Detections
Analytics

FreeBSD : OpenSSL -- multiple vulnerabilities (4e536c14-9791-11e4-977d-d050992ecde8) (FREAK)

medium Nessus Plugin ID 80424

Language:

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

OpenSSL project reports :

DTLS segmentation fault in dtls1_get_record (CVE-2014-3571)

DTLS memory leak in dtls1_buffer_record (CVE-2015-0206)

no-ssl3 configuration sets method to NULL (CVE-2014-3569)

ECDHE silently downgrades to ECDH [Client] (CVE-2014-3572)

RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204)

DH client certificates accepted without verification [Server] (CVE-2015-0205)

Certificate fingerprints can be modified (CVE-2014-8275)

Bignum squaring may produce incorrect results (CVE-2014-3570)

Solution

Update the affected packages.

See Also

https://www.openssl.org/news/secadv/20150108.txt

http://www.nessus.org/u?80b933c4

Plugin Details

Severity: Medium

ID: 80424

File Name: freebsd_pkg_4e536c14979111e4977dd050992ecde8.nasl

Version: 1.14

Type: local

Published: 1/9/2015

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.2

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:linux-c6-openssl, p-cpe:/a:freebsd:freebsd:mingw32-openssl, p-cpe:/a:freebsd:freebsd:openssl, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 1/8/2015

Vulnerability Publication Date: 1/8/2015

Reference Information

CVE: CVE-2014-3569, CVE-2014-3570, CVE-2014-3571, CVE-2014-3572, CVE-2014-8275, CVE-2015-0204, CVE-2015-0205, CVE-2015-0206

FreeBSD: SA-15:01.openssl