Test ID:	1.3.6.1.4.1.25623.1.1.13.2015.190.01
Category:	Slackware Local Security Checks
Title:	Slackware: Security Advisory (SSA:2015-190-01)
Summary:	The remote host is missing an update for the 'openssl' package(s) announced via the SSA:2015-190-01 advisory.
Description:	Summary: The remote host is missing an update for the 'openssl' package(s) announced via the SSA:2015-190-01 advisory. Vulnerability Insight: New openssl packages are available for Slackware 14.0, 14.1, and -current to fix a security issue. Here are the details from the Slackware 14.1 ChangeLog: +--------------------------+ patches/packages/openssl-1.0.1p-i486-1_slack14.1.txz: Upgraded. This update fixes the following security issue: Alternative chains certificate forgery (CVE-2015-1793). During certificate verification, OpenSSL (starting from version 1.0.1n and 1.0.2b) will attempt to find an alternative certificate chain if the first attempt to build such a chain fails. An error in the implementation of this logic can mean that an attacker could cause certain checks on untrusted certificates to be bypassed, such as the CA flag, enabling them to use a valid leaf certificate to act as a CA and 'issue' an invalid certificate. This issue will impact any application that verifies certificates including SSL/TLS/DTLS clients and SSL/TLS/DTLS servers using client authentication. This issue affects OpenSSL versions 1.0.2c, 1.0.2b, 1.0.1n and 1.0.1o. This issue was reported to OpenSSL on 24th June 2015 by Adam Langley/David Benjamin (Google/BoringSSL). The fix was developed by the BoringSSL project. For more information, see: [links moved to references] (* Security fix *) patches/packages/openssl-solibs-1.0.1p-i486-1_slack14.1.txz: Upgraded. +--------------------------+ Affected Software/OS: 'openssl' package(s) on Slackware 14.0, Slackware 14.1, Slackware current. Solution: Please install the updated package(s). CVSS Score: 6.4 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-1793 BugTraq ID: 75652 http://www.securityfocus.com/bid/75652 BugTraq ID: 91787 http://www.securityfocus.com/bid/91787 Cisco Security Advisory: 20150710 OpenSSL Alternative Chains Certificate Forgery Vulnerability (July 2015) Affecting Cisco Products http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150710-openssl https://www.exploit-db.com/exploits/38640/ http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161747.html http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161782.html FreeBSD Security Advisory: FreeBSD-SA-15:12 https://www.freebsd.org/security/advisories/FreeBSD-SA-15:12.openssl.asc https://security.gentoo.org/glsa/201507-15 HPdes Security Advisory: HPSBGN03424 http://marc.info/?l=bugtraq&m=144370846326989&w=2 HPdes Security Advisory: HPSBUX03388 http://marc.info/?l=bugtraq&m=143880121627664&w=2 HPdes Security Advisory: SSRT102180 NETBSD Security Advisory: NetBSD-SA2015-008 http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc http://www.securitytracker.com/id/1032817 http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.561427
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.