The Cisco AnyConnect Secure Mobility Client installed on the remote host is a version prior to 3.1.13015.0 or 4.2.x prior to 4.2.1035.0.
It is, therefore, affected by multiple vulnerabilities in the bundled version of OpenSSL :
  - A carry propagating flaw exists in the x86_64 Montgomery     squaring implementation that may cause the BN_mod_exp()     function to produce incorrect results. An attacker can     exploit this to obtain sensitive information regarding     private keys. (CVE-2015-3193)

  - A NULL pointer dereference flaw exists in file     rsa_ameth.c when handling ASN.1 signatures that use the     RSA PSS algorithm but are missing a mask generation     function parameter. A remote attacker can exploit this     to cause the signature verification routine to crash,     leading to a denial of service. (CVE-2015-3194)

  - A flaw exists in the ASN1_TFLG_COMBINE implementation in     file tasn_dec.c related to handling malformed     X509_ATTRIBUTE structures. A remote attacker can exploit     this to cause a memory leak by triggering a decoding     failure in a PKCS#7 or CMS application, resulting in a     denial of service. (CVE-2015-3195)

  - A race condition exists in s3_clnt.c that is triggered     when PSK identity hints are incorrectly updated in the     parent SSL_CTX structure when they are received by a     multi-threaded client. A remote attacker can exploit     this, via a crafted ServerKeyExchange message, to cause     a double-free memory error, resulting in a denial of     service. (CVE-2015-3196)

  - A flaw exists in the ssl3_get_key_exchange() function     in file s3_clnt.c when handling a ServerKeyExchange     message for an anonymous DH ciphersuite with the value     of 'p' set to 0. A attacker can exploit this, by causing     a segmentation fault, to crash an application linked     against the library, resulting in a denial of service.
    (CVE-2015-1794)

OpenSSL was update to fix security issues and bugs :

CVE-2016-0800 aka the 'DROWN' attack (bsc#968046): OpenSSL was vulnerable to a cross-protocol attack that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. This update changes the OpenSSL library to :

Disable SSLv2 protocol support by default. This can be overridden by setting the environment variable 'OPENSSL_ALLOW_SSL2' or by using SSL_CTX_clear_options using the SSL_OP_NO_SSLv2 flag. Note that various services and clients had already disabled SSL protocol 2 by default previously.

Disable all weak EXPORT ciphers by default. These can be re-enabled if required by old legacy software using the environment variable 'OPENSSL_ALLOW_EXPORT'.

CVE-2016-0797 (bsc#968048): The BN_hex2bn() and BN_dec2bn() functions had a bug that could result in an attempt to de-reference a NULL pointer leading to crashes. This could have security consequences if these functions were ever called by user applications with large untrusted hex/decimal data. Also, internal usage of these functions in OpenSSL uses data from config files or application command line arguments. If user developed applications generated config file data based on untrusted data, then this could have had security consequences as well.

CVE-2016-0799 (bsc#968374): On many 64 bit systems, the internal fmtstr() and doapr_outch() functions could miscalculate the length of a string and attempt to access out-of-bounds memory locations. These problems could have enabled attacks where large amounts of untrusted data is passed to the BIO_*printf functions. If applications use these functions in this way then they could have been vulnerable. OpenSSL itself uses these functions when printing out human-readable dumps of ASN.1 data. Therefore applications that print this data could have been vulnerable if the data is from untrusted sources. OpenSSL command line applications could also have been vulnerable when they print out ASN.1 data, or if untrusted data is passed as command line arguments.
Libssl is not considered directly vulnerable.

CVE-2015-3197 (bsc#963415): The SSLv2 protocol did not block disabled ciphers.

CVE-2015-3195 (bsc#957812): An X509_ATTRIBUTE memory leak was fixed.

Fixed a regression caused by the openssl-CVE-2015-0287.patch (bsc#937492)

Note that the March 1st 2016 release also references following CVEs that were fixed by us with CVE-2015-0293 in 2015 :

CVE-2016-0703 (bsc#968051): This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above 'DROWN' attack much easier.

CVE-2016-0704 (bsc#968053): 'Bleichenbacher oracle in SSLv2' This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above 'DROWN' attack much easier.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix CVE-2016-2105 - possible overflow in base64 encoding

  - fix CVE-2016-2106 - possible overflow in     EVP_EncryptUpdate

  - fix CVE-2016-2107 - padding oracle in stitched AES-NI     CBC-MAC

  - fix CVE-2016-2108 - memory corruption in ASN.1 encoder

  - fix CVE-2016-2109 - possible DoS when reading ASN.1 data     from BIO

  - fix CVE-2016-0799 - memory issues in BIO_printf

  - fix CVE-2016-0702 - side channel attack on modular     exponentiation

  - fix CVE-2016-0705 - double-free in DSA private key     parsing

  - fix CVE-2016-0797 - heap corruption in BN_hex2bn and     BN_dec2bn

  - fix CVE-2015-3197 - SSLv2 ciphersuite enforcement

  - disable SSLv2 in the generic TLS method

  - fix 1-byte memory leak in pkcs12 parse (#1229871)

  - document some options of the speed command (#1197095)

  - fix high-precision timestamps in timestamping authority

  - fix CVE-2015-7575 - disallow use of MD5 in TLS1.2

  - fix CVE-2015-3194 - certificate verify crash with     missing PSS parameter

  - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak

  - fix CVE-2015-3196 - race condition when handling PSK     identity hint

According to its banner, the version of HP System Management Homepage (SMH) hosted on the remote web server is affected by the following vulnerabilities :

  - A denial of service vulnerability exists in the Apache     HTTP Server due to the lack of the mod_reqtimeout     module. An unauthenticated, remote attacker can exploit     this, via a saturation of partial HTTP requests, to     cause a daemon outage. (CVE-2007-6750)

  - A cross-site scripting (XSS) vulnerability exists in     jQuery when using location.hash to select elements. An     unauthenticated, remote attacker can exploit this, via     a specially crafted tag, to inject arbitrary script     code or HTML into the user's browser session.
    (CVE-2011-4969)

  - A NULL pointer dereference flaw exists in file     rsa_ameth.c due to improper handling of ASN.1 signatures     that are missing the PSS parameter. A remote attacker     can exploit this to cause the signature verification     routine to crash, resulting in a denial of service     condition. (CVE-2015-3194)

  - A flaw exists in the ASN1_TFLG_COMBINE implementation in     file tasn_dec.c related to handling malformed     X509_ATTRIBUTE structures. A remote attacker can exploit     this to cause a memory leak by triggering a decoding     failure in a PKCS#7 or CMS application, resulting in a     denial of service. (CVE-2015-3195)

  - An out-of-bounds read error exists in cURL and libcurl     within the smb_request_state() function due to improper     bounds checking. An unauthenticated, remote attacker     can exploit this, using a malicious SMB server and     crafted length and offset values, to disclose sensitive     memory information or to cause a denial of service     condition. (CVE-2015-3237)

  - A flaw exists in libxslt in the xsltStylePreCompute()     function within file preproc.c due to a failure to check     if the parent node is an element. An unauthenticated,     remote attacker can exploit this, via a specially     crafted XML file, to cause a denial of service     condition. (CVE-2015-7995)

  - An infinite loop condition exists in the xz_decomp()     function within file xzlib.c when handling xz compressed     XML content due to a failure to detect compression     errors. An unauthenticated, remote attacker can exploit     this, via specially crafted XML data, to cause a denial     of service condition. (CVE-2015-8035)

  - A double-free error exists due to improper validation of     user-supplied input when parsing malformed DSA private     keys. A remote attacker can exploit this to corrupt     memory, resulting in a denial of service condition or     the execution of arbitrary code. (CVE-2016-0705)

  - An out-of-bounds read error exists in the fmtstr()     function within file crypto/bio/b_print.c when printing     very long strings due to a failure to properly calculate     string lengths. An unauthenticated, remote attacker can     exploit this, via a long string, to cause a denial of     service condition, as demonstrated by a large amount of     ASN.1 data. (CVE-2016-0799)

  - An unspecified flaw exists that allows a local attacker     to impact the confidentiality and integrity of the     system. No other details are available. (CVE-2016-2015)

  - A flaw exists in the doapr_outch() function within file     crypto/bio/b_print.c due to a failure to verify that a     certain memory allocation succeeds. An unauthenticated,     remote attacker can exploit this, via a long string,     to cause a denial of service condition, as demonstrated     by a large amount of ASN.1 data. (CVE-2016-2842)

The version of MySQL installed on the remote host is 5.5.x prior to 5.5.48, 5.6.x prior to 5.6.29, or 5.7.x prior to 5.7.11, and is affected by vulnerabilities in the following components :

 - Data Manipulation Language
 - Data Definition Language
 - Full-Text Search
 - MyISAM
 - PeopleSoft
 - Performance Schema
 - Pluggable Authentication
 - Replication
 - Server Connection
 - Server:Security
 - Server:InnoDB
 - Server:Optimizer
 - Server:Options


The remote host is running a version of Mac OS X version 10.11.x prior to 10.11.4 and is affected by multiple vulnerabilities in the following components :

 - apache_mod_php
 - AppleRAID
 - AppleUSBNetworking
 - Bluetooth
 - Carbon
 - dyld
 - FontParser
 - HTTPProtocol
 - Intel Graphics Driver
 - IOFireWireFamily
 - IOGraphics
 - IOHIDFamily
 - IOUSBFamily
 - Kernel
 - libxml2
 - Messages
 - NVIDIA Graphics Drivers
 - OpenSSH
 - OpenSSL
 - Python
 - QuickTime
 - Reminders
 - Ruby
 - Security
 - Tcl
 - TrueTypeScaler
 - Wi-Fi

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	Name	Product	Family	Published	Updated	Severity
88100	Cisco AnyConnect Secure Mobility Client < 3.1.13015.0 / 4.2.x < 4.2.1035.0 Multiple OpenSSL Vulnerabilities	Nessus	Windows	1/22/2016	7/6/2018	medium
89731	SUSE SLES10 Security Update : OpenSSL (SUSE-SU-2016:0678-1) (DROWN)	Nessus	SuSE Local Security Checks	3/8/2016	1/6/2021	critical
91154	OracleVM 3.3 / 3.4 : openssl (OVMSA-2016-0049) (SLOTH)	Nessus	OracleVM Local Security Checks	5/16/2016	1/4/2021	critical
91222	HP System Management Homepage Multiple Vulnerabilities (HPSBMU03593)	Nessus	Web Servers	5/18/2016	4/11/2022	critical
9259	Oracle MySQL 5.5.x < 5.5.48 / 5.6.x < 5.6.29 / 5.7.x < 5.7.11 Multiple Vulnerabilities	Nessus Network Monitor	Database	4/18/2016	3/6/2019	medium
9327	Mac OS X 10.11.x < 10.11.4 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	5/27/2016	3/6/2019	critical
503118	Siemens SCALANCE X-200RNA Switch Devices Exposure of Sensitive Information to an Unauthorized Actor (CVE-2015-3195)	Tenable OT Security	Tenable.ot	3/13/2025	3/13/2025	medium

Detections

Analytics

Plugins Search

medium

critical

critical

critical

medium

critical

medium