1     before 1.0.1h frees data structures without considering that application data can arrive between a     ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of     service (memory corruption and application crash) or possibly have unspecified other impact via unexpected     application data. (CVE-2014-8176)

  - Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding     implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote     attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via     crafted base64 data that triggers a buffer overflow. (CVE-2015-0292)

  - OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing     of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length     master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain     sensitive information, via a crafted TLS handshake, aka the CCS Injection vulnerability. (CVE-2014-0224)

  - The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and     1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via     a DTLS hello message in an invalid DTLS handshake. (CVE-2014-0221)

  - The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and     1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows     remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application     crash) via a long non-initial fragment. (CVE-2014-0195)

  - The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m,     and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a     denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.
    (CVE-2014-3470)

  - The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap     operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via     a FLUSH+RELOAD cache side-channel attack. (CVE-2014-0076)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

OpenSSL before 0.9.8za, 1.0.0m, or 1.0.1h are unpatched for the following vulnerabilities:

  - Potential arbitrary code execution due to a buffer overflow vulnerability when processing invalid DTLS fragments (CVE-2014-0195)

  - Denial of service via a NULL pointer dereference error in 'so_ssl3_write()' function of 's3_pkt.c' source file (CVE-2014-0198)

  - Denial of service against an OpenSSL client due to a recursion flaw in the DTLS handshake. (CVE-2014-0221)

  - A man-in-the-middle security bypass due to weak keying material in OpenSSL SSL/TLS clients and servers, which can be exploited via a specially crafted handshake (CVE-2014-0224)

  - Denial of service that can be triggered in the case where anonymous ECDH cipher suites are enabled in TLS clients (CVE-2014-3470)

  - An integer underflow condition exists in the EVP_DecodeUpdate() function due to improper validation of base64 encoded input when decoding. This allows a remote attacker, using maliciously crafted base64 data, to cause a segmentation fault or memory corruption, resulting in a denial of service or possibly the execution of arbitrary code. (CVE-2015-0292)

  - A flaw exists that is triggered as user-supplied input is not properly validated when a DTLS peer handles application data between the ChangeCipherSpec and Finished messages. This may allow a remote attacker to cause an invalid free, which will corrupt memory and cause a denial of service or potentially execute arbitrary code. (CVE-2014-8176)

The version of OpenSSL installed on the remote host is prior to 1.0.0m. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.0m advisory.

  - The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1     before 1.0.1h frees data structures without considering that application data can arrive between a     ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of     service (memory corruption and application crash) or possibly have unspecified other impact via unexpected     application data. (CVE-2014-8176)

  - Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding     implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote     attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via     crafted base64 data that triggers a buffer overflow. (CVE-2015-0292)

  - OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing     of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length     master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain     sensitive information, via a crafted TLS handshake, aka the CCS Injection vulnerability. (CVE-2014-0224)

  - The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and     1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via     a DTLS hello message in an invalid DTLS handshake. (CVE-2014-0221)

  - The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and     1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows     remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application     crash) via a long non-initial fragment. (CVE-2014-0195)

  - The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m,     and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a     denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.
    (CVE-2014-3470)

  - The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is     enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote     attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that     trigger an alert condition. (CVE-2014-0198)

  - Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when     SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a     denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.
    (CVE-2010-5298)

  - The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap     operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via     a FLUSH+RELOAD cache side-channel attack. (CVE-2014-0076)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199292	RHEL 6 : openssl (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199286	RHEL 7 : openssl (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
132178	EulerOS 2.0 SP3 : openssl098e (EulerOS-SA-2019-2643)	Nessus	Huawei Local Security Checks	high
131662	EulerOS 2.0 SP2 : openssl098e (EulerOS-SA-2019-2509)	Nessus	Huawei Local Security Checks	high
125001	EulerOS Virtualization 3.0.1.0 : openssl (EulerOS-SA-2019-1548)	Nessus	Huawei Local Security Checks	medium
106495	pfSense < 2.2.3 Multiple Vulnerabilities (SA-15_07) (Logjam)	Nessus	Firewalls	critical
91427	Cisco ACE 4710 Appliance / ACE30 Module Multiple Vulnerabilities (Logjam)	Nessus	CISCO	high
84998	openSUSE Security Update : libressl (openSUSE-2015-507) (Logjam)	Nessus	SuSE Local Security Checks	high
84960	Puppet Enterprise 3.x < 3.8.1 Multiple Vulnerabilities (Logjam)	Nessus	CGI abuses	critical
84880	AIX OpenSSL Advisory : openssl_advisory14.asc (Logjam)	Nessus	AIX Local Security Checks	high
84330	GLSA-201506-02 : OpenSSL: Multiple vulnerabilities (Logjam)	Nessus	Gentoo Local Security Checks	high
84253	Debian DLA-247-1 : openssl security update (Logjam)	Nessus	Debian Local Security Checks	high
84251	Amazon Linux AMI : openssl (ALAS-2015-550) (Logjam)	Nessus	Amazon Linux Local Security Checks	high
84226	Scientific Linux Security Update : openssl on SL6.x, SL7.x i386/x86_64 (20150615)	Nessus	Scientific Linux Local Security Checks	high
84204	RHEL 6 / 7 : openssl (RHSA-2015:1115)	Nessus	Red Hat Local Security Checks	high
84203	OracleVM 3.3 : openssl (OVMSA-2015-0070)	Nessus	OracleVM Local Security Checks	high
84202	Oracle Linux 6 / 7 : openssl (ELSA-2015-1115)	Nessus	Oracle Linux Local Security Checks	high
84199	CentOS 6 / 7 : openssl (CESA-2015:1115)	Nessus	CentOS Local Security Checks	high
84170	Debian DSA-3287-1 : openssl - security update (Logjam)	Nessus	Debian Local Security Checks	high
84148	Ubuntu 14.04 LTS : OpenSSL vulnerabilities (USN-2639-1)	Nessus	Ubuntu Local Security Checks	high
84133	FreeBSD : openssl -- multiple vulnerabilities (8305e215-1080-11e5-8ba2-000c2980a9f3) (Logjam)	Nessus	FreeBSD Local Security Checks	high
74364	OpenSSL 1.0.1 < 1.0.1h Multiple Vulnerabilities	Nessus	Web Servers	high
74363	OpenSSL 0.9.8 < 0.9.8za Multiple Vulnerabilities	Nessus	Web Servers	high
8253	OpenSSL < 0.9.8za / < 1.0.0m / < 1.0.1h Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
73403	OpenSSL 1.0.0 < 1.0.0m Multiple Vulnerabilities	Nessus	Web Servers	high

Detections

Analytics

CVE-2014-8176

critical

Tenable Plugins

critical

critical

high

high

medium

critical

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high