Detections
Analytics
OpenSSL < 0.9.8zc / < 1.0.0o / < 1.0.1j Multiple Vulnerabilities
high Nessus Network Monitor Plugin ID 8552
Synopsis
The remote web server is running an outdated instance of OpenSSL and thus may be missing patches for multiple vulnerabilities.Description
OpenSSL before 0.9.8zc, 1.0.0o, or 1.0.1j are unpatched for the following vulnerabilities:- Memory leak in the DTLS SRTP extension parsing code that can be triggered during a handshake to cause a denial of service. (CVE-2014-3513)
- Memory leak in the way SSL, TLS, and DTLS servers handle a session ticket that has failed to have its integrity properly verified (CVE-2014-3567)
- The 'no_ssl3' build option is not properly honored, which can cause insecure SSL 3.0 handshakes (re: CVE-2014-3566) to be accepted. (CVE-2014-3568)
Solution
OpenSSL versions 0.9.8zc, 1.0.0o, and 1.0.1j are patched against these vulnerabilities. Apply the vendors patch, or update to these versions or later.See Also
Plugin Details
Severity: High
ID: 8552
Family: Web Servers
Published: 10/16/2014
Updated: 3/6/2019
Risk Information
VPR
Risk Factor: Medium
Score: 5.1
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: High
Base Score: 7.3
Temporal Score: 7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:openssl:openssl
Patch Publication Date: 10/15/2014
Vulnerability Publication Date: 10/15/2014