ID de Prueba:	1.3.6.1.4.1.25623.1.0.120376
Categoría:	Amazon Linux Local Security Checks
Título:	Amazon Linux: Security Advisory (ALAS-2013-224)
Resumen:	The remote host is missing an update for the 'php54' package(s) announced via the ALAS-2013-224 advisory.
Descripción:	Summary: The remote host is missing an update for the 'php54' package(s) announced via the ALAS-2013-224 advisory. Vulnerability Insight: Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hijack web sessions by specifying a session ID. The openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408. Affected Software/OS: 'php54' package(s) on Amazon Linux. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2011-4718 https://bugs.php.net/bug.php?id=60491 https://wiki.php.net/rfc/strict_sessions Common Vulnerability Exposure (CVE) ID: CVE-2013-4248 BugTraq ID: 61776 http://www.securityfocus.com/bid/61776 Debian Security Information: DSA-2742 (Google Search) http://www.debian.org/security/2013/dsa-2742 HPdes Security Advisory: HPSBUX03150 http://marc.info/?l=bugtraq&m=141390017113542&w=2 RedHat Security Advisories: RHSA-2013:1307 http://rhn.redhat.com/errata/RHSA-2013-1307.html RedHat Security Advisories: RHSA-2013:1615 http://rhn.redhat.com/errata/RHSA-2013-1615.html http://www.securitytracker.com/id/1028924 http://secunia.com/advisories/54478 http://secunia.com/advisories/54657 http://secunia.com/advisories/55078 http://secunia.com/advisories/59652 SuSE Security Announcement: openSUSE-SU-2013:1963 (Google Search) http://lists.opensuse.org/opensuse-updates/2013-12/msg00125.html SuSE Security Announcement: openSUSE-SU-2013:1964 (Google Search) http://lists.opensuse.org/opensuse-updates/2013-12/msg00126.html http://www.ubuntu.com/usn/USN-1937-1
Copyright	Copyright (C) 2015 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.