The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - openssl: Memory corruption in the ASN.1 encoder (CVE-2016-2108)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-7250, CVE-2012-1410. Reason: this     candidate was intended for one issue, but CVE users may have associated it with multiple unrelated issues.
    Notes: All CVE users should consult CVE-2006-7250 for the OpenSSL candidate or CVE-2012-1410 for the Kadu     candidate. All references and descriptions in this candidate have been removed to prevent accidental usage     (CVE-2006-7248)

  - The mime_hdr_cmp function in crypto/asn1/asn_mime.c in OpenSSL 0.9.8t and earlier allows remote attackers     to cause a denial of service (NULL pointer dereference and application crash) via a crafted S/MIME     message. (CVE-2006-7250)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Malicious clients could have downgraded a connection to a low strength cipher suite on session resumption if the server offers such ciphers (CVE-2010-4180). This has been fixed.

Versions of Mac OS X 10.6 earlier than 10.6.8 are potentially affected by a security issue.  Mac OS X 10.6.8 contains a security fix for the following products :

  - App Store

  - ATS

  - Certificate Trust Policy

  - CoreFoundation

  - CoreGraphics

  - FTP Server

  - ImageIO

  - International Components for Unicode

  - Kernel

  - Libsystem

  - libxslt

  - MobileMe

  - MySQL

  - OpenSSL

  - patch

  - QuickLook

  - QuickTime

  - Samba

  - servermgrd

  - subversion

Versions of OpenSSL earlier than 0.9.8q and 1.0.0c are potentially affected by multiple vulnerabilities :

  - It may be possible to downgrade the ciphersuite to a weaker version by modifying the stored session cache cipher suite.

  - An error exists in the J-PAKE implementation which could lead to successful validation by someone with no knowledge of the shared secret.

Versions of OpenSSL earlier than 0.9.8q and 1.0.0c are potentially affected by multiple vulnerabilities :

  - It may be possible to downgrade the ciphersuite to a weaker version by modifying the stored session cache cipher suite.

  - An error exists in the J-PAKE implementation which could lead to successful validation by someone with no knowledge of the shared secret.
IAVA Reference : 2011-A-0160
IAVB Reference : 2012-B-0038
STIG Finding Severity : Category I

Versions of Mac OS X 10.6 earlier than 10.6.8 are potentially affected by a security issue.  Mac OS X 10.6.8 contains a security fix for the following products :

  - App Store

  - ATS

  - Certificate Trust Policy

  - CoreFoundation

  - CoreGraphics

  - FTP Server

  - ImageIO

  - International Components for Unicode

  - Kernel

  - Libsystem

  - libxslt

  - MobileMe

  - MySQL

  - OpenSSL

  - patch

  - QuickLook

  - QuickTime

  - Samba

  - servermgrd

  - subversion
IAVA Reference : 2011-A-0160
IAVB Reference : 2012-B-0038
STIG Finding Severity : Category I

ID	Name	Product	Family	Published	Updated	Severity
199380	RHEL 4 : openssl (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	10/24/2024	critical
53640	SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 7463)	Nessus	SuSE Local Security Checks	5/4/2011	1/19/2021	medium
5968	Mac OS X 10.6 < 10.6.8 Multiple Vulnerabilities	Nessus Network Monitor	Generic	6/23/2011	3/6/2019	critical
5720	OpenSSL < 0.9.8q / 1.0.0c Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	12/7/2010	3/6/2019	medium
801055	OpenSSL < 0.9.8q / 1.0.0c Multiple Vulnerabilities	Log Correlation Engine	Web Servers	12/7/2010		medium
800790	Mac OS X 10.6 < 10.6.8 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	6/23/2011		high

Detections

Analytics

Plugins Search

critical

medium

critical

medium

medium

high