Test ID:	1.3.6.1.4.1.25623.1.0.881134
Category:	CentOS Local Security Checks
Title:	CentOS Update for openssl CESA-2012:0060 centos5
Summary:	The remote host is missing an update for the 'openssl'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'openssl' package(s) announced via the referenced advisory. Vulnerability Insight: OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library. It was discovered that the Datagram Transport Layer Security (DTLS) protocol implementation in OpenSSL leaked timing information when performing certain operations. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a DTLS server as a padding oracle. (CVE-2011-4108) A double free flaw was discovered in the policy checking code in OpenSSL. A remote attacker could use this flaw to crash an application that uses OpenSSL by providing an X.509 certificate that has specially-crafted policy extension data. (CVE-2011-4109) An information leak flaw was found in the SSL 3.0 protocol implementation in OpenSSL. Incorrect initialization of SSL record padding bytes could cause an SSL client or server to send a limited amount of possibly sensitive data to its SSL peer via the encrypted connection. (CVE-2011-4576) It was discovered that OpenSSL did not limit the number of TLS/SSL handshake restarts required to support Server Gated Cryptography. A remote attacker could use this flaw to make a TLS/SSL server using OpenSSL consume an excessive amount of CPU by continuously restarting the handshake. (CVE-2011-4619) All OpenSSL users should upgrade to these updated packages, which contain backported patches to resolve these issues. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. Affected Software/OS: openssl on CentOS 5 Solution: Please install the updated packages. CVSS Score: 9.3 CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-4108 48528 http://secunia.com/advisories/48528 57260 http://secunia.com/advisories/57260 57353 http://secunia.com/advisories/57353 APPLE-SA-2013-06-04-1 http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html DSA-2390 http://www.debian.org/security/2012/dsa-2390 FEDORA-2012-18035 http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html HPSBMU02776 http://marc.info/?l=bugtraq&m=133951357207000&w=2 HPSBMU02786 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 HPSBOV02793 http://marc.info/?l=bugtraq&m=134039053214295&w=2 HPSBUX02734 http://marc.info/?l=bugtraq&m=132750648501816&w=2 MDVSA-2012:006 http://www.mandriva.com/security/advisories?name=MDVSA-2012:006 MDVSA-2012:007 http://www.mandriva.com/security/advisories?name=MDVSA-2012:007 RHSA-2012:1306 http://rhn.redhat.com/errata/RHSA-2012-1306.html RHSA-2012:1307 http://rhn.redhat.com/errata/RHSA-2012-1307.html RHSA-2012:1308 http://rhn.redhat.com/errata/RHSA-2012-1308.html SSRT100729 SSRT100852 SSRT100877 SSRT100891 SUSE-SU-2012:0084 http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00018.html SUSE-SU-2014:0320 http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html VU#737740 http://www.kb.cert.org/vuls/id/737740 http://aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc http://support.apple.com/kb/HT5784 http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564 http://www.isg.rhul.ac.uk/~kp/dtls.pdf http://www.openssl.org/news/secadv_20120104.txt https://security.paloaltonetworks.com/CVE-2011-4108 openSUSE-SU-2012:0083 http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00017.html Common Vulnerability Exposure (CVE) ID: CVE-2011-4109 openssl-policy-checks-dos(72129) https://exchange.xforce.ibmcloud.com/vulnerabilities/72129 Common Vulnerability Exposure (CVE) ID: CVE-2011-4576 55069 http://secunia.com/advisories/55069 Common Vulnerability Exposure (CVE) ID: CVE-2011-4619 HPSBUX02782 http://marc.info/?l=bugtraq&m=133728068926468&w=2 SSRT100844
Copyright	Copyright (C) 2012 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.