Detections
Analytics
Amazon Linux AMI : nspr (ALAS-2013-216)
medium Nessus Plugin ID 70220
Language:
Synopsis
The remote Amazon Linux AMI host is missing a security update.Description
It was discovered that NSS leaked timing information when decrypting TLS/SSL and DTLS protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL or DTLS server as a padding oracle. (CVE-2013-1620)An out-of-bounds memory read flaw was found in the way NSS decoded certain certificates. If an application using NSS decoded a malformed certificate, it could cause the application to crash. (CVE-2013-0791)
Solution
Run 'yum update nspr' to update your system.See Also
Plugin Details
Severity: Medium
ID: 70220
File Name: ala_ALAS-2013-216.nasl
Version: 1.4
Type: local
Agent: unix
Published: 10/1/2013
Updated: 4/18/2018
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.4
CVSS v2
Risk Factor: Medium
Base Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
Vulnerability Information
CPE: p-cpe:/a:amazon:linux:nspr, p-cpe:/a:amazon:linux:nspr-devel, p-cpe:/a:amazon:linux:nspr-debuginfo, cpe:/o:amazon:linux
Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list
Patch Publication Date: 8/7/2013
Reference Information
CVE: CVE-2013-0791, CVE-2013-1620