Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.66694
Category:Red Hat Local Security Checks
Title:RedHat Security Advisory RHSA-2010:0054
Summary:NOSUMMARY
Description:Description:
The remote host is missing updates announced in
advisory RHSA-2010:0054.

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3)
and Transport Layer Security (TLS v1) protocols, as well as a
full-strength, general purpose cryptography library.

It was found that the OpenSSL library did not properly re-initialize its
internal state in the SSL_library_init() function after previous calls to
the CRYPTO_cleanup_all_ex_data() function, which would cause a memory leak
for each subsequent SSL connection. This flaw could cause server
applications that call those functions during reload, such as a combination
of the Apache HTTP Server, mod_ssl, PHP, and cURL, to consume all available
memory, resulting in a denial of service. (CVE-2009-4355)

Dan Kaminsky found that browsers could accept certificates with MD2 hash
signatures, even though MD2 is no longer considered a cryptographically
strong algorithm. This could make it easier for an attacker to create a
malicious certificate that would be treated as trusted by a browser.
OpenSSL now disables the use of the MD2 algorithm inside signatures by
default. (CVE-2009-2409)

All OpenSSL users should upgrade to these updated packages, which contain
backported patches to resolve these issues. For the update to take effect,
all services linked to the OpenSSL library must be restarted, or the system
rebooted.

Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

http://rhn.redhat.com/errata/RHSA-2010-0054.html
http://www.redhat.com/security/updates/classification/#moderate

Risk factor : High

CVSS Score:
5.1

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2009-2409
http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
Bugtraq: 20101207 VMSA-2010-0019 VMware ESX third party updates for Service Console (Google Search)
http://www.securityfocus.com/archive/1/515055/100/0/threaded
Debian Security Information: DSA-1874 (Google Search)
http://www.debian.org/security/2009/dsa-1874
Debian Security Information: DSA-1888 (Google Search)
https://www.debian.org/security/2009/dsa-1888
http://security.gentoo.org/glsa/glsa-200911-02.xml
http://security.gentoo.org/glsa/glsa-200912-01.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2009:197
http://www.mandriva.com/security/advisories?name=MDVSA-2009:216
http://www.mandriva.com/security/advisories?name=MDVSA-2009:258
http://www.mandriva.com/security/advisories?name=MDVSA-2010:084
https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html
https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.html
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10763
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6631
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7155
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8594
http://www.redhat.com/support/errata/RHSA-2009-1207.html
http://www.redhat.com/support/errata/RHSA-2009-1432.html
RedHat Security Advisories: RHSA-2010:0095
https://rhn.redhat.com/errata/RHSA-2010-0095.html
http://www.securitytracker.com/id?1022631
http://secunia.com/advisories/36139
http://secunia.com/advisories/36157
http://secunia.com/advisories/36434
http://secunia.com/advisories/36669
http://secunia.com/advisories/36739
http://secunia.com/advisories/37386
http://secunia.com/advisories/42467
http://www.ubuntu.com/usn/usn-810-1
https://usn.ubuntu.com/810-2/
http://www.vupen.com/english/advisories/2009/2085
http://www.vupen.com/english/advisories/2009/3184
http://www.vupen.com/english/advisories/2010/3126
Common Vulnerability Exposure (CVE) ID: CVE-2009-4355
Debian Security Information: DSA-1970 (Google Search)
http://www.debian.org/security/2010/dsa-1970
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038587.html
HPdes Security Advisory: HPSBUX02517
http://marc.info/?l=bugtraq&m=127128920008563&w=2
HPdes Security Advisory: SSRT100058
http://www.mandriva.com/security/advisories?name=MDVSA-2010:022
http://www.openwall.com/lists/oss-security/2010/01/13/3
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11260
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12168
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6678
http://secunia.com/advisories/38175
http://secunia.com/advisories/38181
http://secunia.com/advisories/38200
http://secunia.com/advisories/38761
http://secunia.com/advisories/39461
http://secunia.com/advisories/42724
http://secunia.com/advisories/42733
http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.663049
SuSE Security Announcement: SUSE-SA:2010:008 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
http://www.ubuntu.com/usn/USN-884-1
http://www.vupen.com/english/advisories/2010/0124
http://www.vupen.com/english/advisories/2010/0839
http://www.vupen.com/english/advisories/2010/0916
CopyrightCopyright (c) 2010 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.