Detections
Analytics
Cisco ONS 15400 Series Devices Multiple Vulnerabilities in OpenSSL
low Nessus Plugin ID 76130
Language:
Synopsis
The remote host is affected by multiple vulnerabilities.Description
The remote Cisco ONS device is running a software version known to be affected by multiple OpenSSL related vulnerabilities :- An error exists related to the implementation of the Elliptic Curve Digital Signature Algorithm (ECDSA) that could allow nonce disclosure via the 'FLUSH+RELOAD' cache side-channel attack. (CVE-2014-0076)
- An unspecified error exists related to anonymous ECDH ciphersuites that could allow denial of service attacks. Note this issue only affects OpenSSL TLS clients. (CVE-2014-3470)
Solution
No known fixed version have been released. There are partial workarounds detailed in the vendor advisory.See Also
Plugin Details
Severity: Low
ID: 76130
File Name: cisco_ons_CSCup24077.nasl
Version: 1.5
Type: remote
Family: CISCO
Published: 6/18/2014
Updated: 11/26/2019
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Low
Base Score: 1.9
Temporal Score: 1.4
Vector: CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2014-0076
Vulnerability Information
CPE: cpe:/o:cisco:ons
Required KB Items: Cisco/ONS/Device, Cisco/ONS/Version
Exploit Ease: No known exploits are available
Patch Publication Date: 6/5/2014
Vulnerability Publication Date: 6/5/2014
Reference Information
CVE: CVE-2014-0076, CVE-2014-3470