ID CVE-2017-3731
Summary If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.
References
Vulnerable Configurations
  • OpenSSL Project OpenSSL 1.1.0a
    cpe:2.3:a:openssl:openssl:1.1.0a
  • OpenSSL Project OpenSSL 1.1.0b
    cpe:2.3:a:openssl:openssl:1.1.0b
  • OpenSSL Project OpenSSL 1.1.0c
    cpe:2.3:a:openssl:openssl:1.1.0c
  • OpenSSL Project OpenSSL 1.0.2
    cpe:2.3:a:openssl:openssl:1.0.2
  • OpenSSL Project OpenSSL 1.0.2-beta1
    cpe:2.3:a:openssl:openssl:1.0.2:beta1
  • OpenSSL 1.0.2 Beta 2
    cpe:2.3:a:openssl:openssl:1.0.2:beta2
  • OpenSSL 1.0.2 Beta 3
    cpe:2.3:a:openssl:openssl:1.0.2:beta3
  • OpenSSL OpenSSL 1.0.2a
    cpe:2.3:a:openssl:openssl:1.0.2a
  • OpenSSL Project OpenSSL 1.0.2b
    cpe:2.3:a:openssl:openssl:1.0.2b
  • OpenSSL Project OpenSSL 1.0.2c
    cpe:2.3:a:openssl:openssl:1.0.2c
  • OpenSSL OpenSSL 1.0.2d
    cpe:2.3:a:openssl:openssl:1.0.2d
  • OpenSSL 1.0.2e
    cpe:2.3:a:openssl:openssl:1.0.2e
  • OpenSSL 1.0.2f
    cpe:2.3:a:openssl:openssl:1.0.2f
  • OpenSSL 1.0.2h
    cpe:2.3:a:openssl:openssl:1.0.2h
  • OpenSSL Project OpenSSL 1.0.2i
    cpe:2.3:a:openssl:openssl:1.0.2i
  • OpenSSL1.0.2j
    cpe:2.3:a:openssl:openssl:1.0.2j
CVSS
Base: 5.0
Impact:
Exploitability:
CWE CWE-125
CAPEC
  • Overread Buffers
    An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.
nessus via4
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2017-1196.NASL
    description This update for mysql-community-server to 5.6.38 fixes the following issues : Full list of changes : http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-38.html CVEs fixed : - [boo#1064116] CVE-2017-10379 - [boo#1064117] CVE-2017-10384 - [boo#1064115] CVE-2017-10378 - [boo#1064101] CVE-2017-10268 - [boo#1064096] CVE-2017-10155 - [boo#1064118] CVE-2017-3731 - [boo#1064102] CVE-2017-10276 - [boo#1064105] CVE-2017-10283 - [boo#1064112] CVE-2017-10314 - [boo#1064100] CVE-2017-10227 - [boo#1064104] CVE-2017-10279 - [boo#1064108] CVE-2017-10294 - [boo#1064107] CVE-2017-10286 Additional changes : - add 'BuildRequires: unixODBC-devel' to allow ODBC support for Connect engine [boo#1039034] - update filename in /var/adm/update-messages to match documentation, and build-compare pattern - some scripts from the tools subpackage, namely: wsrep_sst_xtrabackup, wsrep_sst_mariabackup.sh and wsrep_sst_xtrabackup-v2.sh need socat - fixed incorrect descriptions and mismatching RPM groups
    last seen 2018-01-27
    modified 2018-01-26
    plugin id 104234
    published 2017-10-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=104234
    title openSUSE Security Update : mysql-community-server (openSUSE-2017-1196)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201702-07.NASL
    description The remote host is affected by the vulnerability described in GLSA-201702-07 (OpenSSL: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in OpenSSL. Please review the CVE identifiers referenced below for details. Impact : A remote attacker is able to crash applications linked against OpenSSL or could obtain sensitive private-key information via an attack against the Diffie-Hellman (DH) ciphersuite. Workaround : There is no known workaround at this time.
    last seen 2018-01-27
    modified 2018-01-26
    plugin id 97183
    published 2017-02-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97183
    title GLSA-201702-07 : OpenSSL: Multiple vulnerabilities
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2017-E853B4144F.NASL
    description Minor upstream release fixing CVE-2016-8610, CVE-2017-3731, CVE-2017-3732. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-02-04
    modified 2018-02-02
    plugin id 97180
    published 2017-02-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97180
    title Fedora 24 : 1:openssl (2017-e853b4144f)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2017-255.NASL
    description This update for openssl fixes the following issues contained in the OpenSSL Security Advisory [26 Jan 2017] (bsc#1021641) Security issues fixed : - CVE-2016-7056: A local ECSDA P-256 timing attack that might have allowed key recovery was fixed (bsc#1019334) - CVE-2016-8610: A remote denial of service in SSL alert handling was fixed (bsc#1005878) - CVE-2016-2108: Added a missing commit for CVE-2016-2108, fixing the negative zero handling in the ASN.1 decoder (bsc#1004499) - CVE-2017-3731: Truncated packet could crash via OOB read (bsc#1022085, CVE-2017-3731) - Degrade the 3DES cipher to MEDIUM in SSLv2 (bsc#1001912) Bugs fixed : - fix crash in openssl speed (bsc#1000677) - fix ca-bundle path (bsc#1022271) This update was imported from the SUSE:SLE-12-SP1:Update update project.
    last seen 2017-10-29
    modified 2017-07-20
    plugin id 97275
    published 2017-02-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97275
    title openSUSE Security Update : openssl (openSUSE-2017-255)
  • NASL family Slackware Local Security Checks
    NASL id SLACKWARE_SSA_2017-041-02.NASL
    description New openssl packages are available for Slackware 14.2 and -current to fix security issues.
    last seen 2018-01-27
    modified 2018-01-26
    plugin id 97102
    published 2017-02-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97102
    title Slackware 14.2 / current : openssl (SSA:2017-041-02)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2017-3451DBEC48.NASL
    description Minor upstream release fixing CVE-2016-8610, CVE-2017-3731, CVE-2017-3732. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-02-02
    modified 2018-02-01
    plugin id 97054
    published 2017-02-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97054
    title Fedora 25 : 1:openssl (2017-3451dbec48)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2017-442.NASL
    description This update for nodejs4 fixes the following issues : - New upstream LTS release 4.7.3 The embedded openssl sources were updated to 1.0.2k (CVE-2017-3731, CVE-2017-3732, CVE-2016-7055, bsc#1022085, bsc#1022086, bsc#1009528) - No changes in LTS version 4.7.2 - New upstream LTS release 4.7.1 - build: shared library support is now working for AIX builds - repl: passing options to the repl will no longer overwrite defaults - timers: recanceling a cancelled timers will no longer throw - New upstream LTS version 4.7.0 - build: introduce the configure --shared option for embedders - debugger: make listen address configurable in debugger server - dgram: generalized send queue to handle close, fixing a potential throw when dgram socket is closed in the listening event handler - http: introduce the 451 status code 'Unavailable For Legal Reasons' - gtest: the test reporter now outputs tap comments as yamlish - tls: introduce secureContext for tls.connect (useful for caching client certificates, key, and CA certificates) - tls: fix memory leak when writing data to TLSWrap instance during handshake - src: node no longer aborts when c-ares initialization fails - ported and updated system CA store for the new node crypto code - New upstream LTS version 4.6.2 - build : + It is now possible to build the documentation from the release tarball. - buffer : + Buffer.alloc() will no longer incorrectly return a zero filled buffer when an encoding is passed. - deps : + Upgrade npm in LTS to 2.15.11. - repl : + Enable tab completion for global properties. - url : + url.format() will now encode all '#' in search. - Add missing conflicts to base package. It's not possible to have concurrent nodejs installations. - enable usage of system certificate store on SLE11SP4 by requiring openssl1 (bsc#1000036) This update was imported from the SUSE:SLE-12:Update update project.
    last seen 2018-01-27
    modified 2018-01-26
    plugin id 99212
    published 2017-04-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99212
    title openSUSE Security Update : nodejs4 (openSUSE-2017-442)
  • NASL family Virtuozzo Local Security Checks
    NASL id VIRTUOZZO_VZLSA-2017-0286.NASL
    description An update for openssl is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es) : * An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite. (CVE-2017-3731) * A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610) Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-07-21
    modified 2018-07-17
    plugin id 101424
    published 2017-07-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=101424
    title Virtuozzo 7 : openssl / openssl-devel / openssl-libs / etc (VZLSA-2017-0286)
  • NASL family Misc.
    NASL id ORACLE_SECURE_GLOBAL_DESKTOP_APR_2017_CPU.NASL
    description The version of Oracle Secure Global Desktop installed on the remote host is 4.71, 5.2, or 5.3 and is missing a security patch from the April 2017 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities : - An integer overflow condition exists in the Window System (X11) subcomponent in multiple functions in X.Org libExt due to improper validation of user-supplied input when calculating the amount of memory required to handle return data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. Note that this issue only affects version 4.71. (CVE-2013-1982) - An integer overflow condition exists in X.Org libXfixes in the XFixesGetCursorImage() function when handling large cursor dimensions or name lengths due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-1983) - An integer overflow condition exists within multiple functions in X.Org libXi due to improper validation of user-supplied input when calculating the amount of memory needed to handle return data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-1984) - An integer overflow condition exists in X.Org libXinerama in the XineramaQueryScreens() function due to improper validation of user-supplied input when calculating the amount of memory needed to handle return data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-1985) - An integer overflow condition exists in multiple functions in X.Org libXrandr due to improper validation of user-supplied input when calculating the amount of memory needed to handle return data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-1986) - An integer overflow condition exists in multiple functions in X.Org libXrender due to improper validation of user-supplied input when calculating the amount of memory needed to handle return data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-1987) - An overflow condition exists in X.Org libXi in the XListInputDevices() function, related to an unexpected sign extension, due to improper checking of the amount of memory needed to handle returned data when converting smaller integer types to larger ones. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-1995) - An overflow condition exists within multiple functions in X.Org LibXi due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted length or index, to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-1998) - An overflow condition exists in X.Org LibXt in the _XtResourceConfigurationEH() function due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted length or index, to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-2002) - An integer overflow condition exists in X.Org libXcursor in the _XcursorFileHeaderCreate() function due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-2003) - An uninitialized pointer flaw exists within multiple functions in X.Org LibXt due to a failure to check for proper initialization of pointers. An unauthenticated, remote attacker can exploit this to corrupt memory, resulting in a denial of service condition or the possible execution of arbitrary code. (CVE-2013-2005) - A flaw exists in the Application Server subcomponent (Apache Tomcat) due to a failure to process passwords when they are paired with non-existent usernames. An authenticated, remote attacker can exploit this, via a timing attack, to enumerate user account names. (CVE-2016-0762) - Multiple integer overflow conditions exist in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit these to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the 'openssl ts' command, to cause a denial of service or to disclose sensitive information. (CVE-2016-2180) - A denial of service vulnerability exists in the Anti-Replay feature in the DTLS implementation due to improper handling of epoch sequence numbers in records. An unauthenticated, remote attacker can exploit this, via spoofed DTLS records, to cause legitimate packets to be dropped. (CVE-2016-2181) - An overflow condition exists in the BN_bn2dec() function in bn_print.c due to improper validation of user-supplied input when handling BIGNUM values. An unauthenticated, remote attacker can exploit this to crash the process. (CVE-2016-2182) - A vulnerability exists, known as SWEET32, in the 3DES and Blowfish algorithms due to the use of weak 64-bit block ciphers by default. A man-in-the-middle attacker who has sufficient resources can exploit this vulnerability, via a 'birthday' attack, to detect a collision that leaks the XOR between the fixed secret and a known plaintext, allowing the disclosure of the secret text, such as secure HTTPS cookies, and possibly resulting in the hijacking of an authenticated session. (CVE-2016-2183) - A flaw exists in the Core subcomponent, specifically in the libcurl library, due to improper validation of TLS certificates. An authenticated, remote attacker with the ability to intercept network traffic can exploit this issue to disclose or manipulate transmitted data by spoofing the TLS/SSL server using a certificate that appears valid. Note that this issue only affects versions 5.2 and 5.3. (CVE-2016-3739) - A flaw exists in cURL and libcurl when loading dynamic link library (DLL) files security.dll, secur32.dll, or ws2_32.dll due searching an insecure path which may not be trusted or under user control. A local attacker can exploit this, via a Trojan DLL file placed in the search path, to execute arbitrary code with the privileges of the user running the program. (CVE-2016-4802) - A security bypass vulnerability exists in Apache Tomcat due to an unspecified flaw related to web applications. A local attacker can exploit this, via a utility method that is available to web applications, to bypass a configured SecurityManager. (CVE-2016-5018) - An out-of-bounds access error exists in the Window System (X11) subcomponent, specifically in the XvQueryAdaptors() function in file Xv.c, when handling server responses. An authenticated, remote attacker can exploit this to impact confidentiality, integrity, and availability. (CVE-2016-5407) - A use-after-free error exists in cURL and libcurl within file lib/vtls/vtls.c due to the program attempting to resume TLS sessions even if the client certificate fails. An unauthenticated, remote attacker can exploit this to bypass validation mechanisms, allowing the attacker to possibly control which connection is used. (CVE-2016-5419) - A flaw exists in cURL and libcurl in the Curl_ssl_config_matches() function within file lib/vtls/vtls.c due to the program reusing TLS connections with different client certificates. An unauthenticated, remote attacker can exploit this to disclose sensitive cross-realm information. (CVE-2016-5420) - A use-after-free error exists in cURL and libcurl in in the close_all_connections() function within file lib/multi.c due to connection pointers not being properly cleared. An unauthenticated, remote attacker can exploit this to have an unspecified impact on confidentiality, integrity, and availability. (CVE-2016-5421) - A flaw exists in the tls_decrypt_ticket() function in t1_lib.c due to improper handling of ticket HMAC digests. An unauthenticated, remote attacker can exploit this, via a ticket that is too short, to crash the process, resulting in a denial of service. (CVE-2016-6302) - An integer overflow condition exists in the MDC2_Update() function in mdc2dgst.c due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a heap-based buffer overflow, resulting in a denial of service condition or possibly the execution of arbitrary code. (CVE-2016-6303) - A flaw exists in the ssl_parse_clienthello_tlsext() function in t1_lib.c due to improper handling of overly large OCSP Status Request extensions from clients. An unauthenticated, remote attacker can exploit this, via large OCSP Status Request extensions, to exhaust memory resources, resulting in a denial of service condition. (CVE-2016-6304) - A flaw exists in the SSL_peek() function in rec_layer_s3.c due to improper handling of empty records. An unauthenticated, remote attacker can exploit this, by triggering a zero-length record in an SSL_peek call, to cause an infinite loop, resulting in a denial of service condition. (CVE-2016-6305) - An out-of-bounds read error exists in the certificate parser that allows an unauthenticated, remote attacker to cause a denial of service via crafted certificate operations. (CVE-2016-6306) - A denial of service vulnerability exists in the state-machine implementation due to a failure to check for an excessive length before allocating memory. An unauthenticated, remote attacker can exploit this, via a crafted TLS message, to exhaust memory resources. (CVE-2016-6307) - A denial of service vulnerability exists in the DTLS implementation due to improper handling of excessively long DTLS messages. An unauthenticated, remote attacker can exploit this, via a crafted DTLS message, to exhaust available memory resources. (CVE-2016-6308) - A flaw exists in Apache Tomcat within SecurityManager due to improper restriction of access to system properties by the configuration files system property replacement feature. A local attacker can exploit this, via a crafted web application, to bypass SecurityManager restrictions and disclose system properties. (CVE-2016-6794) - A flaw exists in Apache Tomcat that allows a local attacker to bypass a configured SecurityManager by changing the configuration parameters for the JSP Servlet. (CVE-2016-6796) - A flaw exists in Apache Tomcat due to a failure to limit web application access to global JNDI resources. A local attacker can exploit this to gain unauthorized access to resources. (CVE-2016-6797) - A flaw exists in Apache Tomcat when handling request lines containing certain invalid characters. An unauthenticated, remote attacker can exploit this to conduct HTTP response splitting attacks by injecting additional headers into responses. (CVE-2016-6816) - An infinite loop condition exists in Apache Tomcat in the HTTP/2 parser when handling overly large headers. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to cause a denial of service condition. (CVE-2016-6817) - A carry propagation error exists in the Broadwell-specific Montgomery multiplication procedure when handling input lengths divisible by but longer than 256 bits. This can result in transient authentication and key negotiation failures or reproducible erroneous outcomes of public-key operations with specially crafted input. A man-in-the-middle attacker can possibly exploit this issue to compromise ECDH key negotiations that utilize Brainpool P-512 curves. (CVE-2016-7055) - A flaw exists in cURL in the Curl_cookie_init() function within file lib/cookie.c when handling cookies. An unauthenticated, remote attacker can exploit this to inject new cookies for arbitrary domains. (CVE-2016-8615) - A flaw exists in cURL in the ConnectionExists() function within file lib/url.c when checking credentials supplied for reused connections due to the comparison being case-insensitive. An unauthenticated, remote attacker can exploit this to authenticate without knowing the proper case of the username and password. (CVE-2016-8616) - An integer overflow condition exists in cURL in the base64_encode() function within file lib/base64.c due to improper validation of certain input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-8617) - A denial of service vulnerability exists in cURL in the alloc_addbyter() function within file lib/mprintf.c due to improper validation of overly long input when it is supplied to the curl_maprintf() API method. An unauthenticated, remote attacker can exploit this to free already freed memory and thereby crash the program. (CVE-2016-8618) - A double-free error exists in cURL in the read_data() function within file lib/security.c when handling Kerberos authentication. An unauthenticated, remote attacker can exploit this to free already freed memory, resulting in an unspecified impact on confidentiality, integrity, and availability. (CVE-2016-8619) - An out-of-bounds access error exists in cURL in file tool_urlglob.c within the globbing feature. An unauthenticated, remote attacker can exploit this to disclose memory contents or execute arbitrary code. (CVE-2016-8620) - An out-of-bounds error exists in cURL in the parsedate() function within file lib/parsedate.c when handling dates. An unauthenticated, remote attacker can exploit this to disclose memory contents or cause a denial of service condition. (CVE-2016-8621) - An integer truncation error exists in cURL in the curl_easy_unescape() function within file lib/escape.c when handling overly large URLs. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-8622) - A use-after-free error exists in cURL within file lib/cookie.c when handling shared cookies. An unauthenticated, remote attacker can exploit this to disclose memory contents. (CVE-2016-8623) - A flaw exists in cURL in the parseurlandfillconn() function within file lib/url.c when parsing the authority component of a URL with the host name part ending in a '#' character. An unauthenticated, remote attacker can exploit this to establish a connection to a different host than intended. (CVE-2016-8624) - A flaw exists in cURL within International Domain Names (IDNA) handling when translating domain names to puny code for DNS resolving due to using the outdated IDNA 2003 standard instead of the IDNA 2008 standard, which can result in incorrect translation of a domain name. An unauthenticated, remote attacker can exploit this to cause network traffic to be redirected to a different host than intended. (CVE-2016-8625) - A flaw exists in Apache Tomcat within the catalina/mbeans/JmxRemoteLifecycleListener.java class that is triggered during the deserialization of Java objects. An unauthenticated, remote attacker can exploit this to execute arbitrary code. (CVE-2016-8735) - A flaw exists in the Web Server component (Apache HTTP Server) when handling whitespace patterns in User-Agent headers. An authenticated, remote attacker can exploit this, via a specially crafted User-Agent header, to cause incorrect processing of sequences of requests, resulting in incorrectly interpreting responses, polluting the cache, or disclosing content from one request to a second downstream user-agent. (CVE-2016-8743) - A NULL pointer dereference flaw exists within file ssl/statem/statem_clnt.c when handling parameters for the DHE or ECDHE key exchanges. An unauthenticated, remote attacker can exploit this, via specially crafted parameters, to cause a denial of service condition. (CVE-2017-3730) - A out-of-bounds read error exists exists in the Core subcomponent, specifically in OpenSSL, when handling packets using the CHACHA20/POLY1305 or RC4-MD5 ciphers. An unauthenticated, remote attacker can exploit this, via specially crafted truncated packets, to cause a denial of service condition. (CVE-2017-3731) - A carry propagating error exists in the x86_64 Montgomery squaring implementation that may cause the BN_mod_exp() function to produce incorrect results. An unauthenticated, remote attacker with sufficient resources can exploit this to obtain sensitive information regarding private keys. Note that this issue is very similar to CVE-2015-3193. Moreover, the attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. For example, this can occur by default in OpenSSL DHE based SSL/TLS cipher suites. (CVE-2017-3732) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2018-07-21
    modified 2018-07-18
    plugin id 99930
    published 2017-05-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99930
    title Oracle Secure Global Desktop Multiple Vulnerabilities (April 2017 CPU) (SWEET32)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2017-256.NASL
    description This update for openssl fixes the following issues contained in the OpenSSL Security Advisory [26 Jan 2017] (bsc#1021641) Security issues fixed : - CVE-2016-7055: The x86_64 optimized montgomery multiplication may produce incorrect results (bsc#1009528) - CVE-2017-3731: Truncated packet could crash via OOB read (bsc#1022085) - CVE-2017-3732: BN_mod_exp may produce incorrect results on x86_64 (bsc#1022086) - Degrade the 3DES cipher to MEDIUM in SSLv2 (bsc#1001912) Non-security issues fixed : - fix crash in openssl speed (bsc#1000677) - fix X509_CERT_FILE path (bsc#1022271) - AES XTS key parts must not be identical in FIPS mode (bsc#1019637) This update was imported from the SUSE:SLE-12-SP2:Update update project.
    last seen 2018-01-27
    modified 2018-01-26
    plugin id 97276
    published 2017-02-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97276
    title openSUSE Security Update : openssl (openSUSE-2017-256)
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2017-0042.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : - fix CVE-2017-3731 - DoS via truncated packets with RC4-MD5 cipher - fix CVE-2016-8610 - DoS of single-threaded servers via excessive alerts
    last seen 2018-07-30
    modified 2018-07-24
    plugin id 97316
    published 2017-02-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97316
    title OracleVM 3.3 / 3.4 : openssl (OVMSA-2017-0042)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_D455708AE3D311E69940B499BAEBFEAF.NASL
    description The OpenSSL project reports : - Truncated packet could crash via OOB read (CVE-2017-3731) - Bad (EC)DHE parameters cause a client crash (CVE-2017-3730) - BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732) - Montgomery multiplication may produce incorrect results (CVE-2016-7055)
    last seen 2018-02-01
    modified 2018-01-31
    plugin id 96821
    published 2017-01-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=96821
    title FreeBSD : OpenSSL -- multiple vulnerabilities (d455708a-e3d3-11e6-9940-b499baebfeaf)
  • NASL family Databases
    NASL id MYSQL_5_7_18.NASL
    description The version of MySQL running on the remote host is 5.7.x prior to 5.7.18. It is, therefore, affected by multiple vulnerabilities : - A carry propagation error exists in the OpenSSL component in the Broadwell-specific Montgomery multiplication procedure when handling input lengths divisible by but longer than 256 bits. This can result in transient authentication and key negotiation failures or reproducible erroneous outcomes of public-key operations with specially crafted input. A man-in-the-middle attacker can possibly exploit this issue to compromise ECDH key negotiations that utilize Brainpool P-512 curves. (CVE-2016-7055) - Multiple unspecified flaws exist in the DML subcomponent that allow an authenticated, remote attacker to cause a denial of service condition. Note that CVE-2017-3331 only affects versions 5.7.11 to 5.7.17. (CVE-2017-3308, CVE-2017-3331, CVE-2017-3456, CVE-2017-3457, CVE-2017-3458) - Multiple unspecified flaws exist in the Optimizer subcomponent that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3309, CVE-2017-3453, CVE-2017-3459) - An unspecified flaw exists in the Thread Pooling subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2017-3329) - An unspecified flaw exists in the Memcached subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2017-3450) - An unspecified flaw exists in the InnoDB subcomponent that allows an authenticated, remote attacker to insert and delete data contained in the database or cause a denial of service condition. (CVE-2017-3454) - An unspecified flaw exists in the 'Security: Privileges' subcomponent that allows an authenticated, remote attacker to insert or delete data contained in the database or disclose sensitive information. (CVE-2017-3455) - An unspecified flaw exists in the Audit Plug-in subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3460) - Multiple unspecified flaws exist in the 'Security: Privileges' subcomponent that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3461, CVE-2017-3462, CVE-2017-3463) - An unspecified flaw exists in the DDL subcomponent that allows an authenticated, remote attacker to update, insert, or delete data contained in the database. (CVE-2017-3464) - An unspecified flaw exists in the 'Security: Privileges' subcomponent that allows an authenticated, remote attacker to update, insert, or delete data contained in the database. (CVE-2017-3465) - An unspecified flaw exists in the C API subcomponent that allows an unauthenticated, remote attacker to disclose sensitive information. (CVE-2017-3467) - An unspecified flaw exists in the 'Security: Encryption' subcomponent that allows an authenticated, remote attacker to update, insert, or delete data contained in the database. (CVE-2017-3468) - An unspecified flaw exists in the Pluggable Auth subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2017-3599) - An unspecified flaw exists in the 'Client mysqldump' subcomponent that allows an authenticated, remote attacker to execute arbitrary code. (CVE-2017-3600) - An out-of-bounds read error exists in the OpenSSL component when handling packets using the CHACHA20/POLY1305 or RC4-MD5 ciphers. An unauthenticated, remote attacker can exploit this, via specially crafted truncated packets, to cause a denial of service condition. (CVE-2017-3731) - A carry propagating error exists in the OpenSSL component in the x86_64 Montgomery squaring implementation that may cause the BN_mod_exp() function to produce incorrect results. An unauthenticated, remote attacker with sufficient resources can exploit this to obtain sensitive information regarding private keys. (CVE-2017-3732) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2018-07-18
    modified 2018-07-16
    plugin id 99516
    published 2017-04-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99516
    title MySQL 5.7.x < 5.7.18 Multiple Vulnerabilities (April 2017 CPU) (July 2017 CPU)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20170220_OPENSSL_ON_SL6_X.NASL
    description Security Fix(es) : - An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite. (CVE-2017-3731) - A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610)
    last seen 2018-01-27
    modified 2018-01-26
    plugin id 97295
    published 2017-02-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97295
    title Scientific Linux Security Update : openssl on SL6.x, SL7.x i386/x86_64
  • NASL family Databases
    NASL id MYSQL_5_6_37.NASL
    description The version of MySQL running on the remote host is 5.6.x prior to 5.6.37. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the Memcached component that allows an unauthenticated, remote attacker to impact integrity and availability. (CVE-2017-3633) - Multiple unspecified flaws exist in the DML component that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3634, CVE-2017-3641) - An unspecified flaw exists in the Connector/C and C API components that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3635) - An unspecified flaw exists in the Client programs component that allows a local attacker to impact confidentiality, integrity, and availability. (CVE-2017-3636) - Multiple unspecified flaws exist in the Replication component that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3647, CVE-2017-3649) - An unspecified flaw exists in the Charsets component that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3648) - An unspecified flaw exists in the Client mysqldump component that allows an authenticated, remote attacker to impact integrity. (CVE-2017-3651) - Multiple unspecified flaws exist in the DDL component that allow an authenticated, remote attacker to impact confidentiality and integrity. (CVE-2017-3652, CVE-2017-3653) - An unspecified flaw exists in the OpenSSL Encryption component that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2017-3731) - An unspecified flaw exists in the Optimizer component that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-10279) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2018-07-18
    modified 2018-07-16
    plugin id 101820
    published 2017-07-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=101820
    title MySQL 5.6.x < 5.6.37 Multiple Vulnerabilities (July 2017 CPU) (October 2017 CPU)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3773.NASL
    description Several vulnerabilities were discovered in OpenSSL : - CVE-2016-7056 A local timing attack was discovered against ECDSA P-256. - CVE-2016-8610 It was discovered that no limit was imposed on alert packets during an SSL handshake. - CVE-2017-3731 Robert Swiecki discovered that the RC4-MD5 cipher when running on 32 bit systems could be forced into an out-of-bounds read, resulting in denial of service.
    last seen 2018-07-12
    modified 2018-07-10
    plugin id 96842
    published 2017-01-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=96842
    title Debian DSA-3773-1 : openssl - security update
  • NASL family F5 Networks Local Security Checks
    NASL id F5_BIGIP_SOL37526132.NASL
    description If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k. (CVE-2017-3731)
    last seen 2018-01-26
    modified 2018-01-25
    plugin id 97361
    published 2017-02-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97361
    title F5 Networks BIG-IP : OpenSSL vulnerability (K37526132)
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2017-1029.NASL
    description According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite. (CVE-2017-3731) - A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-08-11
    modified 2018-08-10
    plugin id 99874
    published 2017-05-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99874
    title EulerOS 2.0 SP1 : openssl (EulerOS-SA-2017-1029)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-2185.NASL
    description Red Hat JBoss Core Services Pack Apache Server 2.4.29 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. This release adds the new Apache HTTP Server 2.4.29 packages that are part of the JBoss Core Services offering. This release serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.23, and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes, enhancements and component upgrades included in this release. This release upgrades OpenSSL to version 1.0.2.n Security Fix(es) : * openssl: Out-of-bounds write caused by unchecked errors in BN_bn2dec() (CVE-2016-2182) * openssl: Insufficient TLS session ticket HMAC length checks (CVE-2016-6302) * openssl: certificate message OOB reads (CVE-2016-6306) * openssl: Carry propagating bug in Montgomery multiplication (CVE-2016-7055) * openssl: Truncated packet could crash via OOB read (CVE-2017-3731) * openssl: BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732) * openssl: bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736) * openssl: Read/write after SSL object in error state (CVE-2017-3737) * openssl: rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738) Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6306 and CVE-2016-7055. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter of CVE-2016-6306.
    last seen 2018-07-19
    modified 2018-07-18
    plugin id 111146
    published 2018-07-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=111146
    title RHEL 7 : Red Hat JBoss Core Services Apache HTTP Server 2.4.29 RHEL 7 (RHSA-2018:2185)
  • NASL family Databases
    NASL id MYSQL_5_7_19_RPM.NASL
    description The version of MySQL running on the remote host is 5.7.x prior to 5.7.19. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the UDF component that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3529) - An unspecified flaw exists in the Memcached component that allows an unauthenticated, remote attacker to impact integrity and availability. (CVE-2017-3633) - Multiple unspecified flaws exist in the DML component that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3634, CVE-2017-3639, CVE-2017-3640, CVE-2017-3641, CVE-2017-3643, CVE-2017-3644, CVE-2017-10296) - An unspecified flaw exists in the Connector/C and C API components that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3635) - An unspecified flaw exists in the X Plugin component that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3637) - Multiple unspecified flaws exist in the Optimizer component that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3638, CVE-2017-3642, CVE-2017-3645, CVE-2017-10279) - Multiple unspecified flaws exist in the Replication component that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3647, CVE-2017-3649) - An unspecified flaw exists in the Charsets component that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3648) - An unspecified flaw exists in the C API component that allows an unauthenticated, remote attacker to disclose sensitive information. (CVE-2017-3650) - An unspecified flaw exists in the Client mysqldump component that allows an authenticated, remote attacker to impact integrity. (CVE-2017-3651) - Multiple unspecified flaws exist in the DDL component that allow an authenticated, remote attacker to impact confidentiality and integrity. (CVE-2017-3652, CVE-2017-3653) - An unspecified flaw exists in the OpenSSL Encryption component that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2017-3731) - An unspecified flaw exists in the Stored Procedure component that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-10284) - An unspecified flaw exists in the InnoDB component that allows an authenticated, remote attacker to cause a denial of service condition or to modify the contents of the MySQL database. (CVE-2017-10365) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2018-07-18
    modified 2018-07-16
    plugin id 101979
    published 2017-07-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=101979
    title MySQL 5.7.x < 5.7.19 Multiple Vulnerabilities (RPM Check) (July 2017 CPU) (October 2017 CPU)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-0112-1.NASL
    description This update for openssl fixes the following issues: Security issues fixed : - CVE-2016-7056: ECSDA P-256 timing attack key recovery (bsc#1019334) - CVE-2017-3731: Truncated packet could crash via OOB read (bsc#1022085) - CVE-2016-8610: remote denial of service in SSL alert handling (bsc#1005878) - CVE-2017-3735: Malformed X.509 IPAdressFamily could cause OOB read (bsc#1056058) Bug fixes : - support alternate root ca chains (bsc#1032261) - X509_get_default_cert_file() returns an incorrect path (bsc#1022271) - Segmentation fault in 'openssl speed' when engine library file cannot be found (bsc#1000677) - adjust DEFAULT_SUSE to meet 1.0.2 and current state (bsc#1027908) - Missing important ciphers in openssl 1.0.1i-47.1 on SLES12 SP1 (bsc#990592) - out of bounds read+crash in DES_fcrypt (bsc#1065363) - tracker bug for January 26th 2017 release (bsc#1021641) - patch for CVE-2016-2108 fails negative zero exploit (bsc#1001502) - Birthday attacks on 64-bit block ciphers aka triple-des (SWEET32) (bsc#1001912) - Include additional patch for CVE-2016-2108 (bsc#1004499) - openssl DEFAULT_SUSE cipher list is missing ECDHE-ECDSA ciphers (bsc#1055825) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-08-02
    modified 2018-08-01
    plugin id 106093
    published 2018-01-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=106093
    title SUSE SLES12 Security Update : openssl (SUSE-SU-2018:0112-1)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2018-168.NASL
    description This update for openssl-steam fixes the following issues : - Merged changes from upstream openssl (Factory rev 137) into this fork for Steam. Updated to openssl 1.0.2k : - CVE-2016-7055: Montgomery multiplication may produce incorrect results (boo#1009528) - CVE-2016-7056: ECSDA P-256 timing attack key recovery (boo#1019334) - CVE-2017-3731: Truncated packet could crash via OOB read (boo#1022085) - CVE-2017-3732: BN_mod_exp may produce incorrect results on x86_64 (boo#1022086) Update to openssl-1.0.2j : - CVE-2016-7052: Missing CRL sanity check (boo#1001148) OpenSSL Security Advisory [22 Sep 2016] (boo#999665) - Severity: High - CVE-2016-6304: OCSP Status Request extension unbounded memory growth (boo#999666) - Severity: Low - CVE-2016-2177: Pointer arithmetic undefined behaviour (boo#982575) - CVE-2016-2178: Constant time flag not preserved in DSA signing (boo#983249) - CVE-2016-2179: DTLS buffered message DoS (boo#994844) - CVE-2016-2180: OOB read in TS_OBJ_print_bio() (boo#990419) - CVE-2016-2181: DTLS replay protection DoS (boo#994749) - CVE-2016-2182: OOB write in BN_bn2dec() (boo#993819) - CVE-2016-2183: Birthday attack against 64-bit block ciphers (SWEET32) (boo#995359) - CVE-2016-6302: Malformed SHA512 ticket DoS (boo#995324) - CVE-2016-6303: OOB write in MDC2_Update() (boo#995377) - CVE-2016-6306: Certificate message OOB reads (boo#999668) ALso fixed : - fixed a crash in print_notice (boo#998190) - fix X509_CERT_FILE path (boo#1022271) and rename - resume reading from /dev/urandom when interrupted by a signal (boo#995075) - fix problems with locking in FIPS mode (boo#992120) - duplicates: boo#991877, boo#991193, boo#990392, boo#990428 and boo#990207 - drop openssl-fips_RSA_compute_d_with_lcm.patch (upstream) (boo#984323) - don't check for /etc/system-fips (boo#982268)
    last seen 2018-02-17
    modified 2018-02-16
    plugin id 106863
    published 2018-02-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=106863
    title openSUSE Security Update : openssl-steam (openSUSE-2018-168)
  • NASL family Misc.
    NASL id SECURITYCENTER_5_4_3_TNS_2017_04.NASL
    description According to its version, the installation of Tenable SecurityCenter on the remote host is affected by multiple vulnerabilities : - A flaw exists in the mod_session_crypto module due to encryption for data and cookies using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default). An unauthenticated, remote attacker can exploit this, via a padding oracle attack, to decrypt information without knowledge of the encryption key, resulting in the disclosure of potentially sensitive information. (CVE-2016-0736) - A denial of service vulnerability exists in the mod_auth_digest module during client entry allocation. An unauthenticated, remote attacker can exploit this, via specially crafted input, to exhaust shared memory resources, resulting in a server crash. (CVE-2016-2161) - The Apache HTTP Server is affected by a man-in-the-middle vulnerability known as 'httpoxy' due to a failure to properly resolve namespace conflicts in accordance with RFC 3875 section 4.1.18. The HTTP_PROXY environment variable is set based on untrusted user data in the 'Proxy' header of HTTP requests. The HTTP_PROXY environment variable is used by some web client libraries to specify a remote proxy server. An unauthenticated, remote attacker can exploit this, via a crafted 'Proxy' header in an HTTP request, to redirect an application's internal HTTP traffic to an arbitrary proxy server where it may be observed or manipulated. (CVE-2016-5387, CVE-2016-1000102, CVE-2016-1000104) - A carry propagation error exists in the Broadwell-specific Montgomery multiplication procedure when handling input lengths divisible by but longer than 256 bits. This can result in transient authentication and key negotiation failures or reproducible erroneous outcomes of public-key operations with specially crafted input. A man-in-the-middle attacker can possibly exploit this issue to compromise ECDH key negotiations that utilize Brainpool P-512 curves. (CVE-2016-7055) - A denial of service vulnerability exists in the mod_http2 module due to improper handling of the LimitRequestFields directive. An unauthenticated, remote attacker can exploit this, via specially crafted CONTINUATION frames in an HTTP/2 request, to inject unlimited request headers into the server, resulting in the exhaustion of memory resources. (CVE-2016-8740) - A flaw exists due to improper handling of whitespace patterns in user-agent headers. An unauthenticated, remote attacker can exploit this, via a specially crafted user-agent header, to cause the program to incorrectly process sequences of requests, resulting in interpreting responses incorrectly, polluting the cache, or disclosing the content from one request to a second downstream user-agent. (CVE-2016-8743) - A flaw exits in libcurl in the randit() function within file lib/rand.c due to improper initialization of the 32-bit random value, which is used, for example, to generate Digest and NTLM authentication nonces, resulting in weaker cryptographic operations than expected. (CVE-2016-9594) - A floating pointer exception flaw exists in the exif_convert_any_to_int() function in exif.c that is triggered when handling TIFF and JPEG image tags. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition. (CVE-2016-10158) - An integer overflow condition exists in the phar_parse_pharfile() function in phar.c due to improper validation when handling phar archives. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition. (CVE-2016-10159) - An off-by-one overflow condition exists in the phar_parse_pharfile() function in phar.c due to improper parsing of phar archives. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition. (CVE-2016-10160) - An out-of-bounds read error exists in the finish_nested_data() function in var_unserializer.c due to improper validation of unserialized data. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition or the disclosure of memory contents. (CVE-2016-10161) - A denial of service vulnerability exists in the gdImageCreateFromGd2Ctx() function within file gd_gd2.c in the GD Graphics Library (LibGD) when handling images claiming to contain more image data than they actually do. An unauthenticated, remote attacker can exploit this to crash a process linked against the library. (CVE-2016-10167) - An out-of-bounds read error exists when handling packets using the CHACHA20/POLY1305 or RC4-MD5 ciphers. An unauthenticated, remote attacker can exploit this, via specially crafted truncated packets, to cause a denial of service condition. (CVE-2017-3731) - A carry propagating error exists in the x86_64 Montgomery squaring implementation that may cause the BN_mod_exp() function to produce incorrect results. An unauthenticated, remote attacker with sufficient resources can exploit this to obtain sensitive information regarding private keys. Note that this issue is very similar to CVE-2015-3193. Moreover, the attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. For example, this can occur by default in OpenSSL DHE based SSL/TLS cipher suites. (CVE-2017-3732) - An out-of-bounds read error exists in the phar_parse_pharfile() function in phar.c due to improper parsing of phar archives. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition. (VulnDB 149621) - Multiple stored cross-site scripting (XSS) vulnerabilities exist in unspecified scripts due to a failure to validate input before returning it to users. An authenticated, remote authenticated attacker can exploit these, via a specially crafted request, to execute arbitrary script code in a user's browser session. (VulnDB 152085, 152086, 152087, 152088) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2018-07-31
    modified 2018-07-30
    plugin id 97726
    published 2017-03-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97726
    title Tenable SecurityCenter 5.x < 5.4.3 Multiple Vulnerabilities (TNS-2017-04) (httpoxy)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2017-284.NASL
    description nodejs was updated to LTS release 4.7.3 to fix the following issues : - deps: upgrade embedded openssl sources to 1.0.2k (CVE-2017-3731, CVE-2017-3732, CVE-2016-7055, boo#1022085, boo#1022086, boo#1009528) Changes in LTS release 4.7.1 : - build: shared library support is now working for AIX builds - repl: passing options to the repl will no longer overwrite defaults - timers: recanceling a cancelled timers will no longer throw Changes in LTS release 4.7.0 : - build: introduce the configure --shared option for embedders - debugger: make listen address configurable in debugger server - dgram: generalized send queue to handle close, fixing a potential throw when dgram socket is closed in the listening event handler - http: introduce the 451 status code 'Unavailable For Legal Reasons' - gtest: the test reporter now outputs tap comments as yamlish - tls: introduce secureContext for tls.connect (useful for caching client certificates, key, and CA certificates) - tls: fix memory leak when writing data to TLSWrap instance during handshake - src: node no longer aborts when c-ares initialization fails Changes in LTS release 4.6.2 : - build: it is now possible to build the documentation from the release tarball - buffer: Buffer.alloc() will no longer incorrectly return a zero filled buffer when an encoding is passed - deps/npm: upgrade npm in LTS to 2.15.11 - repl: enable tab completion for global properties - url: url.format() will now encode all '#' in search
    last seen 2018-01-27
    modified 2018-01-26
    plugin id 97292
    published 2017-02-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97292
    title openSUSE Security Update : nodejs (openSUSE-2017-284)
  • NASL family Databases
    NASL id MYSQL_5_7_19.NASL
    description The version of MySQL running on the remote host is 5.7.x prior to 5.7.19. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the UDF component that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3529) - An unspecified flaw exists in the Memcached component that allows an unauthenticated, remote attacker to impact integrity and availability. (CVE-2017-3633) - Multiple unspecified flaws exist in the DML component that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3634, CVE-2017-3639, CVE-2017-3640, CVE-2017-3641, CVE-2017-3643, CVE-2017-3644, CVE-2017-10296) - An unspecified flaw exists in the Connector/C and C API components that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3635) - An unspecified flaw exists in the X Plugin component that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3637) - Multiple unspecified flaws exist in the Optimizer component that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3638, CVE-2017-3642, CVE-2017-3645, CVE-2017-10279) - Multiple unspecified flaws exist in the Replication component that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3647, CVE-2017-3649) - An unspecified flaw exists in the Charsets component that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3648) - An unspecified flaw exists in the C API component that allows an unauthenticated, remote attacker to disclose sensitive information. (CVE-2017-3650) - An unspecified flaw exists in the Client mysqldump component that allows an authenticated, remote attacker to impact integrity. (CVE-2017-3651) - Multiple unspecified flaws exist in the DDL component that allow an authenticated, remote attacker to impact confidentiality and integrity. (CVE-2017-3652, CVE-2017-3653) - An unspecified flaw exists in the OpenSSL Encryption component that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2017-3731) - An unspecified flaw exists in the Stored Procedure component that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-10284) - An unspecified flaw exists in the InnoDB component that allows an authenticated, remote attacker to cause a denial of service condition or to modify the contents of the MySQL database. (CVE-2017-10365) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2018-07-18
    modified 2018-07-16
    plugin id 101821
    published 2017-07-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=101821
    title MySQL 5.7.x < 5.7.19 Multiple Vulnerabilities (July 2017 CPU) (October 2017 CPU)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2017-0441-1.NASL
    description This update for openssl fixes the following issues contained in the OpenSSL Security Advisory [26 Jan 2017] (bsc#1021641) Security issues fixed : - CVE-2016-7055: The x86_64 optimized montgomery multiplication may produce incorrect results (bsc#1009528) - CVE-2017-3731: Truncated packet could crash via OOB read (bsc#1022085) - CVE-2017-3732: BN_mod_exp may produce incorrect results on x86_64 (bsc#1022086) - Degrade the 3DES cipher to MEDIUM in SSLv2 (bsc#1001912) Non-security issues fixed : - fix crash in openssl speed (bsc#1000677) - fix X509_CERT_FILE path (bsc#1022271) - AES XTS key parts must not be identical in FIPS mode (bsc#1019637) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-08-05
    modified 2018-08-02
    plugin id 97129
    published 2017-02-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97129
    title SUSE SLED12 / SLES12 Security Update : openssl (SUSE-SU-2017:0441-1)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2017-0286.NASL
    description An update for openssl is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es) : * An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite. (CVE-2017-3731) * A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610)
    last seen 2018-07-03
    modified 2018-07-02
    plugin id 97305
    published 2017-02-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97305
    title CentOS 6 / 7 : openssl (CESA-2017:0286)
  • NASL family Misc.
    NASL id VMWARE_ESXI_6_0_BUILD_5485776_REMOTE.NASL
    description The version of the remote VMware ESXi 6.0 host is prior to build 5224529. It is, therefore, affected by multiple vulnerabilities in VMWare Tools and the bundled OpenSSL and Python packages, as well as a NULL pointer dereference vulnerability related to handling RPC requests that could allow an attacker to crash a virtual machine.
    last seen 2018-08-10
    modified 2018-08-07
    plugin id 102698
    published 2017-09-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=102698
    title ESXi 6.0 < Build 5485776 Multiple Vulnerabilities (VMSA-2017-0015) (remote check)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2017-0286.NASL
    description An update for openssl is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es) : * An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite. (CVE-2017-3731) * A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610)
    last seen 2018-07-30
    modified 2018-07-26
    plugin id 97294
    published 2017-02-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97294
    title RHEL 6 / 7 : openssl (RHSA-2017:0286)
  • NASL family Databases
    NASL id MYSQL_5_6_36.NASL
    description The version of MySQL running on the remote host is 5.6.x prior to 5.6.36. It is, therefore, affected by multiple vulnerabilities : - A use-after-free error exists in the mysql_prune_stmt_list() function in client.c that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3302) - A carry propagation error exists in the OpenSSL component in the Broadwell-specific Montgomery multiplication procedure when handling input lengths divisible by but longer than 256 bits. This can result in transient authentication and key negotiation failures or reproducible erroneous outcomes of public-key operations with specially crafted input. A man-in-the-middle attacker can possibly exploit this issue to compromise ECDH key negotiations that utilize Brainpool P-512 curves. (CVE-2016-7055) - An authentication information disclosure vulnerability, known as Riddle, exists due to authentication being performed prior to security parameter verification. A man-in-the-middle (MitM) attacker can exploit this vulnerability to disclose sensitive authentication information, which the attacker can later use for authenticating to the server. (CVE-2017-3305) - Multiple unspecified flaws exist in the DML subcomponent that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3308, CVE-2017-3456) - Multiple unspecified flaws exist in the Optimizer subcomponent that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3309, CVE-2017-3452, CVE-2017-3453) - An unspecified flaw exists in the Thread Pooling subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2017-3329) - An unspecified flaw exists in the Memcached subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2017-3450) - Multiple unspecified flaws exist in the 'Security: Privileges' subcomponent that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3461, CVE-2017-3462, CVE-2017-3463) - An unspecified flaw exists in the DDL subcomponent that allows an authenticated, remote attacker to update, insert, or delete data contained in the database. (CVE-2017-3464) - An unspecified flaw exists in the Pluggable Auth subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2017-3599) - An unspecified flaw exists in the 'Client mysqldump' subcomponent that allows an authenticated, remote attacker to execute arbitrary code. (CVE-2017-3600) - An out-of-bounds read error exists in the OpenSSL component when handling packets using the CHACHA20/POLY1305 or RC4-MD5 ciphers. An unauthenticated, remote attacker can exploit this, via specially crafted truncated packets, to cause a denial of service condition. (CVE-2017-3731) - A carry propagating error exists in the OpenSSL component in the x86_64 Montgomery squaring implementation that may cause the BN_mod_exp() function to produce incorrect results. An unauthenticated, remote attacker with sufficient resources can exploit this to obtain sensitive information regarding private keys. (CVE-2017-3732) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2018-07-18
    modified 2018-07-16
    plugin id 99515
    published 2017-04-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99515
    title MySQL 5.6.x < 5.6.36 Multiple Vulnerabilities (April 2017 CPU) (July 2017 CPU) (Riddle)
  • NASL family Junos Local Security Checks
    NASL id JUNIPER_JSA10775.NASL
    description According to its self-reported version number, the remote Juniper Junos device is affected by multiple vulnerabilities : - A carry propagation error exists in the OpenSSL component in the Broadwell-specific Montgomery multiplication procedure when handling input lengths divisible by but longer than 256 bits. This can result in transient authentication and key negotiation failures or reproducible erroneous outcomes of public-key operations with specially crafted input. A man-in-the-middle attacker can possibly exploit this issue to compromise ECDH key negotiations that utilize Brainpool P-512 curves. (CVE-2016-7055) - An out-of-bounds read error exists in the OpenSSL component when handling packets using the CHACHA20/POLY1305 or RC4-MD5 ciphers. An unauthenticated, remote attacker can exploit this, via specially crafted truncated packets, to cause a denial of service condition. (CVE-2017-3731) - A carry propagating error exists in the OpenSSL component in the x86_64 Montgomery squaring implementation that may cause the BN_mod_exp() function to produce incorrect results. An unauthenticated, remote attacker with sufficient resources can exploit this to obtain sensitive information regarding private keys. (CVE-2017-3732) Note that these vulnerabilities only affect devices with J-Web or the SSL service for JUNOScript enabled.
    last seen 2018-07-13
    modified 2018-07-12
    plugin id 102699
    published 2017-08-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=102699
    title Juniper Junos Multiple OpenSSL Vulnerabilities (JSA10775)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-814.NASL
    description Several vulnerabilities were discovered in OpenSSL : CVE-2016-7056 A local timing attack was discovered against ECDSA P-256. CVE-2016-8610 It was discovered that no limit was imposed on alert packets during an SSL handshake. CVE-2017-3731 Robert Swiecki discovered that the RC4-MD5 cipher when running on 32 bit systems could be forced into an out-of-bounds read, resulting in denial of service. For Debian 7 'Wheezy', these problems have been fixed in version 1.0.1t-1+deb7u2. We recommend that you upgrade your openssl packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-07-10
    modified 2018-07-09
    plugin id 96931
    published 2017-02-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=96931
    title Debian DLA-814-1 : openssl security update
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-3181-1.NASL
    description Guido Vranken discovered that OpenSSL used undefined behaviour when performing pointer arithmetic. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS as other releases were fixed in a previous security update. (CVE-2016-2177) It was discovered that OpenSSL did not properly handle Montgomery multiplication, resulting in incorrect results leading to transient failures. This issue only applied to Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2016-7055) It was discovered that OpenSSL did not properly use constant-time operations when performing ECDSA P-256 signing. A remote attacker could possibly use this issue to perform a timing attack and recover private ECDSA keys. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-7056) Shi Lei discovered that OpenSSL incorrectly handled certain warning alerts. A remote attacker could possibly use this issue to cause OpenSSL to stop responding, resulting in a denial of service. (CVE-2016-8610) Robert Swiecki discovered that OpenSSL incorrectly handled certain truncated packets. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2017-3731) It was discovered that OpenSSL incorrectly performed the x86_64 Montgomery squaring procedure. While unlikely, a remote attacker could possibly use this issue to recover private keys. This issue only applied to Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2017-3732). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-08-05
    modified 2018-08-03
    plugin id 96927
    published 2017-02-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=96927
    title Ubuntu 12.04 LTS / 14.04 LTS / 16.04 LTS / 16.10 : openssl vulnerabilities (USN-3181-1)
  • NASL family CGI abuses
    NASL id MYSQL_ENTERPRISE_MONITOR_3_3_3_1199.NASL
    description According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 3.1.x prior to 3.1.7.8023, 3.2.x prior to 3.2.7.1204, or 3.3.x prior to 3.3.3.1199. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists in the Apache Commons component in the FileUpload functionality due to improper handling of file upload requests. An unauthenticated, remote attacker can exploit this, via a specially crafted content-type header, to cause a denial of service condition. Note that this vulnerability does not affect MySQL Enterprise Monitor versions 3.3.x. (CVE-2016-3092) - An unspecified flaw exists in the Apache Struts component that is triggered during the cleanup of action names. An unauthenticated, remote attacker can exploit this, via a specially crafted payload, to perform unspecified actions. (CVE-2016-4436) - A carry propagation error exists in the OpenSSL component in the Broadwell-specific Montgomery multiplication procedure when handling input lengths divisible by but longer than 256 bits. This can result in transient authentication and key negotiation failures or reproducible erroneous outcomes of public-key operations with specially crafted input. A man-in-the-middle attacker can possibly exploit this issue to compromise ECDH key negotiations that utilize Brainpool P-512 curves. (CVE-2016-7055) - An unspecified flaw exists in the Monitoring Server subcomponent that allows an authenticated, remote attacker to impact confidentiality and integrity. (CVE-2017-3306) - An unspecified flaw exists in the Monitoring Server subcomponent that allows an authenticated, remote attacker to impact integrity and availability. (CVE-2017-3307) - An out-of-bounds read error exists in the OpenSSL component when handling packets using the CHACHA20/POLY1305 or RC4-MD5 ciphers. An unauthenticated, remote attacker can exploit this, via specially crafted truncated packets, to cause a denial of service condition. (CVE-2017-3731) - A carry propagating error exists in the OpenSSL component in the x86_64 Montgomery squaring implementation that may cause the BN_mod_exp() function to produce incorrect results. An unauthenticated, remote attacker with sufficient resources can exploit this to obtain sensitive information regarding private keys. (CVE-2017-3732) - A remote code execution vulnerability exists in the Apache Struts component in the Jakarta Multipart parser due to improper handling of the Content-Type, Content-Disposition, and Content-Length headers. An unauthenticated, remote attacker can exploit this, via a specially crafted header value in the HTTP request, to execute arbitrary code. (CVE-2017-5638)
    last seen 2018-07-01
    modified 2018-06-29
    plugin id 99593
    published 2017-04-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99593
    title MySQL Enterprise Monitor 3.1.x < 3.1.7.8023 / 3.2.x < 3.2.7.1204 / 3.3.x < 3.3.3.1199 Multiple Vulnerabilities (April 2017 CPU)
  • NASL family Databases
    NASL id MYSQL_5_6_37_RPM.NASL
    description The version of MySQL running on the remote host is 5.6.x prior to 5.6.37. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the Memcached component that allows an unauthenticated, remote attacker to impact integrity and availability. (CVE-2017-3633) - Multiple unspecified flaws exist in the DML component that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3634, CVE-2017-3641) - An unspecified flaw exists in the Connector/C and C API components that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3635) - An unspecified flaw exists in the Client programs component that allows a local attacker to impact confidentiality, integrity, and availability. (CVE-2017-3636) - Multiple unspecified flaws exist in the Replication component that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3647, CVE-2017-3649) - An unspecified flaw exists in the Charsets component that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3648) - An unspecified flaw exists in the Client mysqldump component that allows an authenticated, remote attacker to impact integrity. (CVE-2017-3651) - Multiple unspecified flaws exist in the DDL component that allow an authenticated, remote attacker to impact confidentiality and integrity. (CVE-2017-3652, CVE-2017-3653) - An unspecified flaw exists in the OpenSSL Encryption component that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2017-3731) - An unspecified flaw exists in the Optimizer component that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-10279) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2018-07-18
    modified 2018-07-16
    plugin id 101978
    published 2017-07-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=101978
    title MySQL 5.6.x < 5.6.37 Multiple Vulnerabilities (RPM Check) (July 2017 CPU) (October 2017 CPU)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2017-0286.NASL
    description From Red Hat Security Advisory 2017:0286 : An update for openssl is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es) : * An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite. (CVE-2017-3731) * A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610)
    last seen 2018-07-30
    modified 2018-07-24
    plugin id 97293
    published 2017-02-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97293
    title Oracle Linux 6 / 7 : openssl (ELSA-2017-0286)
  • NASL family Misc.
    NASL id SECURITYCENTER_OPENSSL_1_0_2K.NASL
    description The Tenable SecurityCenter application installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities in the bundled version of OpenSSL : - A carry propagation error exists in the Broadwell-specific Montgomery multiplication procedure when handling input lengths divisible by but longer than 256 bits. This can result in transient authentication and key negotiation failures or reproducible erroneous outcomes of public-key operations with specially crafted input. A man-in-the-middle attacker can possibly exploit this issue to compromise ECDH key negotiations that utilize Brainpool P-512 curves. (CVE-2016-7055) - An out-of-bounds read error exists when handling packets using the CHACHA20/POLY1305 or RC4-MD5 ciphers. An unauthenticated, remote attacker can exploit this, via specially crafted truncated packets, to cause a denial of service condition. (CVE-2017-3731) - A carry propagating error exists in the x86_64 Montgomery squaring implementation that may cause the BN_mod_exp() function to produce incorrect results. An unauthenticated, remote attacker with sufficient resources can exploit this to obtain sensitive information regarding private keys. Note that this issue is very similar to CVE-2015-3193. Moreover, the attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. For example, this can occur by default in OpenSSL DHE based SSL/TLS cipher suites. (CVE-2017-3732)
    last seen 2018-07-30
    modified 2018-07-27
    plugin id 101046
    published 2017-06-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=101046
    title Tenable SecurityCenter OpenSSL 1.0.2 < 1.0.2k Multiple Vulnerabilities (TNS-2017-04)
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2017-803.NASL
    description An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite. (CVE-2017-3731) A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610)
    last seen 2018-04-19
    modified 2018-04-18
    plugin id 97555
    published 2017-03-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97555
    title Amazon Linux AMI : openssl (ALAS-2017-803)
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2017-1030.NASL
    description According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite. (CVE-2017-3731) - A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-08-11
    modified 2018-08-10
    plugin id 99875
    published 2017-05-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99875
    title EulerOS 2.0 SP2 : openssl (EulerOS-SA-2017-1030)
  • NASL family Databases
    NASL id MYSQL_5_7_18_RPM.NASL
    description The version of MySQL running on the remote host is 5.7.x prior to 5.7.18. It is, therefore, affected by multiple vulnerabilities : - A carry propagation error exists in the OpenSSL component in the Broadwell-specific Montgomery multiplication procedure when handling input lengths divisible by but longer than 256 bits. This can result in transient authentication and key negotiation failures or reproducible erroneous outcomes of public-key operations with specially crafted input. A man-in-the-middle attacker can possibly exploit this issue to compromise ECDH key negotiations that utilize Brainpool P-512 curves. (CVE-2016-7055) - Multiple unspecified flaws exist in the DML subcomponent that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3308, CVE-2017-3331, CVE-2017-3456, CVE-2017-3457, CVE-2017-3458) - Multiple unspecified flaws exist in the Optimizer subcomponent that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3309, CVE-2017-3453, CVE-2017-3459) - An unspecified flaw exists in the Thread Pooling subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2017-3329) - An unspecified flaw exists in the Memcached subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2017-3450) - An unspecified flaw exists in the InnoDB subcomponent that allows an authenticated, remote attacker to insert and delete data contained in the database or cause a denial of service condition. (CVE-2017-3454) - An unspecified flaw exists in the 'Security: Privileges' subcomponent that allows an authenticated, remote attacker to insert or delete data contained in the database or disclose sensitive information. (CVE-2017-3455) - An unspecified flaw exists in the Audit Plug-in subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3460) - Multiple unspecified flaws exist in the 'Security: Privileges' subcomponent that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3461, CVE-2017-3462, CVE-2017-3463) - An unspecified flaw exists in the DDL subcomponent that allows an authenticated, remote attacker to update, insert, or delete data contained in the database. (CVE-2017-3464) - An unspecified flaw exists in the 'Security: Privileges' subcomponent that allows an authenticated, remote attacker to update, insert, or delete data contained in the database. (CVE-2017-3465) - An unspecified flaw exists in the C API subcomponent that allows an unauthenticated, remote attacker to disclose sensitive information. (CVE-2017-3467) - An unspecified flaw exists in the 'Security: Encryption' subcomponent that allows an authenticated, remote attacker to update, insert, or delete data contained in the database. (CVE-2017-3468) - An unspecified flaw exists in the Pluggable Auth subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2017-3599) - An unspecified flaw exists in the 'Client mysqldump' subcomponent that allows an authenticated, remote attacker to execute arbitrary code. (CVE-2017-3600) - An out-of-bounds read error exists in the OpenSSL component when handling packets using the CHACHA20/POLY1305 or RC4-MD5 ciphers. An unauthenticated, remote attacker can exploit this, via specially crafted truncated packets, to cause a denial of service condition. (CVE-2017-3731) - A carry propagating error exists in the OpenSSL component in the x86_64 Montgomery squaring implementation that may cause the BN_mod_exp() function to produce incorrect results. An unauthenticated, remote attacker with sufficient resources can exploit this to obtain sensitive information regarding private keys. (CVE-2017-3732) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2018-07-18
    modified 2018-07-16
    plugin id 99513
    published 2017-04-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99513
    title MySQL 5.7.x < 5.7.18 Multiple Vulnerabilities (April 2017 CPU) (July 2017 CPU)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-2186.NASL
    description Red Hat JBoss Core Services Pack Apache Server 2.4.29 packages are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. This release adds the new Apache HTTP Server 2.4.29 packages that are part of the JBoss Core Services offering. This release serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.23, and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes, enhancements and component upgrades included in this release. This release upgrades OpenSSL to version 1.0.2.n Security Fix(es) : * openssl: Out-of-bounds write caused by unchecked errors in BN_bn2dec() (CVE-2016-2182) * openssl: Insufficient TLS session ticket HMAC length checks (CVE-2016-6302) * openssl: certificate message OOB reads (CVE-2016-6306) * openssl: Carry propagating bug in Montgomery multiplication (CVE-2016-7055) * openssl: Truncated packet could crash via OOB read (CVE-2017-3731) * openssl: BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732) * openssl: bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736) * openssl: Read/write after SSL object in error state (CVE-2017-3737) * openssl: rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738) Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6306 and CVE-2016-7055. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter of CVE-2016-6306.
    last seen 2018-07-19
    modified 2018-07-18
    plugin id 111147
    published 2018-07-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=111147
    title RHEL 6 : Red Hat JBoss Core Services Apache HTTP Server 2.4.29 RHEL 6 (RHSA-2018:2186)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2017-0461-1.NASL
    description This update for openssl fixes the following issues contained in the OpenSSL Security Advisory [26 Jan 2017] (bsc#1021641) Security issues fixed : - CVE-2016-7056: A local ECSDA P-256 timing attack that might have allowed key recovery was fixed (bsc#1019334) - CVE-2016-8610: A remote denial of service in SSL alert handling was fixed (bsc#1005878) - CVE-2016-2108: Added a missing commit for CVE-2016-2108, fixing the negative zero handling in the ASN.1 decoder (bsc#1004499) - CVE-2017-3731: Truncated packet could crash via OOB read (bsc#1022085, CVE-2017-3731) - Degrade the 3DES cipher to MEDIUM in SSLv2 (bsc#1001912) Bugs fixed : - fix crash in openssl speed (bsc#1000677) - fix ca-bundle path (bsc#1022271) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-08-01
    modified 2018-07-31
    plugin id 97188
    published 2017-02-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97188
    title SUSE SLED12 / SLES12 Security Update : openssl (SUSE-SU-2017:0461-1)
  • NASL family AIX Local Security Checks
    NASL id AIX_OPENSSL_ADVISORY23.NASL
    description The version of OpenSSL installed on the remote AIX host is affected by a denial of service vulnerability in OpenSSL caused by an out-of-bounds read when using a specific cipher. By sending specially crafted truncated packets, a remote attacker could exploit this vulnerability using CHACHA20/POLY1305 to cause an application crash.
    last seen 2018-07-21
    modified 2018-07-17
    plugin id 107230
    published 2018-03-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=107230
    title AIX OpenSSL Advisory : openssl_advisory23.asc
  • NASL family Databases
    NASL id MYSQL_5_6_36_RPM.NASL
    description The version of MySQL running on the remote host is 5.6.x prior to 5.6.36. It is, therefore, affected by multiple vulnerabilities : - A carry propagation error exists in the OpenSSL component in the Broadwell-specific Montgomery multiplication procedure when handling input lengths divisible by but longer than 256 bits. This can result in transient authentication and key negotiation failures or reproducible erroneous outcomes of public-key operations with specially crafted input. A man-in-the-middle attacker can possibly exploit this issue to compromise ECDH key negotiations that utilize Brainpool P-512 curves. (CVE-2016-7055) - An authentication information disclosure vulnerability, known as Riddle, exists due to authentication being performed prior to security parameter verification. A man-in-the-middle (MitM) attacker can exploit this vulnerability to disclose sensitive authentication information, which the attacker can later use for authenticating to the server. (CVE-2017-3305) - Multiple unspecified flaws exist in the DML subcomponent that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3308, CVE-2017-3456) - Multiple unspecified flaws exist in the Optimizer subcomponent that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3309, CVE-2017-3452, CVE-2017-3453) - An unspecified flaw exists in the Thread Pooling subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2017-3329) - An unspecified flaw exists in the Memcached subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2017-3450) - Multiple unspecified flaws exist in the 'Security: Privileges' subcomponent that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2017-3461, CVE-2017-3462, CVE-2017-3463) - An unspecified flaw exists in the DDL subcomponent that allows an authenticated, remote attacker to update, insert, or delete data contained in the database. (CVE-2017-3464) - An unspecified flaw exists in the Pluggable Auth subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2017-3599) - An unspecified flaw exists in the 'Client mysqldump' subcomponent that allows an authenticated, remote attacker to execute arbitrary code. (CVE-2017-3600) - An out-of-bounds read error exists in the OpenSSL component when handling packets using the CHACHA20/POLY1305 or RC4-MD5 ciphers. An unauthenticated, remote attacker can exploit this, via specially crafted truncated packets, to cause a denial of service condition. (CVE-2017-3731) - A carry propagating error exists in the OpenSSL component in the x86_64 Montgomery squaring implementation that may cause the BN_mod_exp() function to produce incorrect results. An unauthenticated, remote attacker with sufficient resources can exploit this to obtain sensitive information regarding private keys. (CVE-2017-3732) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2018-07-18
    modified 2018-07-16
    plugin id 99512
    published 2017-04-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99512
    title MySQL 5.6.x < 5.6.36 Multiple Vulnerabilities (April 2017 CPU) (July 2017 CPU) (Riddle)
  • NASL family Palo Alto Local Security Checks
    NASL id PALO_ALTO_PAN-OS_7_0_15.NASL
    description The version of Palo Alto Networks PAN-OS running on the remote host is 6.1.x prior to 6.1.17, 7.0.x prior to 7.0.15, 7.1.x prior to 7.1.10, or 8.0.x prior to 8.0.2. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the GNU wget component when handling server redirects to FTP resources due to the destination file name being obtained from the redirected URL and not the original URL. An unauthenticated, remote attacker can exploit this, via a specially crafted response, to cause a different file name to be used than intended, resulting in writing to arbitrary files. (CVE-2016-4971) - A flaw exists in the Linux kernel due to improper determination of the rate of challenge ACK segments. An unauthenticated, remote attacker can exploit this to gain access to the shared counter, which makes it easier to hijack TCP sessions using a blind in-window attack. This issue only affects version 7.1.x. (CVE-2016-5696) - An out-of-bounds read error exists when handling packets using the CHACHA20/POLY1305 or RC4-MD5 ciphers. An unauthenticated, remote attacker can exploit this, via specially crafted truncated packets, to cause a denial of service condition. This issue does not affect version 6.1.x. (CVE-2017-3731) - A cross-site scripting (XSS) vulnerability exists in GlobalProtect due to improper validation of user-supplied input to unspecified request parameters before returning it to users. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. This issue only affects version 7.0.x. (CVE-2017-7409) - A flaw exists in the web-based management interface due to improper permission checks that allows an authenticated, remote attacker to disclose sensitive information. This issue only affects versions 6.1.x, 7.0.x, and 8.0.x. (CVE-2017-7644) - An information disclosure vulnerability exists in the GlobalProtect external interface due to returning different error messages when handling login attempts with valid or invalid usernames. An unauthenticated, remote attacker can exploit this to enumerate valid user accounts. This issue only affects versions 6.1.x, 7.0.x, and 8.0.x. (CVE-2017-7945) - A denial of service vulnerability exists in the firewall when handling stale responses to authentication requests prior to selecting CHAP or PAP as the protocol. An unauthenticated, remote attacker can exploit this to cause the authentication process (authd) to stop responding. This issue only affects versions 7.0.x and 7.1.x. (VulnDB 156216) - An information disclosure vulnerability exists when viewing changes in the configuration log due to the 'Auth Password' and 'Priv Password' for the SNMPv3 server profile not being properly masked. A local attacker can exploit this to disclose password information. This issue only affects versions 7.1.x and 8.0.x. (VulnDB 158179) - A denial of service vulnerability exists due to a flaw when handling HA3 messages. An unauthenticated, remote attacker can exploit this to cause several processes to stop. This issue only affects version 7.1.x. (VulnDB 158180)
    last seen 2018-08-02
    modified 2018-08-01
    plugin id 100419
    published 2017-05-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=100419
    title Palo Alto Networks PAN-OS 6.1.x < 6.1.17 / 7.0.x < 7.0.15 / 7.1.x < 7.1.10 / 8.0.x < 8.0.2 Multiple Vulnerabilities
  • NASL family Web Servers
    NASL id OPENSSL_1_0_2K.NASL
    description According to its banner, the version of OpenSSL running on the remote host is 1.0.2 prior to 1.0.2k. It is, therefore, affected by multiple vulnerabilities : - A carry propagation error exists in the Broadwell-specific Montgomery multiplication procedure when handling input lengths divisible by but longer than 256 bits. This can result in transient authentication and key negotiation failures or reproducible erroneous outcomes of public-key operations with specially crafted input. A man-in-the-middle attacker can possibly exploit this issue to compromise ECDH key negotiations that utilize Brainpool P-512 curves. (CVE-2016-7055) - An out-of-bounds read error exists when handling packets using the CHACHA20/POLY1305 or RC4-MD5 ciphers. An unauthenticated, remote attacker can exploit this, via specially crafted truncated packets, to cause a denial of service condition. (CVE-2017-3731) - A carry propagating error exists in the x86_64 Montgomery squaring implementation that may cause the BN_mod_exp() function to produce incorrect results. An unauthenticated, remote attacker with sufficient resources can exploit this to obtain sensitive information regarding private keys. Note that this issue is very similar to CVE-2015-3193. Moreover, the attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. For example, this can occur by default in OpenSSL DHE based SSL/TLS cipher suites. (CVE-2017-3732)
    last seen 2018-07-18
    modified 2018-07-16
    plugin id 96873
    published 2017-01-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=96873
    title OpenSSL 1.0.2 < 1.0.2k Multiple Vulnerabilities
  • NASL family Web Servers
    NASL id OPENSSL_1_1_0D.NASL
    description According to its banner, the version of OpenSSL running on the remote host is 1.1.0 prior to 1.1.0d. It is, therefore, affected by multiple vulnerabilities : - A NULL pointer dereference flaw exists within file ssl/statem/statem_clnt.c when handling parameters for the DHE or ECDHE key exchanges. An unauthenticated, remote attacker can exploit this, via specially crafted parameters, to cause a denial of service condition. (CVE-2017-3730) - An out-of-bounds read error exists when handling packets using the CHACHA20/POLY1305 or RC4-MD5 ciphers. An unauthenticated, remote attacker can exploit this, via specially crafted truncated packets, to cause a denial of service condition. (CVE-2017-3731) - A carry propagating error exists in the x86_64 Montgomery squaring implementation that may cause the BN_mod_exp() function to produce incorrect results. An unauthenticated, remote attacker with sufficient resources can exploit this to obtain sensitive information regarding private keys. Note that this issue is very similar to CVE-2015-3193. Moreover, the attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. For example, this can occur by default in OpenSSL DHE based SSL/TLS cipher suites. (CVE-2017-3732)
    last seen 2018-07-18
    modified 2018-07-16
    plugin id 96874
    published 2017-01-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=96874
    title OpenSSL 1.1.0 < 1.1.0d Multiple Vulnerabilities
packetstorm via4
data source https://packetstormsecurity.com/files/download/143369/orionbrowser79-mitm.txt
id PACKETSTORM:143369
last seen 2017-07-15
published 2017-07-14
reporter MaXe
source https://packetstormsecurity.com/files/143369/Orion-Elite-Hidden-IP-Browser-Pro-7.9-OpenSSL-Tor-Man-In-The-Middle.html
title Orion Elite Hidden IP Browser Pro 7.9 OpenSSL / Tor / Man-In-The-Middle
redhat via4
advisories
  • bugzilla
    id 1416852
    title CVE-2017-3731 openssl: Truncated packet could crash via OOB read
    oval
    OR
    • AND
      • OR
        • comment Red Hat Enterprise Linux 6 Client is installed
          oval oval:com.redhat.rhsa:tst:20100842001
        • comment Red Hat Enterprise Linux 6 Server is installed
          oval oval:com.redhat.rhsa:tst:20100842002
        • comment Red Hat Enterprise Linux 6 Workstation is installed
          oval oval:com.redhat.rhsa:tst:20100842003
        • comment Red Hat Enterprise Linux 6 ComputeNode is installed
          oval oval:com.redhat.rhsa:tst:20100842004
      • OR
        • AND
          • comment openssl is earlier than 0:1.0.1e-48.el6_8.4
            oval oval:com.redhat.rhsa:tst:20170286009
          • comment openssl is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100888006
        • AND
          • comment openssl-devel is earlier than 0:1.0.1e-48.el6_8.4
            oval oval:com.redhat.rhsa:tst:20170286005
          • comment openssl-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100888012
        • AND
          • comment openssl-perl is earlier than 0:1.0.1e-48.el6_8.4
            oval oval:com.redhat.rhsa:tst:20170286007
          • comment openssl-perl is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100888008
        • AND
          • comment openssl-static is earlier than 0:1.0.1e-48.el6_8.4
            oval oval:com.redhat.rhsa:tst:20170286011
          • comment openssl-static is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100888010
    • AND
      • OR
        • comment Red Hat Enterprise Linux 7 Client is installed
          oval oval:com.redhat.rhsa:tst:20140675001
        • comment Red Hat Enterprise Linux 7 Server is installed
          oval oval:com.redhat.rhsa:tst:20140675002
        • comment Red Hat Enterprise Linux 7 Workstation is installed
          oval oval:com.redhat.rhsa:tst:20140675003
        • comment Red Hat Enterprise Linux 7 ComputeNode is installed
          oval oval:com.redhat.rhsa:tst:20140675004
      • OR
        • AND
          • comment openssl is earlier than 1:1.0.1e-60.el7_3.1
            oval oval:com.redhat.rhsa:tst:20170286022
          • comment openssl is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100888006
        • AND
          • comment openssl-devel is earlier than 1:1.0.1e-60.el7_3.1
            oval oval:com.redhat.rhsa:tst:20170286017
          • comment openssl-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100888012
        • AND
          • comment openssl-libs is earlier than 1:1.0.1e-60.el7_3.1
            oval oval:com.redhat.rhsa:tst:20170286019
          • comment openssl-libs is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20140679014
        • AND
          • comment openssl-perl is earlier than 1:1.0.1e-60.el7_3.1
            oval oval:com.redhat.rhsa:tst:20170286021
          • comment openssl-perl is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100888008
        • AND
          • comment openssl-static is earlier than 1:1.0.1e-60.el7_3.1
            oval oval:com.redhat.rhsa:tst:20170286018
          • comment openssl-static is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100888010
    rhsa
    id RHSA-2017:0286
    released 2017-02-20
    severity Moderate
    title RHSA-2017:0286: openssl security update (Moderate)
  • rhsa
    id RHSA-2018:2185
  • rhsa
    id RHSA-2018:2186
  • rhsa
    id RHSA-2018:2187
rpms
  • openssl-0:1.0.1e-48.el6_8.4
  • openssl-devel-0:1.0.1e-48.el6_8.4
  • openssl-perl-0:1.0.1e-48.el6_8.4
  • openssl-static-0:1.0.1e-48.el6_8.4
  • openssl-1:1.0.1e-60.el7_3.1
  • openssl-devel-1:1.0.1e-60.el7_3.1
  • openssl-libs-1:1.0.1e-60.el7_3.1
  • openssl-perl-1:1.0.1e-60.el7_3.1
  • openssl-static-1:1.0.1e-60.el7_3.1
refmap via4
bid 95813
confirm
debian DSA-3773
freebsd FreeBSD-SA-17:02
gentoo GLSA-201702-07
misc https://github.com/openssl/openssl/commit/00d965474b22b54e4275232bc71ee0c699c5cd21
sectrack 1037717
Last major update 05-05-2017 - 21:29
Published 04-05-2017 - 15:29
Last modified 27-07-2018 - 21:29
Back to Top