ID de Prueba:	1.3.6.1.4.1.25623.1.0.51237
Categoría:	Red Hat Local Security Checks
Título:	RedHat Security Advisory RHSA-2002:157
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing updates announced in advisory RHSA-2002:157. Updated OpenSSL packages are available which fix several serious buffer overflow vulnerabilities. OpenSSL is a commercial-grade, full-featured, and Open Source toolkit which implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library. A security audit of the OpenSSL code sponsored by DARPA found several buffer overflows in OpenSSL which affect versions 0.9.7 and 0.9.6d and earlier: 1. The master key supplied by a client to an SSL version 2 server could be oversized, causing a stack-based buffer overflow. This issue is remotely exploitable. Services that have SSLv2 disabled would not be vulnerable to this issue. (CVE-2002-0656) 2. The SSLv3 session ID supplied to a client from a malicious server could be oversized and overrun a buffer. This issue looks to be remotely exploitable. (CVE-2002-0656) 3. Various buffers used for storing ASCII representations of integers were too small on 64 bit platforms. This issue may be exploitable. (CVE-2002-0655) A further issue was found in OpenSSL 0.9.7 that does not affect versions of OpenSSL shipped with Red Hat Linux (CVE-2002-0657). A large number of applications within Red Hat Linux make use the OpenSSL library to provide SSL support. All users are therefore advised to upgrade to the errata OpenSSL packages, which contain patches to correct these vulnerabilities. Thanks go to the OpenSSL team and Ben Laurie for providing patches for these issues. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date Because both client and server applications are affected by these vulnerabilities, we advise users to reboot their systems after installing these updates. http://rhn.redhat.com/errata/RHSA-2002-157.html Risk factor : High CVSS Score: 7.5
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2002-0655 BugTraq ID: 5364 http://www.securityfocus.com/bid/5364 Bugtraq: 20020730 GLSA: OpenSSL (Google Search) Bugtraq: 20020730 OpenSSL Security Altert - Remote Buffer Overflows (Google Search) Bugtraq: 20020730 OpenSSL patches for other versions (Google Search) Bugtraq: 20020730 TSLSA-2002-0063 - openssl (Google Search) Bugtraq: 20020730 [OpenPKG-SA-2002.008] OpenPKG Security Advisory (openssl) (Google Search) Caldera Security Advisory: CSSA-2002-033.0 ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-033.0.txt Caldera Security Advisory: CSSA-2002-033.1 ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-033.1.txt http://www.cert.org/advisories/CA-2002-23.html CERT/CC vulnerability note: VU#308891 http://www.kb.cert.org/vuls/id/308891 Conectiva Linux advisory: CLA-2002:513 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000513 Debian Security Information: DSA-136 (Google Search) En Garde Linux Advisory: ESA-20020730-019 FreeBSD Security Advisory: FreeBSD-SA-02:33 ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:33.openssl.asc http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-046.php RedHat Security Advisories: RHSA-2002:155 SuSE Security Announcement: SuSE-SA:2002:027 (Google Search) Common Vulnerability Exposure (CVE) ID: CVE-2002-0656 BugTraq ID: 5362 http://www.securityfocus.com/bid/5362 BugTraq ID: 5363 http://www.securityfocus.com/bid/5363 CERT/CC vulnerability note: VU#102795 http://www.kb.cert.org/vuls/id/102795 CERT/CC vulnerability note: VU#258555 http://www.kb.cert.org/vuls/id/258555 http://www.iss.net/security_center/static/9714.php http://www.iss.net/security_center/static/9716.php Common Vulnerability Exposure (CVE) ID: CVE-2002-0657 BugTraq ID: 5361 http://www.securityfocus.com/bid/5361 Bugtraq: 20020730 OpenSSL Security Altert - Remote Buffer Overflows: (Google Search) CERT/CC vulnerability note: VU#561275 http://www.kb.cert.org/vuls/id/561275 http://www.iss.net/security_center/static/9715.php
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.