Detections
Analytics
OpenSSL < 0.9.8n Multiple Vulnerabilities
medium Log Correlation Engine Plugin ID 801060
Synopsis
The remote web server is vulnerable to multiple attack vectors.Description
According to its banner, the remote web server is running a version of OpenSSL older than 0.9.8n. Such versions have the following vulnerabilities :- Kerberos-enabled versions of OpenSSL do not check the return value when Kerberos configuration files cannot be opened, leading to a crash. (CVE-2010-0433)
- Rejecting a SSL/TLS record with and incorrect version number can lead to a crash. This only affects version 0.9.8m if a 'short' is 1 bits. Otherwise it affects all versions back to and including 0.9.8f. (CVE-2010-0740)
Solution
Upgrade to OpenSSL 0.9.8n or later.See Also
Plugin Details
Severity: Medium
ID: 801060
Family: Web Servers
Published: 3/26/2010
Nessus ID: 45359
Vulnerability Information
Patch Publication Date: 3/24/2010
Vulnerability Publication Date: 3/24/2010
Reference Information
CVE: CVE-2010-0433, CVE-2010-0740