Detections
Analytics
OracleVM 2.2 : openssl (OVMSA-2015-0030) (FREAK)
medium Nessus Plugin ID 81903
Language:
Synopsis
The remote OracleVM host is missing a security update.Description
The remote OracleVM system is missing necessary patches to address critical security updates :- Backport openssl 08-Jan-2015 security fixes (John Haxby) [orabug 20409893]
- fix CVE-2014-3570 - Bignum squaring may produce incorrect results
- fix CVE-2014-3571 - DTLS segmentation fault in dtls1_get_record
- fix CVE-2014-3572 - ECDHE silently downgrades to ECDH [Client]
- fix CVE-2014-8275 - Certificate fingerprints can be modified
- fix CVE-2015-0204 - RSA silently downgrades to EXPORT_RSA [Client]
- properly lock X509_STORE accesses (#1168938)
Solution
Update the affected openssl package.See Also
Plugin Details
Severity: Medium
ID: 81903
File Name: oraclevm_OVMSA-2015-0030.nasl
Version: 1.13
Type: local
Family: OracleVM Local Security Checks
Published: 3/18/2015
Updated: 1/4/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.2
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
Vulnerability Information
CPE: p-cpe:/a:oracle:vm:openssl, cpe:/o:oracle:vm_server:2.2
Required KB Items: Host/local_checks_enabled, Host/OracleVM/release, Host/OracleVM/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 3/17/2015
Vulnerability Publication Date: 1/8/2015
Reference Information
CVE: CVE-2014-3570, CVE-2014-3571, CVE-2014-3572, CVE-2014-8275, CVE-2015-0204