OpenSSL Team 报告：

修复了 OpenSSL 1.0.0e 中的两个安全缺陷：

在某些情况下，OpenSSL 的内部证书验证例程可错误接受 nextUpdate 字段为过去的 CRL。(CVE-2011-3207)

临时 ECDH 加密套件的 OpenSSL 服务器代码线程不安全，而且，若客户端以错误顺序发送握手消息而违反通讯协议，可能因此而崩溃。
(CVE-2011-3210)

远程主机上安装的 OpenSSL 版本低于 1.0.0e。因此，它受到公告 1.0.0e 中提及的多个漏洞影响。

  - 在 0.9.8s 之前的 OpenSSL、1.0.0e 之前的 OpenSSL 1.0.0、1.0.1n 之前的 OpenSSL 1.0.1 以及 1.0.2b 之前的 OpenSSL 1.0.2 中，crypto/bn/bn_gf2m.c 中的 BN_GF2m_mod_inv 函数无法正确处理其中曲线超出不规范二进制多项式字段的 ECParameters 结构，这允许远程攻击者通过使用椭圆曲线算法的会话造成拒绝服务（无限循环），这一点已由支持客户端认证的服务器所遭受的攻击证实。(CVE-2015-1788)

  - 0.9.8 至 0.9.8r 版以及 1.0.0e 之前的 1.0.x 版 OpenSSL 中，临时 ECDH 加密套件功能无法在处理来自客户端的握手消息期间确保线程安全，这允许远程攻击者通过违反 TLS 协议的顺序错误消息造成拒绝服务（后台程序崩溃）。(CVE-2011-3210)

  - 在 1.0.0e 之前的 OpenSSL 1.0.x 中，crypto/x509/x509_vfy.c 不会初始化某些结构成员，这使远程攻击者能够更轻松地通过对应过去某个时间段的 nextUpdate 值绕过 CRL 验证。(CVE-2011-3207)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

OpenSSL 的内部证书验证例程可能会错误地接受其 nextUpdate 字段为过去的 CRL (CVE-2011-3207)。

用于 ECDH 的服务器代码在收到特别构建的握手消息时可能会崩溃 (CVE-2011-3210)。

Versions of OpenSSL 1.0.0 earlier than and 1.0.0e are potentially affected by the following vulnerabilities : 

  - An error exists in the internal certificate verification process that can allow improper acceptance of a certificate revolcation list (CRL) if the lists's 'nextUpdate' field contains a date in teh past.  Note that this internal CRL checking is not enabled by defaut. (CVE-2011-3207)

  - An error exists in the code for the ephemeral (EC)DH ciphersuites that can allow a remote attacker to crash the process. (CVE-2011-3210)

The remote host is running a version of Mac OS X 10.8 that is older than 10.8.4. The newer version contains numerous security-related fixes :

  - A local security-bypass vulnerability exists that affects the Disk Management component. The issue can be exploited by an unauthorized attacker to disable FileVault using the command-line. (CVE-2013-0985)

  - A security-bypass vulnerability in SMB file sharing can occur whereby an authenticated attacker can write files outside the shared directory. (CVE-2013-0990)

  - A remote buffer-overflow vulnerability exists when handling certain PICT images. (CVE-2013-0975)

  - A security-bypass vulnerability exists whereby an attacker with access to a user's session may be able to log into previously accessed sites. An attacker can exploit this issue even if Private Browsing was used. (CVE-2013-0982)

  - A remote-code execution issue affects the text glyphs because of an unbounded stack allocation when handling maliciously crafted URLs. (CVE-2013-0983)

  - A remote-code execution vulnerability exists due to improper handling of text tracks. (CVE-2013-1024)

  - A buffer-overflow vulnerability exists in the Directory Service daemon that can be exploited via a specially crafted network message. (CVE-2013-0984)

ID	Name	Product	Family	Published	Updated	Severity
56117	FreeBSD：OpenSSL -- 多种漏洞 (2ecb7b20-d97e-11e0-b2e2-00215c6a37bb)	Nessus	FreeBSD Local Security Checks	9/8/2011	1/6/2021	medium
56162	OpenSSL 1.0.0 < 1.0.0e 多个漏洞	Nessus	Web Servers	9/12/2011	6/7/2024	medium
75597	openSUSE 安全更新：libopenssl-devel (openSUSE-SU-2011:1144-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	medium
6022	OpenSSL 1.x < 1.0.0e Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	9/6/2011	3/6/2019	medium
6857	Mac OS X 10.8 < 10.8.4 Multiple Vulnerabilities (Security Update 2013-002)	Nessus Network Monitor	Web Clients	6/5/2013	3/6/2019	critical
801065	OpenSSL 1.x < 1.0.0e Multiple Vulnerabilities	Log Correlation Engine	Web Servers	9/6/2011		medium
801016	Mac OS X 10.8 < 10.8.4 Multiple Vulnerabilities (Security Update 2013-002)	Log Correlation Engine	Operating System Detection	6/5/2013		high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

critical

medium

high