Detections
Analytics
GLSA-200806-08 : OpenSSL: Denial of Service
medium Nessus Plugin ID 33244
Synopsis
The remote Gentoo host is missing one or more security-related patches.Description
The remote host is affected by the vulnerability described in GLSA-200806-08 (OpenSSL: Denial of Service)Ossi Herrala and Jukka Taimisto of Codenomicon discovered two vulnerabilities:
A double free() call in the TLS server name extension (CVE-2008-0891).
The OpenSSL client code does not properly handle servers that omit the Server Key Exchange message in the TLS handshake (CVE-2008-1672).
Impact :
A remote attacker could connect to a vulnerable server, or entice a daemon to connect to a malicious server, causing a Denial of Service of the daemon in both cases.
Workaround :
There is no known workaround at this time.
Solution
All OpenSSL users should upgrade to the latest version:# emerge --sync # emerge --ask --oneshot --verbose '>=dev-libs/openssl-0.9.8g-r2'
See Also
Plugin Details
Severity: Medium
ID: 33244
File Name: gentoo_GLSA-200806-08.nasl
Version: 1.18
Type: local
Family: Gentoo Local Security Checks
Published: 6/24/2008
Updated: 1/6/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P
Vulnerability Information
CPE: cpe:/o:gentoo:linux, p-cpe:/a:gentoo:linux:openssl
Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list
Exploit Ease: No known exploits are available
Patch Publication Date: 6/23/2008
Reference Information
CVE: CVE-2008-0891, CVE-2008-1672