Detections
Analytics

HP-UX PHSS_30639 : HP-UX Running Apache, Remote Denial of Service (DoS) (HPSBUX01019 SSRT4717 rev.3)

medium Nessus Plugin ID 17071

Synopsis

The remote HP-UX host is missing a security-related patch.

Description

s700_800 11.04 Virtualvault 4.7 IWS update :

Two potential security vulnerabilities have been identified in OpenSSL by NISCC (224012/1 and 224012/2). The Common Vulnerabilities and Exposures project has referenced them as the following CAN-2004-0079, and CAN-2004-0112. The CERT summary is TA04-078A. 1. The do_change_cipher_spec function in OpenSSL allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that triggers a null dereference. CVE-2004-0079 2. The SSL/TLS handshaking, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that causes an out-of-bounds read. CVE-2004-0112.

Solution

Install patch PHSS_30639 or subsequent.

See Also

http://www.nessus.org/u?6195bc72

Plugin Details

Severity: Medium

ID: 17071

File Name: hpux_PHSS_30639.nasl

Version: 1.18

Type: local

Published: 2/16/2005

Updated: 1/11/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: cpe:/o:hp:hp-ux

Required KB Items: Host/local_checks_enabled, Host/HP-UX/version, Host/HP-UX/swlist

Patch Publication Date: 4/20/2004

Reference Information

CVE: CVE-2003-0020, CVE-2004-0079, CVE-2004-0112, CVE-2004-0113, CVE-2004-0174

HP: HPSBUX01019, SSRT4717, emr_na-c00944046