Test Kennung:	1.3.6.1.4.1.25623.1.0.71997
Kategorie:	Mandrake Local Security Checks
Titel:	Mandriva Security Advisory MDVSA-2011:137 (openssl)
Zusammenfassung:	NOSUMMARY
Beschreibung:	Description: The remote host is missing an update to openssl announced via advisory MDVSA-2011:137. Multiple vulnerabilities has been discovered and corrected in openssl: The elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm (ECDSA) is used for the ECDHE_ECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine private keys via a timing attack and a lattice calculation (CVE-2011-1945). crypto/x509/x509_vfy.c in OpenSSL 1.0.x before 1.0.0e does not initialize certain structure members, which makes it easier for remote attackers to bypass CRL validation by using a nextUpdate value corresponding to a time in the past (CVE-2011-3207). The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8s and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages, which allows remote attackers to cause a denial of service (application crash) via out-of-order messages that violate the TLS protocol (CVE-2011-3210). Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more: http://store.mandriva.com/product_info.php?cPath=149&products_id=490 The updated packages have been patched to correct these issues. Affected: 2010.1, 2011. Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. http://www.securityspace.com/smysecure/catid.html?in=MDVSA-2011:137 Risk factor : High
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2011-1945 44935 http://secunia.com/advisories/44935 APPLE-SA-2013-06-04-1 http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html DSA-2309 http://www.debian.org/security/2011/dsa-2309 MDVSA-2011:136 http://www.mandriva.com/security/advisories?name=MDVSA-2011:136 MDVSA-2011:137 http://www.mandriva.com/security/advisories?name=MDVSA-2011:137 SUSE-SU-2011:0636 https://hermes.opensuse.org/messages/8764170 VU#536044 http://www.kb.cert.org/vuls/id/536044 http://eprint.iacr.org/2011/232.pdf http://support.apple.com/kb/HT5784 http://www.kb.cert.org/vuls/id/MAPG-8FENZ3 openSUSE-SU-2011:0634 https://hermes.opensuse.org/messages/8760466 Common Vulnerability Exposure (CVE) ID: CVE-2011-3207 http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065744.html http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065712.html http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html HPdes Security Advisory: HPSBMU02752 http://marc.info/?l=bugtraq&m=133226187115472&w=2 HPdes Security Advisory: SSRT100802 http://www.redhat.com/support/errata/RHSA-2011-1409.html http://www.securitytracker.com/id?1026012 http://secunia.com/advisories/45956 http://secunia.com/advisories/57353 Common Vulnerability Exposure (CVE) ID: CVE-2011-3210 1026012 57353 HPSBMU02752 HPSBUX02734 http://marc.info/?l=bugtraq&m=132750648501816&w=2 SSRT100729 SSRT100802 http://cvs.openssl.org/chngview?cn=21337 http://openssl.org/news/secadv_20110906.txt http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564 https://bugzilla.redhat.com/show_bug.cgi?id=736079
Copyright	Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.