The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2537-1 advisory.

    It was discovered that OpenSSL incorrectly handled malformed EC private key files. A remote attacker could     possibly use this issue to cause OpenSSL to crash, resulting in a denial of service, or execute arbitrary     code. (CVE-2015-0209)

    Stephen Henson discovered that OpenSSL incorrectly handled comparing ASN.1 boolean types. A remote     attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service.
    (CVE-2015-0286)

    Emilia Ksper discovered that OpenSSL incorrectly handled ASN.1 structure reuse. A remote attacker could     possibly use this issue to cause OpenSSL to crash, resulting in a denial of service, or execute arbitrary     code. (CVE-2015-0287)

    Brian Carpenter discovered that OpenSSL incorrectly handled invalid certificate keys. A remote attacker     could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2015-0288)

    Michal Zalewski discovered that OpenSSL incorrectly handled missing outer ContentInfo when parsing PKCS#7     structures. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a     denial of service, or execute arbitrary code. (CVE-2015-0289)

    Robert Dugal and David Ramos discovered that OpenSSL incorrectly handled decoding Base64 encoded data. A     remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service,     or execute arbitrary code. (CVE-2015-0292)

    Sean Burford and Emilia Ksper discovered that OpenSSL incorrectly handled specially crafted SSLv2     CLIENT-MASTER-KEY messages. A remote attacker could possibly use this issue to cause OpenSSL to crash,     resulting in a denial of service. (CVE-2015-0293)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS : OpenSSL vulnerabilities (USN-2537-1)

critical Nessus Plugin ID 81971

Version 1.21