Detections
Analytics
OpenSSL 0.9.8 < 0.9.8zc Multiple Vulnerabilities
critical Nessus Plugin ID 78552
Language:
Synopsis
The remote service is affected by multiple vulnerabilities.Description
The version of OpenSSL installed on the remote host is prior to 0.9.8zc. It is, therefore, affected by multiple vulnerabilities as referenced in the 0.9.8zc advisory.- OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j does not properly enforce the no-ssl3 build option, which allows remote attackers to bypass intended access restrictions via an SSL 3.0 handshake, related to s23_clnt.c and s23_srvr.c. (CVE-2014-3568)
- Memory leak in the tls_decrypt_ticket function in t1_lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted session ticket that triggers an integrity-check failure. (CVE-2014-3567)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to OpenSSL version 0.9.8zc or later.See Also
https://www.openssl.org/news/secadv/20141015.txt
Plugin Details
Severity: Critical
ID: 78552
File Name: openssl_0_9_8zc.nasl
Version: 1.20
Type: combined
Agent: windows, macosx, unix
Family: Web Servers
Published: 10/17/2014
Updated: 10/23/2024
Configuration: Enable thorough checks
Supported Sensors: Continuous Assessment, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2014-3568
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS Score Source: CVE-2014-3567
Vulnerability Information
CPE: cpe:/a:openssl:openssl
Required KB Items: installed_sw/OpenSSL
Exploit Ease: No known exploits are available
Patch Publication Date: 10/15/2014
Vulnerability Publication Date: 10/14/2014
Reference Information
CVE: CVE-2014-3567, CVE-2014-3568
CERT: 577193