Test ID:	1.3.6.1.4.1.25623.1.0.881239
Category:	CentOS Local Security Checks
Title:	CentOS Update for openssl CESA-2012:0086 centos4
Summary:	The remote host is missing an update for the 'openssl'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'openssl' package(s) announced via the referenced advisory. Vulnerability Insight: OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library. An information leak flaw was found in the SSL 3.0 protocol implementation in OpenSSL. Incorrect initialization of SSL record padding bytes could cause an SSL client or server to send a limited amount of possibly sensitive data to its SSL peer via the encrypted connection. (CVE-2011-4576) It was discovered that OpenSSL did not limit the number of TLS/SSL handshake restarts required to support Server Gated Cryptography. A remote attacker could use this flaw to make a TLS/SSL server using OpenSSL consume an excessive amount of CPU by continuously restarting the handshake. (CVE-2011-4619) All OpenSSL users should upgrade to these updated packages, which contain backported patches to resolve these issues. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. Affected Software/OS: openssl on CentOS 4 Solution: Please install the updated packages. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-4576 48528 http://secunia.com/advisories/48528 55069 http://secunia.com/advisories/55069 57353 http://secunia.com/advisories/57353 APPLE-SA-2013-06-04-1 http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html DSA-2390 http://www.debian.org/security/2012/dsa-2390 FEDORA-2012-18035 http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html HPSBMU02776 http://marc.info/?l=bugtraq&m=133951357207000&w=2 HPSBMU02786 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 HPSBOV02793 http://marc.info/?l=bugtraq&m=134039053214295&w=2 HPSBUX02734 http://marc.info/?l=bugtraq&m=132750648501816&w=2 MDVSA-2012:006 http://www.mandriva.com/security/advisories?name=MDVSA-2012:006 MDVSA-2012:007 http://www.mandriva.com/security/advisories?name=MDVSA-2012:007 RHSA-2012:1306 http://rhn.redhat.com/errata/RHSA-2012-1306.html RHSA-2012:1307 http://rhn.redhat.com/errata/RHSA-2012-1307.html RHSA-2012:1308 http://rhn.redhat.com/errata/RHSA-2012-1308.html SSRT100729 SSRT100852 SSRT100877 SSRT100891 SUSE-SU-2012:0084 http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00018.html VU#737740 http://www.kb.cert.org/vuls/id/737740 http://aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc http://support.apple.com/kb/HT5784 http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564 http://www.openssl.org/news/secadv_20120104.txt openSUSE-SU-2012:0083 http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00017.html Common Vulnerability Exposure (CVE) ID: CVE-2011-4619 HPSBUX02782 http://marc.info/?l=bugtraq&m=133728068926468&w=2 SSRT100844
Copyright	Copyright (C) 2012 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.