Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.69189
Category:Red Hat Local Security Checks
Title:RedHat Security Advisory RHSA-2010:0888
Summary:NOSUMMARY
Description:Description:
The remote host is missing updates announced in
advisory RHSA-2010:0888.

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3)
and Transport Layer Security (TLS v1) protocols, as well as a
full-strength, general purpose cryptography library.

A race condition flaw has been found in the OpenSSL TLS server extension
parsing code, which could affect some multithreaded OpenSSL applications.
Under certain specific conditions, it may be possible for a remote attacker
to trigger this race condition and cause such an application to crash, or
possibly execute arbitrary code with the permissions of the application.
(CVE-2010-3864)

Note that this issue does not affect the Apache HTTP Server. Refer to Red
Hat Bugzilla bug 649304 for more technical details on how to determine if
your application is affected.

Red Hat would like to thank Rob Hulswit for reporting this issue.

All OpenSSL users should upgrade to these updated packages, which contain a
backported patch to resolve this issue. For the update to take effect, all
services linked to the OpenSSL library must be restarted, or the system
rebooted.

Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

http://rhn.redhat.com/errata/RHSA-2010-0888.html
http://www.redhat.com/security/updates/classification/#important

Risk factor : High

CVSS Score:
7.6

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2010-3864
http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html
Bugtraq: 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX (Google Search)
http://www.securityfocus.com/archive/1/516397/100/0/threaded
CERT/CC vulnerability note: VU#737740
http://www.kb.cert.org/vuls/id/737740
Debian Security Information: DSA-2125 (Google Search)
http://www.debian.org/security/2010/dsa-2125
http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051255.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051170.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051237.html
FreeBSD Security Advisory: FreeBSD-SA-10:10
http://security.FreeBSD.org/advisories/FreeBSD-SA-10:10.openssl.asc
HPdes Security Advisory: HPSBGN02740
http://marc.info/?l=bugtraq&m=132828103218869&w=2
HPdes Security Advisory: HPSBMA02658
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02794777
HPdes Security Advisory: HPSBOV02670
http://marc.info/?l=bugtraq&m=130497251507577&w=2
HPdes Security Advisory: HPSBUX02638
http://marc.info/?l=bugtraq&m=129916880600544&w=2
HPdes Security Advisory: SSRT100339
HPdes Security Advisory: SSRT100413
HPdes Security Advisory: SSRT100475
HPdes Security Advisory: SSRT100741
https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html
https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.html
RedHat Security Advisories: RHSA-2010:0888
https://rhn.redhat.com/errata/RHSA-2010-0888.html
http://securitytracker.com/id?1024743
http://secunia.com/advisories/42241
http://secunia.com/advisories/42243
http://secunia.com/advisories/42309
http://secunia.com/advisories/42336
http://secunia.com/advisories/42352
http://secunia.com/advisories/42397
http://secunia.com/advisories/42413
http://secunia.com/advisories/43312
http://secunia.com/advisories/44269
http://secunia.com/advisories/57353
http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.668793
SuSE Security Announcement: SUSE-SR:2010:022 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00006.html
http://www.vupen.com/english/advisories/2010/3041
http://www.vupen.com/english/advisories/2010/3077
http://www.vupen.com/english/advisories/2010/3097
http://www.vupen.com/english/advisories/2010/3121
CopyrightCopyright (c) 2011 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.