Detections
Analytics

Mandriva Linux Security Advisory : apache (MDVSA-2009:295)

medium Nessus Plugin ID 42429

Synopsis

The remote Mandriva Linux host is missing one or more security updates.

Description

A vulnerability was discovered and corrected in apache :

Apache is affected by SSL injection or man-in-the-middle attacks due to a design flaw in the SSL and/or TLS protocols. A short term solution was released Sat Nov 07 2009 by the ASF team to mitigate these problems. Apache will now reject in-session renegotiation (CVE-2009-3555).

Additionally the SNI patch was upgraded for 2009.0/MES5 and 2009.1.

This update provides a solution to this vulnerability.

Solution

Update the affected packages.

See Also

http://www.nessus.org/u?6a81680c

Plugin Details

Severity: Medium

ID: 42429

File Name: mandriva_MDVSA-2009-295.nasl

Version: 1.20

Type: local

Published: 11/9/2009

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 4.5

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P

Vulnerability Information

CPE: cpe:/o:mandriva:linux:2009.0, cpe:/o:mandriva:linux:2009.1, p-cpe:/a:mandriva:linux:apache-mod_mem_cache, p-cpe:/a:mandriva:linux:apache-mod_ssl, p-cpe:/a:mandriva:linux:apache-mod_dbd, p-cpe:/a:mandriva:linux:apache-mod_authn_dbd, p-cpe:/a:mandriva:linux:apache-mpm-peruser, p-cpe:/a:mandriva:linux:apache-mod_proxy, cpe:/o:mandriva:linux:2010.0, p-cpe:/a:mandriva:linux:apache-mod_ldap, p-cpe:/a:mandriva:linux:apache-mod_cache, p-cpe:/a:mandriva:linux:apache-mod_deflate, p-cpe:/a:mandriva:linux:apache-mpm-worker, p-cpe:/a:mandriva:linux:apache-devel, p-cpe:/a:mandriva:linux:apache-mod_disk_cache, p-cpe:/a:mandriva:linux:apache-mod_userdir, p-cpe:/a:mandriva:linux:apache-htcacheclean, p-cpe:/a:mandriva:linux:apache-base, p-cpe:/a:mandriva:linux:apache-mod_proxy_ajp, p-cpe:/a:mandriva:linux:apache-mpm-prefork, p-cpe:/a:mandriva:linux:apache-mod_file_cache, p-cpe:/a:mandriva:linux:apache-mpm-itk, p-cpe:/a:mandriva:linux:apache-source, p-cpe:/a:mandriva:linux:apache-modules, p-cpe:/a:mandriva:linux:apache-mpm-event, p-cpe:/a:mandriva:linux:apache-mod_proxy_scgi, p-cpe:/a:mandriva:linux:apache-mod_dav

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/8/2009

Reference Information

CVE: CVE-2009-3555

BID: 36935

CWE: 310

MDVSA: 2009:295