Test ID:	1.3.6.1.4.1.25623.1.0.64713
Category:	Fedora Local Security Checks
Title:	Fedora Core 10 FEDORA-2009-8794 (neon)
Summary:	The remote host is missing an update to neon;announced via advisory FEDORA-2009-8794.;Note: This VT has been deprecated and is therefore no longer functional.
Description:	Summary: The remote host is missing an update to neon announced via advisory FEDORA-2009-8794. Note: This VT has been deprecated and is therefore no longer functional. Vulnerability Insight: Update Information: This update includes the latest release of neon, version 0.28.6. This fixes two security issues: * the billion laughs attack against expat could allow a Denial of Service attack by a malicious server. (CVE-2009-2473) * an embedded NUL byte in a certificate subject name could allow an undetected MITM attack against an SSL server if a trusted CA issues such a cert. Several bug fixes are also included, notably: * X.509v1 CA certificates are trusted by default * Fix handling of some PKCS#12 certificates ChangeLog: * Wed Aug 19 2009 Joe Orton 0.28.6-1 - update to 0.28.6 * Fri May 29 2009 Joe Orton 0.28.4-1.1 - trust V1 CA certs by default (#502451) * Fri Mar 6 2009 Joe Orton 0.28.4-1 - update to 0.28.4 * Mon Jan 19 2009 Joe Orton 0.28.3-3 - use install-p in make install (Robert Scheck, #226189) Solution: Apply the appropriate updates. This update can be installed with the yum update program. Use su -c 'yum update neon' at the command line. CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-2473 36371 http://secunia.com/advisories/36371 ADV-2009-2341 http://www.vupen.com/english/advisories/2009/2341 APPLE-SA-2010-11-10-1 http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html FEDORA-2009-8794 https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00924.html FEDORA-2009-8815 https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00945.html MDVSA-2009:221 http://www.mandriva.com/security/advisories?name=MDVSA-2009:221 RHSA-2013:0131 http://rhn.redhat.com/errata/RHSA-2013-0131.html SUSE-SR:2009:018 http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html [neon] 20090818 CVE-2009-2473: fix for "billion laughs" attack against expat http://lists.manyfish.co.uk/pipermail/neon/2009-August/001045.html [neon] 20090818 neon: release 0.28.6 (SECURITY) http://lists.manyfish.co.uk/pipermail/neon/2009-August/001044.html http://support.apple.com/kb/HT4435 neon-xml-dos(52633) https://exchange.xforce.ibmcloud.com/vulnerabilities/52633 oval:org.mitre.oval:def:9461 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9461
Copyright	Copyright (C) 2009 E-Soft Inc.

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.