RHEL 6 : openssl (RHSA-2014:0015)

high Nessus Plugin ID 71877

Synopsis

The remote Red Hat host is missing one or more security updates for openssl.

Description

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0015 advisory.

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library.

A flaw was found in the way OpenSSL determined which hashing algorithm to use when TLS protocol version 1.2 was enabled. This could possibly cause OpenSSL to use an incorrect hashing algorithm, leading to a crash of an application using the library. (CVE-2013-6449)

It was discovered that the Datagram Transport Layer Security (DTLS) protocol implementation in OpenSSL did not properly maintain encryption and digest contexts during renegotiation. A lost or discarded renegotiation handshake packet could cause a DTLS client or server using OpenSSL to crash. (CVE-2013-6450)

A NULL pointer dereference flaw was found in the way OpenSSL handled TLS/SSL protocol handshake packets. A specially crafted handshake packet could cause a TLS/SSL client using OpenSSL to crash. (CVE-2013-4353)

All OpenSSL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the RHEL openssl package based on the guidance in RHSA-2014:0015.

See Also

http://www.nessus.org/u?d6ebe3fc

https://access.redhat.com/errata/RHSA-2014:0015

https://access.redhat.com/security/updates/classification/#important

https://bugzilla.redhat.com/show_bug.cgi?id=1045363

https://bugzilla.redhat.com/show_bug.cgi?id=1047840

https://bugzilla.redhat.com/show_bug.cgi?id=1049058

Plugin Details

Severity: High

ID: 71877

File Name: redhat-RHSA-2014-0015.nasl

Version: 1.15

Type: local

Agent: unix

Published: 1/9/2014

Updated: 11/4/2024

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

Vendor

Vendor Severity: Important

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P

CVSS Score Source: CVE-2013-6450

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:openssl-devel, p-cpe:/a:redhat:enterprise_linux:openssl-static, p-cpe:/a:redhat:enterprise_linux:openssl, cpe:/o:redhat:enterprise_linux:6, p-cpe:/a:redhat:enterprise_linux:openssl-perl

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 1/8/2014

Vulnerability Publication Date: 12/23/2013

Reference Information

CVE: CVE-2013-4353, CVE-2013-6449, CVE-2013-6450

CWE: 476

RHSA: 2014:0015