Test ID:	1.3.6.1.4.1.25623.1.0.64323
Category:	Ubuntu Local Security Checks
Title:	Ubuntu USN-792-1 (openssl)
Summary:	Ubuntu USN-792-1 (openssl)
Description:	The remote host is missing an update to openssl announced via advisory USN-792-1. Details follow: It was discovered that OpenSSL did not limit the number of DTLS records it would buffer when they arrived with a future epoch. A remote attacker could cause a denial of service via memory resource consumption by sending a large number of crafted requests. (CVE-2009-1377) It was discovered that OpenSSL did not properly free memory when processing DTLS fragments. A remote attacker could cause a denial of service via memory resource consumption by sending a large number of crafted requests. (CVE-2009-1378) It was discovered that OpenSSL did not properly handle certain server certificates when processing DTLS packets. A remote DTLS server could cause a denial of service by sending a message containing a specially crafted server certificate. (CVE-2009-1379) It was discovered that OpenSSL did not properly handle a DTLS ChangeCipherSpec packet when it occured before ClientHello. A remote attacker could cause a denial of service by sending a specially crafted request. (CVE-2009-1386) It was discovered that OpenSSL did not properly handle out of sequence DTLS handshake messages. A remote attacker could cause a denial of service by sending a specially crafted request. (CVE-2009-1387) Solution: The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: libssl0.9.8 0.9.8a-7ubuntu0.9 Ubuntu 8.04 LTS: libssl0.9.8 0.9.8g-4ubuntu3.7 Ubuntu 8.10: libssl0.9.8 0.9.8g-10.1ubuntu2.4 Ubuntu 9.04: libssl0.9.8 0.9.8g-15ubuntu3.2 After a standard system upgrade you need to reboot your computer to effect the necessary changes. http://www.securityspace.com/smysecure/catid.html?in=USN-792-1
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-1377 http://marc.info/?l=openssl-dev&m=124247675613888&w=2 http://www.openwall.com/lists/oss-security/2009/05/18/1 http://lists.vmware.com/pipermail/security-announce/2010/000082.html https://launchpad.net/bugs/cve/2009-1377 http://security.gentoo.org/glsa/glsa-200912-01.xml HPdes Security Advisory: HPSBMA02492 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444 HPdes Security Advisory: SSRT100079 http://www.mandriva.com/security/advisories?name=MDVSA-2009:120 NETBSD Security Advisory: NetBSD-SA2009-009 ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-009.txt.asc http://www.redhat.com/support/errata/RHSA-2009-1335.html http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.663049 SuSE Security Announcement: SUSE-SR:2009:011 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html http://www.ubuntu.com/usn/USN-792-1 BugTraq ID: 35001 http://www.securityfocus.com/bid/35001 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6683 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9663 http://www.securitytracker.com/id?1022241 http://secunia.com/advisories/35128 http://secunia.com/advisories/35416 http://secunia.com/advisories/35461 http://secunia.com/advisories/35571 http://secunia.com/advisories/35729 http://secunia.com/advisories/37003 http://secunia.com/advisories/38761 http://secunia.com/advisories/38794 http://secunia.com/advisories/38834 http://secunia.com/advisories/42724 http://secunia.com/advisories/42733 http://secunia.com/advisories/36533 http://www.vupen.com/english/advisories/2009/1377 http://www.vupen.com/english/advisories/2010/0528 Common Vulnerability Exposure (CVE) ID: CVE-2009-1378 http://www.milw0rm.com/exploits/8720 http://marc.info/?l=openssl-dev&m=124247679213944&w=2 http://marc.info/?l=openssl-dev&m=124263491424212&w=2 https://launchpad.net/bugs/cve/2009-1378 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11309 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7229 Common Vulnerability Exposure (CVE) ID: CVE-2009-1379 http://www.openwall.com/lists/oss-security/2009/05/18/4 https://launchpad.net/bugs/cve/2009-1379 BugTraq ID: 35138 http://www.securityfocus.com/bid/35138 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6848 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9744 XForce ISS Database: openssl-dtls1retrievebufferedfragment-dos(50661) http://xforce.iss.net/xforce/xfdb/50661 Common Vulnerability Exposure (CVE) ID: CVE-2009-1386 http://www.milw0rm.com/exploits/8873 http://www.openwall.com/lists/oss-security/2009/06/02/1 SuSE Security Announcement: SUSE-SR:2009:012 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html BugTraq ID: 35174 http://www.securityfocus.com/bid/35174 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11179 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7469 http://secunia.com/advisories/35685 XForce ISS Database: openssl-changecipherspec-dos(50963) http://xforce.iss.net/xforce/xfdb/50963 Common Vulnerability Exposure (CVE) ID: CVE-2009-1387 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10740 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7592 Common Vulnerability Exposure (CVE) ID: CVE-2009-1628 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=808 Common Vulnerability Exposure (CVE) ID: CVE-2009-1886 Debian Security Information: DSA-1823 (Google Search) http://www.debian.org/security/2009/dsa-1823 http://www.mandriva.com/security/advisories?name=MDVSA-2009:196 http://www.slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.521591 http://www.ubuntu.com/usn/USN-839-1 BugTraq ID: 35472 http://www.securityfocus.com/bid/35472 http://www.securitytracker.com/id?1022441 http://secunia.com/advisories/35539 http://secunia.com/advisories/35573 http://secunia.com/advisories/35606 http://secunia.com/advisories/36918 http://www.vupen.com/english/advisories/2009/1664 XForce ISS Database: samba-smbclient-format-string(51328) http://xforce.iss.net/xforce/xfdb/51328 Common Vulnerability Exposure (CVE) ID: CVE-2009-1888 Bugtraq: 20091112 rPSA-2009-0145-1 samba samba-client samba-server samba-swat (Google Search) http://www.securityfocus.com/archive/1/archive/1/507856/100/0/threaded http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10790 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7292 http://www.securitytracker.com/id?1022442 XForce ISS Database: samba-acl-security-bypass(51327) http://xforce.iss.net/xforce/xfdb/51327 Common Vulnerability Exposure (CVE) ID: CVE-2009-1394 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=809 Bugtraq: 20090625 iDefense Security Advisory 06.25.09: Motorola Timbuktu Pro PlughNTCommand Stack Based Buffer Overflow Vulnerability (Google Search) http://www.securityfocus.com/archive/1/archive/1/504554/100/0/threaded http://www.netopia.com/software/products/tb2/ BugTraq ID: 35496 http://www.securityfocus.com/bid/35496 http://www.securitytracker.com/id?1022455 http://secunia.com/advisories/35533 Common Vulnerability Exposure (CVE) ID: CVE-2009-1150 Debian Security Information: DSA-1824 (Google Search) http://www.debian.org/security/2009/dsa-1824 http://security.gentoo.org/glsa/glsa-200906-03.xml http://www.mandriva.com/security/advisories?name=MDVSA-2009:115 SuSE Security Announcement: SUSE-SR:2009:008 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html BugTraq ID: 34251 http://www.securityfocus.com/bid/34251 http://secunia.com/advisories/34430 http://secunia.com/advisories/34642 http://secunia.com/advisories/35585 http://secunia.com/advisories/35635 Common Vulnerability Exposure (CVE) ID: CVE-2009-1151 Bugtraq: 20090609 CVE-2009-1151: phpMyAdmin Remote Code Execution Proof of Concept (Google Search) http://www.securityfocus.com/archive/1/archive/1/504191/100/0/threaded http://www.milw0rm.com/exploits/8921 http://labs.neohapsis.com/2009/04/06/about-cve-2009-1151/ http://www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/ BugTraq ID: 34236 http://www.securityfocus.com/bid/34236 Common Vulnerability Exposure (CVE) ID: CVE-2009-1303 Debian Security Information: DSA-1797 (Google Search) http://www.debian.org/security/2009/dsa-1797 Debian Security Information: DSA-1830 (Google Search) http://www.debian.org/security/2009/dsa-1830 https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00683.html http://www.mandriva.com/security/advisories?name=MDVSA-2009:111 http://www.mandriva.com/security/advisories?name=MDVSA-2009:141 http://www.redhat.com/support/errata/RHSA-2009-0436.html RedHat Security Advisories: RHSA-2009:0437 http://rhn.redhat.com/errata/RHSA-2009-0437.html http://www.redhat.com/support/errata/RHSA-2009-1125.html http://www.redhat.com/support/errata/RHSA-2009-1126.html http://www.slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.454275 http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1 SuSE Security Announcement: SUSE-SR:2009:010 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html http://www.ubuntulinux.org/support/documentation/usn/usn-764-1 http://www.ubuntu.com/usn/usn-782-1 BugTraq ID: 34656 http://www.securityfocus.com/bid/34656 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:5810 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:5992 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6151 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6646 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9455 http://www.securitytracker.com/id?1022090 http://secunia.com/advisories/34758 http://secunia.com/advisories/34894 http://secunia.com/advisories/34843 http://secunia.com/advisories/34844 http://secunia.com/advisories/34780 http://secunia.com/advisories/35065 http://secunia.com/advisories/35042 http://secunia.com/advisories/35536 http://secunia.com/advisories/35602 http://www.vupen.com/english/advisories/2009/1125 Common Vulnerability Exposure (CVE) ID: CVE-2009-1305 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10110 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6090 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6232 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6248 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6921 Common Vulnerability Exposure (CVE) ID: CVE-2009-1306 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10150 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6021 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6194 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6312 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6710 http://www.securitytracker.com/id?1022095 Common Vulnerability Exposure (CVE) ID: CVE-2009-1307 https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00444.html https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00504.html http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.425408 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10972 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:5933 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6154 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6266 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7008 http://www.securitytracker.com/id?1022093 http://secunia.com/advisories/35561 http://secunia.com/advisories/35882 Common Vulnerability Exposure (CVE) ID: CVE-2009-1308 http://www.theregister.co.uk/2009/03/08/ebay_scam_wizardy/ http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10428 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6173 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6185 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6296 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7285 http://www.securitytracker.com/id?1022097 Common Vulnerability Exposure (CVE) ID: CVE-2009-1309 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:5265 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:5591 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6139 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6831 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9494 http://www.securitytracker.com/id?1022094 Common Vulnerability Exposure (CVE) ID: CVE-2009-1392 Debian Security Information: DSA-1820 (Google Search) http://www.debian.org/security/2009/dsa-1820 https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00574.html https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00657.html RedHat Security Advisories: RHSA-2009:1095 https://rhn.redhat.com/errata/RHSA-2009-1095.html RedHat Security Advisories: RHSA-2009:1096 http://rhn.redhat.com/errata/RHSA-2009-1096.html http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.372468 http://sunsolve.sun.com/search/document.do?assetkey=1-26-265068-1 http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020800.1-1 BugTraq ID: 35326 http://www.securityfocus.com/bid/35326 BugTraq ID: 35370 http://www.securityfocus.com/bid/35370 http://osvdb.org/55144 http://osvdb.org/55145 http://osvdb.org/55146 http://osvdb.org/55147 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9501 http://securitytracker.com/id?1022376 http://www.securitytracker.com/id?1022397 http://secunia.com/advisories/35331 http://secunia.com/advisories/35428 http://secunia.com/advisories/35431 http://secunia.com/advisories/35439 http://secunia.com/advisories/35440 http://secunia.com/advisories/35468 http://secunia.com/advisories/35415 http://www.vupen.com/english/advisories/2009/1572 http://www.vupen.com/english/advisories/2009/2152 Common Vulnerability Exposure (CVE) ID: CVE-2009-1833 BugTraq ID: 35372 http://www.securityfocus.com/bid/35372 http://osvdb.org/55152 http://osvdb.org/55153 http://osvdb.org/55154 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11487 Common Vulnerability Exposure (CVE) ID: CVE-2009-1836 http://research.microsoft.com/apps/pubs/default.aspx?id=79323 http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf BugTraq ID: 35380 http://www.securityfocus.com/bid/35380 http://osvdb.org/55160 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11764 http://www.securitytracker.com/id?1022396 Common Vulnerability Exposure (CVE) ID: CVE-2009-1838 BugTraq ID: 35383 http://www.securityfocus.com/bid/35383 http://osvdb.org/55157 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11080 Common Vulnerability Exposure (CVE) ID: CVE-2009-1841 BugTraq ID: 35373 http://www.securityfocus.com/bid/35373 http://osvdb.org/55159 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9815
Copyright	Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com

This is only one of 32582 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.

New User Registration Email: UserID: Passwd: Please email me your monthly newsletters, informing the latest services, improvements & surveys. Please email me a vulnerability test announcement whenever a new test is added.     Privacy

Registered User Login   UserID:     Passwd:     Forgot userid or passwd? Email/Userid: