|Category:||Ubuntu Local Security Checks|
|Title:||Ubuntu USN-620-1 (openssl)|
|Summary:||Ubuntu USN-620-1 (openssl)|
The remote host is missing an update to openssl
announced via advisory USN-620-1.
A security issue affects the following Ubuntu releases:
Ubuntu 8.04 LTS
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
It was discovered that OpenSSL was vulnerable to a double-free
when using TLS server extensions. A remote attacker could send a
crafted packet and cause a denial of service via application crash
in applications linked against OpenSSL. Ubuntu 8.04 LTS does not
compile TLS server extensions by default. (CVE-2008-0891)
It was discovered that OpenSSL could dereference a NULL pointer.
If a user or automated system were tricked into connecting to a
malicious server with particular cipher suites, a remote attacker
could cause a denial of service via application crash.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 8.04 LTS:
After a standard system upgrade you need to reboot your computer to
effect the necessary changes.
Risk factor : Medium
Common Vulnerability Exposure (CVE) ID: CVE-2008-0891|
CERT/CC vulnerability note: VU#661475
BugTraq ID: 29405
XForce ISS Database: openssl-servername-dos(42666)
Common Vulnerability Exposure (CVE) ID: CVE-2008-1672
Bugtraq: 20080602 rPSA-2008-0181-1 openssl openssl-scripts (Google Search)
CERT/CC vulnerability note: VU#520586
XForce ISS Database: openssl-serverkey-dos(42667)
|Copyright||Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com|
|This is only one of 40037 vulnerability tests in our test suite. Find out more about running a complete security audit.|
To run a free test of this vulnerability against your system, register below.