Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.871353
Category:Red Hat Local Security Checks
Title:RedHat Update for openssl RHSA-2015:0800-01
Summary:The remote host is missing an update for the 'openssl'; package(s) announced via the referenced advisory.
Description:Summary:
The remote host is missing an update for the 'openssl'
package(s) announced via the referenced advisory.

Vulnerability Insight:
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3)
and Transport Layer Security (TLS v1) protocols, as well as a
full-strength, general purpose cryptography library.

It was discovered that OpenSSL would accept ephemeral RSA keys when using
non-export RSA cipher suites. A malicious server could make a TLS/SSL
client using OpenSSL use a weaker key exchange method. (CVE-2015-0204)

An integer underflow flaw, leading to a buffer overflow, was found in the
way OpenSSL decoded malformed Base64-encoded inputs. An attacker able to
make an application using OpenSSL decode a specially crafted Base64-encoded
input (such as a PEM file) could use this flaw to cause the application to
crash. Note: this flaw is not exploitable via the TLS/SSL protocol because
the data being transferred is not Base64-encoded. (CVE-2015-0292)

A denial of service flaw was found in the way OpenSSL handled SSLv2
handshake messages. A remote attacker could use this flaw to cause a
TLS/SSL server using OpenSSL to exit on a failed assertion if it had both
the SSLv2 protocol and EXPORT-grade cipher suites enabled. (CVE-2015-0293)

Multiple flaws were found in the way OpenSSL parsed X.509 certificates.
An attacker could use these flaws to modify an X.509 certificate to produce
a certificate with a different fingerprint without invalidating its
signature, and possibly bypass fingerprint-based blacklisting in
applications. (CVE-2014-8275)

An out-of-bounds write flaw was found in the way OpenSSL reused certain
ASN.1 structures. A remote attacker could possibly use a specially crafted
ASN.1 structure that, when parsed by an application, would cause that
application to crash. (CVE-2015-0287)

A NULL pointer dereference flaw was found in OpenSSL's X.509 certificate
handling implementation. A specially crafted X.509 certificate could cause
an application using OpenSSL to crash if the application attempted to
convert the certificate to a certificate request. (CVE-2015-0288)

A NULL pointer dereference was found in the way OpenSSL handled certain
PKCS#7 inputs. An attacker able to make an application using OpenSSL
verify, decrypt, or parse a specially crafted PKCS#7 input could cause that
application to crash. TLS/SSL clients and servers using OpenSSL were not
affected by this flaw. (CVE-2015-0289)

Red Hat would like to thank the OpenSSL project for reporting
CVE-2015-0287, CVE-2015-0288, CVE-2015-0289, CVE-2015-0292, and
CVE-2015-0293. Upstream acknowledges Emilia Kasper of the OpenSSL
development team as the original reporter of CVE-2015-0287, Brian Carpenter
as the original reporter ...

Description truncated, please see the referenced URL(s) for more information.

Affected Software/OS:
openssl on Red Hat Enterprise Linux (v. 5 server)

Solution:
Please Install the Updated Packages.

CVSS Score:
7.5

CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2014-8275
http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
BugTraq ID: 71935
http://www.securityfocus.com/bid/71935
Cisco Security Advisory: 20150310 Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150310-ssl
Debian Security Information: DSA-3125 (Google Search)
http://www.debian.org/security/2015/dsa-3125
http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148363.html
HPdes Security Advisory: HPSBGN03299
http://marc.info/?l=bugtraq&m=142720981827617&w=2
HPdes Security Advisory: HPSBHF03289
http://marc.info/?l=bugtraq&m=142721102728110&w=2
HPdes Security Advisory: HPSBMU03380
http://marc.info/?l=bugtraq&m=143748090628601&w=2
HPdes Security Advisory: HPSBMU03396
http://marc.info/?l=bugtraq&m=144050205101530&w=2
HPdes Security Advisory: HPSBMU03397
http://marc.info/?l=bugtraq&m=144050297101809&w=2
HPdes Security Advisory: HPSBMU03409
http://marc.info/?l=bugtraq&m=144050155601375&w=2
HPdes Security Advisory: HPSBMU03413
http://marc.info/?l=bugtraq&m=144050254401665&w=2
HPdes Security Advisory: HPSBOV03318
http://marc.info/?l=bugtraq&m=142895206924048&w=2
HPdes Security Advisory: HPSBUX03162
http://marc.info/?l=bugtraq&m=142496179803395&w=2
HPdes Security Advisory: HPSBUX03244
http://marc.info/?l=bugtraq&m=142496289803847&w=2
HPdes Security Advisory: SSRT101885
HPdes Security Advisory: SSRT101987
http://www.mandriva.com/security/advisories?name=MDVSA-2015:019
http://www.mandriva.com/security/advisories?name=MDVSA-2015:062
RedHat Security Advisories: RHSA-2015:0066
http://rhn.redhat.com/errata/RHSA-2015-0066.html
RedHat Security Advisories: RHSA-2015:0800
http://rhn.redhat.com/errata/RHSA-2015-0800.html
http://www.securitytracker.com/id/1033378
SuSE Security Announcement: SUSE-SU-2015:0578 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html
SuSE Security Announcement: SUSE-SU-2015:0946 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00026.html
SuSE Security Announcement: openSUSE-SU-2015:0130 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00021.html
SuSE Security Announcement: openSUSE-SU-2015:1277 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.html
SuSE Security Announcement: openSUSE-SU-2016:0640 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html
Common Vulnerability Exposure (CVE) ID: CVE-2015-0204
BugTraq ID: 71936
http://www.securityfocus.com/bid/71936
BugTraq ID: 91787
http://www.securityfocus.com/bid/91787
https://security.gentoo.org/glsa/201503-11
HPdes Security Advisory: HPSBMU03345
http://marc.info/?l=bugtraq&m=144043644216842&w=2
HPdes Security Advisory: HPSBUX03334
http://marc.info/?l=bugtraq&m=143213830203296&w=2
HPdes Security Advisory: SSRT102000
http://www.mandriva.com/security/advisories?name=MDVSA-2015:063
https://freakattack.com/
RedHat Security Advisories: RHSA-2015:0849
http://rhn.redhat.com/errata/RHSA-2015-0849.html
RedHat Security Advisories: RHSA-2016:1650
http://rhn.redhat.com/errata/RHSA-2016-1650.html
SuSE Security Announcement: SUSE-SU-2015:1085 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00014.html
SuSE Security Announcement: SUSE-SU-2015:1086 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00015.html
SuSE Security Announcement: SUSE-SU-2015:1138 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00022.html
SuSE Security Announcement: SUSE-SU-2015:1161 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00031.html
SuSE Security Announcement: SUSE-SU-2015:2166 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00000.html
SuSE Security Announcement: SUSE-SU-2015:2168 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00001.html
SuSE Security Announcement: SUSE-SU-2015:2182 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00003.html
SuSE Security Announcement: SUSE-SU-2015:2192 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00004.html
SuSE Security Announcement: SUSE-SU-2015:2216 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00006.html
SuSE Security Announcement: SUSE-SU-2016:0113 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00005.html
XForce ISS Database: openssl-cve20150204-weak-security(99707)
https://exchange.xforce.ibmcloud.com/vulnerabilities/99707
Common Vulnerability Exposure (CVE) ID: CVE-2015-0287
http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html
http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html
http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
BugTraq ID: 73227
http://www.securityfocus.com/bid/73227
Debian Security Information: DSA-3197 (Google Search)
http://www.debian.org/security/2015/dsa-3197
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152844.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152733.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152734.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157177.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156823.html
FreeBSD Security Advisory: FreeBSD-SA-15:06
https://www.freebsd.org/security/advisories/FreeBSD-SA-15%3A06.openssl.asc
HPdes Security Advisory: HPSBGN03306
http://marc.info/?l=bugtraq&m=142841429220765&w=2
RedHat Security Advisories: RHSA-2015:0715
http://rhn.redhat.com/errata/RHSA-2015-0715.html
RedHat Security Advisories: RHSA-2015:0716
http://rhn.redhat.com/errata/RHSA-2015-0716.html
RedHat Security Advisories: RHSA-2015:0752
http://rhn.redhat.com/errata/RHSA-2015-0752.html
http://www.securitytracker.com/id/1031929
SuSE Security Announcement: SUSE-SU-2015:0541 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00022.html
SuSE Security Announcement: SUSE-SU-2016:0678 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00017.html
SuSE Security Announcement: openSUSE-SU-2015:0554 (Google Search)
http://lists.opensuse.org/opensuse-updates/2015-03/msg00062.html
http://www.ubuntu.com/usn/USN-2537-1
Common Vulnerability Exposure (CVE) ID: CVE-2015-0288
BugTraq ID: 73237
http://www.securityfocus.com/bid/73237
Common Vulnerability Exposure (CVE) ID: CVE-2015-0289
BugTraq ID: 73231
http://www.securityfocus.com/bid/73231
Common Vulnerability Exposure (CVE) ID: CVE-2015-0292
BugTraq ID: 73228
http://www.securityfocus.com/bid/73228
Common Vulnerability Exposure (CVE) ID: CVE-2015-0293
BugTraq ID: 73232
http://www.securityfocus.com/bid/73232
SuSE Security Announcement: SUSE-SU-2016:0617 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00001.html
SuSE Security Announcement: SUSE-SU-2016:0620 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00002.html
SuSE Security Announcement: SUSE-SU-2016:0621 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00003.html
SuSE Security Announcement: SUSE-SU-2016:0624 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00004.html
SuSE Security Announcement: SUSE-SU-2016:0631 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00007.html
SuSE Security Announcement: SUSE-SU-2016:0641 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00012.html
SuSE Security Announcement: SUSE-SU-2016:1057 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00038.html
SuSE Security Announcement: openSUSE-SU-2016:0628 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00006.html
SuSE Security Announcement: openSUSE-SU-2016:0637 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html
SuSE Security Announcement: openSUSE-SU-2016:0638 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00010.html
SuSE Security Announcement: openSUSE-SU-2016:0720 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00025.html
CopyrightCopyright (C) 2015 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.