Test ID:	1.3.6.1.4.1.25623.1.0.880713
Category:	CentOS Local Security Checks
Title:	CentOS Update for neon CESA-2009:1452 centos5 i386
Summary:	The remote host is missing an update for the 'neon'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'neon' package(s) announced via the referenced advisory. Vulnerability Insight: neon is an HTTP and WebDAV client library, with a C interface. It provides a high-level interface to HTTP and WebDAV methods along with a low-level interface for HTTP request handling. neon supports persistent connections, proxy servers, basic, digest and Kerberos authentication, and has complete SSL support. It was discovered that neon is affected by the previously published 'null prefix attack', caused by incorrect handling of NULL characters in X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a trusted Certificate Authority, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse an application using the neon library into accepting it by mistake. (CVE-2009-2474) A denial of service flaw was found in the neon Extensible Markup Language (XML) parser. A remote attacker (malicious DAV server) could provide a specially-crafted XML document that would cause excessive memory and CPU consumption if an application using the neon XML parser was tricked into processing it. (CVE-2009-2473) All neon users should upgrade to these updated packages, which contain backported patches to correct these issues. Applications using the neon HTTP and WebDAV client library, such as cadaver, must be restarted for this update to take effect. Affected Software/OS: neon on CentOS 5 Solution: Please install the updated packages. CVSS Score: 5.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-2473 36371 http://secunia.com/advisories/36371 ADV-2009-2341 http://www.vupen.com/english/advisories/2009/2341 APPLE-SA-2010-11-10-1 http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html FEDORA-2009-8794 https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00924.html FEDORA-2009-8815 https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00945.html MDVSA-2009:221 http://www.mandriva.com/security/advisories?name=MDVSA-2009:221 RHSA-2013:0131 http://rhn.redhat.com/errata/RHSA-2013-0131.html SUSE-SR:2009:018 http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html [neon] 20090818 CVE-2009-2473: fix for "billion laughs" attack against expat http://lists.manyfish.co.uk/pipermail/neon/2009-August/001045.html [neon] 20090818 neon: release 0.28.6 (SECURITY) http://lists.manyfish.co.uk/pipermail/neon/2009-August/001044.html http://support.apple.com/kb/HT4435 neon-xml-dos(52633) https://exchange.xforce.ibmcloud.com/vulnerabilities/52633 oval:org.mitre.oval:def:9461 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9461 Common Vulnerability Exposure (CVE) ID: CVE-2009-2474 36079 http://www.securityfocus.com/bid/36079 36799 http://secunia.com/advisories/36799 USN-835-1 http://www.ubuntu.com/usn/usn-835-1 [neon] 20090818 CVE-2009-2474: fix handling of NUL in SSL cert subject names http://lists.manyfish.co.uk/pipermail/neon/2009-August/001046.html oval:org.mitre.oval:def:11721 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11721
Copyright	Copyright (C) 2011 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.