Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.871569
Category:Red Hat Local Security Checks
Title:RedHat Update for openssl098e RHSA-2016:0372-01
Summary:The remote host is missing an update for the 'openssl098e'; package(s) announced via the referenced advisory.
Description:Summary:
The remote host is missing an update for the 'openssl098e'
package(s) announced via the referenced advisory.

Vulnerability Insight:
OpenSSL is a toolkit that implements the
Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols,
as well as a full-strength, general purpose cryptography library.

A padding oracle flaw was found in the Secure Sockets Layer version 2.0
(SSLv2) protocol. An attacker can potentially use this flaw to decrypt
RSA-encrypted cipher text from a connection using a newer SSL/TLS protocol
version, allowing them to decrypt such connections. This cross-protocol
attack is publicly referred to as DROWN. (CVE-2016-0800)

Note: This issue was addressed by disabling the SSLv2 protocol by default
when using the 'SSLv23' connection methods, and removing support for weak
SSLv2 cipher suites. For more information, refer to the knowledge base
article linked to in the References section.

It was discovered that the SSLv2 servers using OpenSSL accepted SSLv2
connection handshakes that indicated non-zero clear key length for
non-export cipher suites. An attacker could use this flaw to decrypt
recorded SSLv2 sessions with the server by using it as a decryption
oracle.(CVE-2016-0703)

It was discovered that the SSLv2 protocol implementation in OpenSSL did
not properly implement the Bleichenbacher protection for export cipher
suites. An attacker could use a SSLv2 server using OpenSSL as a
Bleichenbacher oracle. (CVE-2016-0704)

Note: The CVE-2016-0703 and CVE-2016-0704 issues could allow for more
efficient exploitation of the CVE-2016-0800 issue via the DROWN attack.

A denial of service flaw was found in the way OpenSSL handled SSLv2
handshake messages. A remote attacker could use this flaw to cause a
TLS/SSL server using OpenSSL to exit on a failed assertion if it had both
the SSLv2 protocol and EXPORT-grade cipher suites enabled. (CVE-2015-0293)

A flaw was found in the way malicious SSLv2 clients could negotiate SSLv2
ciphers that have been disabled on the server. This could result in weak
SSLv2 ciphers being used for SSLv2 connections, making them vulnerable to
man-in-the-middle attacks. (CVE-2015-3197)

Red Hat would like to thank the OpenSSL project for reporting these issues.
Upstream acknowledges Nimrod Aviram and Sebastian Schinzel as the original
reporters of CVE-2016-0800 and CVE-2015-3197 David Adrian (University of
Michigan) and J. Alex Halderman (University of Michigan) as the original
reporters of CVE-2016-0703 and CVE-2016-0704 and Sean Burford (Google) and
Emilia Kasper (OpenSSL development team) as the original r ...

Description truncated, please see the referenced URL(s) for more information.

Affected Software/OS:
openssl098e on Red Hat Enterprise Linux Desktop (v. 6),
Red Hat Enterprise Linux Server (v. 6),
Red Hat Enterprise Linux Server (v. 7),
Red Hat Enterprise Linux Workstation (v. 6)

Solution:
Please Install the Updated Packages.

CVSS Score:
5.0

CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2015-0293
http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html
BugTraq ID: 73232
http://www.securityfocus.com/bid/73232
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152844.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152733.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152734.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157177.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156823.html
FreeBSD Security Advisory: FreeBSD-SA-16:12
https://www.freebsd.org/security/advisories/FreeBSD-SA-15%3A06.openssl.asc
https://security.gentoo.org/glsa/201503-11
HPdes Security Advisory: HPSBMU03380
http://marc.info/?l=bugtraq&m=143748090628601&w=2
HPdes Security Advisory: HPSBMU03397
http://marc.info/?l=bugtraq&m=144050297101809&w=2
HPdes Security Advisory: HPSBMU03409
http://marc.info/?l=bugtraq&m=144050155601375&w=2
HPdes Security Advisory: HPSBUX03334
http://marc.info/?l=bugtraq&m=143213830203296&w=2
HPdes Security Advisory: SSRT102000
http://www.mandriva.com/security/advisories?name=MDVSA-2015:062
http://www.mandriva.com/security/advisories?name=MDVSA-2015:063
RedHat Security Advisories: RHSA-2015:0715
http://rhn.redhat.com/errata/RHSA-2015-0715.html
RedHat Security Advisories: RHSA-2015:0716
http://rhn.redhat.com/errata/RHSA-2015-0716.html
RedHat Security Advisories: RHSA-2015:0752
http://rhn.redhat.com/errata/RHSA-2015-0752.html
RedHat Security Advisories: RHSA-2015:0800
http://rhn.redhat.com/errata/RHSA-2015-0800.html
http://www.securitytracker.com/id/1031929
SuSE Security Announcement: SUSE-SU-2015:0541 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00022.html
SuSE Security Announcement: SUSE-SU-2015:0578 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html
SuSE Security Announcement: SUSE-SU-2016:0617 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00001.html
SuSE Security Announcement: SUSE-SU-2016:0620 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00002.html
SuSE Security Announcement: SUSE-SU-2016:0621 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00003.html
SuSE Security Announcement: SUSE-SU-2016:0624 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00004.html
SuSE Security Announcement: SUSE-SU-2016:0631 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00007.html
SuSE Security Announcement: SUSE-SU-2016:0641 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00012.html
SuSE Security Announcement: SUSE-SU-2016:1057 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00038.html
SuSE Security Announcement: openSUSE-SU-2015:0554 (Google Search)
http://lists.opensuse.org/opensuse-updates/2015-03/msg00062.html
SuSE Security Announcement: openSUSE-SU-2016:0628 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00006.html
SuSE Security Announcement: openSUSE-SU-2016:0637 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html
SuSE Security Announcement: openSUSE-SU-2016:0638 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00010.html
SuSE Security Announcement: openSUSE-SU-2016:0640 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html
SuSE Security Announcement: openSUSE-SU-2016:0720 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00025.html
http://www.ubuntu.com/usn/USN-2537-1
Common Vulnerability Exposure (CVE) ID: CVE-2015-3197
BugTraq ID: 82237
http://www.securityfocus.com/bid/82237
BugTraq ID: 91787
http://www.securityfocus.com/bid/91787
CERT/CC vulnerability note: VU#257823
https://www.kb.cert.org/vuls/id/257823
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176373.html
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:11.openssl.asc
https://security.gentoo.org/glsa/201601-05
http://www.securitytracker.com/id/1034849
SuSE Security Announcement: SUSE-SU-2016:0678 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00017.html
SuSE Security Announcement: openSUSE-SU-2016:1239 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html
SuSE Security Announcement: openSUSE-SU-2016:1241 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html
Common Vulnerability Exposure (CVE) ID: CVE-2016-0703
BugTraq ID: 83743
http://www.securityfocus.com/bid/83743
Cisco Security Advisory: 20160302 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2016
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-openssl
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:12.openssl.asc
https://security.gentoo.org/glsa/201603-15
https://drownattack.com
http://www.securitytracker.com/id/1035133
Common Vulnerability Exposure (CVE) ID: CVE-2016-0704
BugTraq ID: 83764
http://www.securityfocus.com/bid/83764
Common Vulnerability Exposure (CVE) ID: CVE-2016-0800
BugTraq ID: 83733
http://www.securityfocus.com/bid/83733
CERT/CC vulnerability note: VU#583776
https://www.kb.cert.org/vuls/id/583776
HPdes Security Advisory: HPSBGN03569
http://marc.info/?l=bugtraq&m=145983526810210&w=2
HPdes Security Advisory: HPSBMU03573
http://marc.info/?l=bugtraq&m=146133665209436&w=2
HPdes Security Advisory: HPSBMU03575
http://marc.info/?l=bugtraq&m=146108058503441&w=2
https://ics-cert.us-cert.gov/advisories/ICSA-16-103-03
RedHat Security Advisories: RHSA-2016:1519
http://rhn.redhat.com/errata/RHSA-2016-1519.html
SuSE Security Announcement: openSUSE-SU-2016:0627 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00005.html
CopyrightCopyright (C) 2016 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2024 E-Soft Inc. All rights reserved.