| Description: | Description:
The remote host is missing updates announced in
advisory TSLSA-2006-0054.
openssh < TSL 3.0 > < TSL 2.2 > < TSEL 2 >
- New Upstream.
- SECURITY Fix: Tavis Ormandy of Google Security Team has reported a
vulnerability in OpenSSH, which can be exploited by malicious people
to cause a DoS. If ssh protocol 1 is enabled, this can be exploited
to cause a DoS due to CPU consumption by sending specially crafted
ssh packets.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the names CVE-2006-4924 to this issue.
openssl < TSL 3.0 > < TSL 2.2 > < TSEL 2 >
- New Upstream.
- SECURITY Fix: Dr. S. N. Henson has discovered vulnerabilities in
OpenSSL which could be exploited by attackers to cause denial of
service.
- During the parsing of certain invalid ASN.1 structures an error
condition is mishandled. This can result in an infinite loop which
consumes system memory.
- Certain types of public key can take disproportionate amounts of
time to process. This could be used by an attacker in a denial of
service attack.
- Tavis Ormandy and Will Drewry of the Google Security Team has
discovered the following two vulnerabilities in OpenSSL :
- Fix buffer overflow in SSL_get_shared_ciphers() utility function
which could allow an attacker to send a list of ciphers to an
application that uses it and overrun a buffer.
- A flaw in the SSLv2 client code was discovered. When a client
application used OpenSSL to create an SSLv2 connection to a
malicious server, that server could cause the client to crash.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the names CVE-2006-2937, CVE-2006-2940, CVE-2006-3738
and CVE-2006-4343 to these issues.
Solution:
Update your system with the packages as indicated in
the referenced security advisory.
http://www.securityspace.com/smysecure/catid.html?in=TSLSA-2006-0054
Risk factor : Critical
CVSS Score:
10.0
|
