The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-005 applied.

This security update contains fixes for the following products :

  - Alias Manager
  - CarbonCore
  - ClamAV
  - ColorSync
  - CoreGraphics
  - CUPS
  - Flash Player plug-in
  - ImageIO
  - Launch Services
  - MySQL
  - PHP
  - SMB
  - Wiki Server

This update of openssl fixes the following problems :

  - ASN1_STRING_print_ex() function allows remote denial of     service. (CVE-2009-0590)

  - CMS_verify() function allows signatures to look valid.
    (CVE-2009-0591)

  - denial of service due to malformed ASN.1 structures.
    (CVE-2009-0789)

New openssl packages are available for Slackware 11.0, 12.0, 12.1, 12.2, and -current to fix security issues.

The version of OpenSSL installed on the remote host is prior to 0.9.8k. It is, therefore, affected by multiple vulnerabilities as referenced in the 0.9.8k advisory.

  - OpenSSL before 0.9.8k on WIN64 and certain other platforms does not properly handle a malformed ASN.1     structure, which allows remote attackers to cause a denial of service (invalid memory access and     application crash) by placing this structure in the public key of a certificate, as demonstrated by an RSA     public key. (CVE-2009-0789)

  - The CMS_verify function in OpenSSL 0.9.8h through 0.9.8j, when CMS is enabled, does not properly handle     errors associated with malformed signed attributes, which allows remote attackers to repudiate a signature     that originally appeared to be valid but was actually invalid. (CVE-2009-0591)

  - The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of     service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString     or (2) UniversalString with an invalid encoded length. (CVE-2009-0590)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the remote server is running a version of OpenSSL that is earlier than 0.9.8k.  As such, it may allow a valid sign to generate invalid signatures which would appear valid and could be repudiated later. 

This only affects CMS users.  CMS appeared in OpenSSL 0.9.8h.

This update of openssl fixes the following problems :

  - CVE-2009-0590: ASN1_STRING_print_ex() function allows     remote denial of service

  - CVE-2009-0591: CMS_verify() function allows signatures     to look valid

  - CVE-2009-0789: denial of service due to malformed ASN.1     structures

ID	Name	Product	Family	Published	Updated	Severity
40945	Mac OS X Multiple Vulnerabilities (Security Update 2009-005)	Nessus	MacOS X Local Security Checks	9/11/2009	5/28/2024	critical
41423	SuSE 11 Security Update : OpenSSL (SAT Patch Number 772)	Nessus	SuSE Local Security Checks	9/24/2009	1/14/2021	medium
36104	Slackware 11.0 / 12.0 / 12.1 / 12.2 / current : openssl (SSA:2009-098-01)	Nessus	Slackware Local Security Checks	4/8/2009	1/14/2021	medium
17763	OpenSSL 0.9.8 < 0.9.8k Multiple Vulnerabilities	Nessus	Web Servers	1/4/2012	10/23/2024	high
17764	OpenSSL < 0.9.8k Signature Repudiation	Nessus	Web Servers	1/4/2012	10/7/2024	low
40260	openSUSE Security Update : libopenssl-devel (libopenssl-devel-786)	Nessus	SuSE Local Security Checks	7/21/2009	1/14/2021	medium

Detections

Analytics

Plugins Search

critical

medium

medium

high

low

medium