Test Kennung:	1.3.6.1.4.1.25623.1.0.51466
Kategorie:	Conectiva Local Security Checks
Titel:	Conectiva Security Advisory CLA-2003:751
Zusammenfassung:	NOSUMMARY
Beschreibung:	Description: The remote host is missing updates announced in advisory CLA-2003:751. OpenSSL[1] implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as full-strength general purpose cryptography functions. It is used (as a library) by several projects, like Apache, OpenSSH, Bind, OpenLDAP and many others clients and servers programs. NISCC[2] developed a test suit to verify the behavior of SSL and TLS implementations when presented with malformed client certificates. As a result of this test, the following vulnerabilities[3,4] were found in the OpenSSL implementation: - Vulnerabilities in the handling of malformed ASN.1 tags (CVE-2003-0543[5] and CVE-2003-0544[6]). Because of a flaw in the handling of ASN.1 tag values, an out-of-bounds read can be triggered in some situations. A remote attacker can exploit these vulnerabilities to cause a denial of service condition. - Stack corruption in the handling of rejected ASN.1 encodings (CVE-2003-0545[7]). A remote attacker may exploit this vulnerability to cause a denial of service condition and potentially execute arbitrary code. This vulnerability does not affect the OpenSSL versions distributed with Conectiva Linux 7.0 and 8 (OpenSSL-0.9.6). Additionally, this update includes fixes for a bug which causes OpenSSL to parse a client certificate when it should reject it as a protocol error. Solution: The apt tool can be used to perform RPM package upgrades by running 'apt-get update' followed by 'apt-get upgrade' http://www.openssl.org http://www.niscc.gov.uk/aboutniscc/index.htm http://www.uniras.gov.uk/vuls/2003/006489/openssl.htm http://www.openssl.org/news/secadv_20030930.txt http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0543 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0544 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0545 http://www.securityspace.com/smysecure/catid.html?in=CLA-2003:751 http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002003 Risk factor : Critical CVSS Score: 10.0
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2003-0543 BugTraq ID: 8732 http://www.securityfocus.com/bid/8732 http://www.cert.org/advisories/CA-2003-26.html CERT/CC vulnerability note: VU#255484 http://www.kb.cert.org/vuls/id/255484 Debian Security Information: DSA-393 (Google Search) http://www.debian.org/security/2003/dsa-393 Debian Security Information: DSA-394 (Google Search) http://www.debian.org/security/2003/dsa-394 En Garde Linux Advisory: ESA-20030930-027 http://www.linuxsecurity.com/advisories/engarde_advisory-3693.html http://www.uniras.gov.uk/vuls/2003/006489/openssl.htm https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4254 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5292 http://www.redhat.com/support/errata/RHSA-2003-291.html http://www.redhat.com/support/errata/RHSA-2003-292.html http://secunia.com/advisories/22249 http://sunsolve.sun.com/search/document.do?assetkey=1-66-201029-1 http://www.vupen.com/english/advisories/2006/3900 Common Vulnerability Exposure (CVE) ID: CVE-2003-0544 CERT/CC vulnerability note: VU#380864 http://www.kb.cert.org/vuls/id/380864 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4574 XForce ISS Database: openssl-asn1-sslclient-dos(43041) https://exchange.xforce.ibmcloud.com/vulnerabilities/43041 Common Vulnerability Exposure (CVE) ID: CVE-2003-0545 CERT/CC vulnerability note: VU#935264 http://www.kb.cert.org/vuls/id/935264 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2590
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.