7.5 - DSA-1935

Executive Summary

Summary
Title	New gnutls23/gnutls26 packages fix SSL certificate verification weakness

Informations
Name	DSA-1935	First vendor Publication	2009-11-17
Vendor	Debian	Last vendor Modification	2009-11-17
Severity (Vendor)	N/A	Revision	1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score	7.5	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Dan Kaminsky and Moxie Marlinspike discovered that gnutls, an implementation of the TLS/SSL protocol, does not properly handle a '\0' character in a domain name in the subject's Common Name or Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. (CVE-2009-2730)

In addition, with this update, certificates with MD2 hash signatures are no longer accepted since they're no longer considered cryptograhically secure. It only affects the oldstable distribution (etch).(CVE-2009-2409)

For the oldstable distribution (etch), these problems have been fixed in version 1.4.4-3+etch5 for gnutls13.

For the stable distribution (lenny), these problems have been fixed in version 2.4.2-6+lenny2 for gnutls26.

For the testing distribution (squeeze), and the unstable distribution (sid), these problems have been fixed in version 2.8.3-1 for gnutls26.

We recommend that you upgrade your gnutls13/gnutls26 packages.

Original Source

Url : http://www.debian.org/security/2009/dsa-1935

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-310	Cryptographic Issues

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10763

Oval ID:	oval:org.mitre.oval:def:10763
Title:	The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.
Description:	The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-2409	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section openssl-perl is earlier than 0:0.9.7a-33.26 AND seamonkey-nspr is earlier than 0:1.0.9-0.45.el3 AND seamonkey-js-debugger is earlier than 0:1.0.9-0.45.el3 AND seamonkey-nss-devel is earlier than 0:1.0.9-0.45.el3 AND seamonkey is earlier than 0:1.0.9-0.45.el3 AND seamonkey-nspr-devel is earlier than 0:1.0.9-0.45.el3 AND openssl-devel is earlier than 0:0.9.7a-33.26 AND openssl is earlier than 0:0.9.7a-33.26 AND seamonkey-mail is earlier than 0:1.0.9-0.45.el3 AND seamonkey-chat is earlier than 0:1.0.9-0.45.el3 AND seamonkey-nss is earlier than 0:1.0.9-0.45.el3 AND seamonkey-devel is earlier than 0:1.0.9-0.45.el3 AND seamonkey-dom-inspector is earlier than 0:1.0.9-0.45.el3 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section openssl-perl is earlier than 0:0.9.7a-43.17.el4_8.5 AND openssl-devel is earlier than 0:0.9.7a-43.17.el4_8.5 AND openssl is earlier than 0:0.9.7a-43.17.el4_8.5 AND nss-devel is earlier than 0:3.12.3.99.3-1.el4_8.2 AND nspr is earlier than 0:4.7.4-1.el4_8.1 AND nss is earlier than 0:3.12.3.99.3-1.el4_8.2 AND nss-tools is earlier than 0:3.12.3.99.3-1.el4_8.2 AND nspr-devel is earlier than 0:4.7.4-1.el4_8.1 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section openssl-perl is earlier than 0:0.9.8e-12.el5_4.1 AND nss-pkcs11-devel is earlier than 0:3.12.3.99.3-1.el5_3.2 AND nspr-devel is earlier than 0:4.7.4-1.el5_3.1 AND gnutls is earlier than 0:1.4.1-3.el5_4.8 AND openssl is earlier than 0:0.9.8e-12.el5_4.1 AND java-1.6.0-openjdk-demo is earlier than 1:1.6.0.0-1.7.b09.el5 AND nspr is earlier than 0:4.7.4-1.el5_3.1 AND nss is earlier than 0:3.12.3.99.3-1.el5_3.2 AND java-1.6.0-openjdk is earlier than 1:1.6.0.0-1.7.b09.el5 AND java-1.6.0-openjdk-devel is earlier than 1:1.6.0.0-1.7.b09.el5 AND openssl-devel is earlier than 0:0.9.8e-12.el5_4.1 AND gnutls-devel is earlier than 0:1.4.1-3.el5_4.8 AND nss-devel is earlier than 0:3.12.3.99.3-1.el5_3.2 AND java-1.6.0-openjdk-src is earlier than 1:1.6.0.0-1.7.b09.el5 AND java-1.6.0-openjdk-javadoc is earlier than 1:1.6.0.0-1.7.b09.el5 AND nss-tools is earlier than 0:3.12.3.99.3-1.el5_3.2 AND gnutls-utils is earlier than 0:1.4.1-3.el5_4.8

Definition Id: oval:org.mitre.oval:def:10778

Oval ID:	oval:org.mitre.oval:def:10778
Title:	libgnutls in GnuTLS before 2.8.2 does not properly handle a '\0' character in a domain name in the subject's (1) Common Name (CN) or (2) Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
Description:	libgnutls in GnuTLS before 2.8.2 does not properly handle a '\0' character in a domain name in the subject's (1) Common Name (CN) or (2) Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-2730	Version:	5
Platform(s):	Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section gnutls is earlier than 0:1.0.20-4.el4_8.3 AND gnutls-devel is earlier than 0:1.0.20-4.el4_8.3 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section gnutls is earlier than 0:1.4.1-3.el5_3.5 AND gnutls-devel is earlier than 0:1.4.1-3.el5_3.5 AND gnutls-utils is earlier than 0:1.4.1-3.el5_3.5

Definition Id: oval:org.mitre.oval:def:13409

Oval ID:	oval:org.mitre.oval:def:13409
Title:	USN-830-1 -- openssl vulnerability
Description:	Dan Kaminsky discovered OpenSSL would still accept certificates with MD2 hash signatures. As a result, an attacker could potentially create a malicious trusted certificate to impersonate another site. This update handles this issue by completely disabling MD2 for certificate validation.
Family:	unix	Class:	patch
Reference(s):	USN-830-1 CVE-2009-2409	Version:	5
Platform(s):	Ubuntu 8.04 Ubuntu 9.04 Ubuntu 6.06 Ubuntu 8.10	Product(s):	openssl
Definition Synopsis:
Release section Ubuntu 8.04 is installed AND Architecture section Architecture independent section Installed architecture is all AND openssl-doc DPKG is earlier than 0.9.8g-4ubuntu3.8 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section libcrypto0.9.8-udeb DPKG is earlier than 0.9.8g-4ubuntu3.8 AND libssl0.9.8-dbg DPKG is earlier than 0.9.8g-4ubuntu3.8 AND libssl0.9.8 DPKG is earlier than 0.9.8g-4ubuntu3.8 AND libssl-dev DPKG is earlier than 0.9.8g-4ubuntu3.8 AND openssl DPKG is earlier than 0.9.8g-4ubuntu3.8 OR Release section Ubuntu 9.04 is installed AND Architecture section Architecture independent section Installed architecture is all AND openssl-doc DPKG is earlier than 0.9.8g-15ubuntu3.3 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section libcrypto0.9.8-udeb DPKG is earlier than 0.9.8g-15ubuntu3.3 AND libssl0.9.8-dbg DPKG is earlier than 0.9.8g-15ubuntu3.3 AND libssl0.9.8 DPKG is earlier than 0.9.8g-15ubuntu3.3 AND libssl-dev DPKG is earlier than 0.9.8g-15ubuntu3.3 AND openssl DPKG is earlier than 0.9.8g-15ubuntu3.3 OR Release section Ubuntu 6.06 is installed AND Supported architectures section Installed architecture is sparc AND Installed architecture is i386 AND Installed architecture is amd64 AND Installed architecture is powerpc AND Packages section libssl0.9.8 DPKG is earlier than 0.9.8a-7ubuntu0.10 AND libcrypto0.9.8-udeb DPKG is earlier than 0.9.8a-7ubuntu0.10 AND libssl0.9.8-dbg DPKG is earlier than 0.9.8a-7ubuntu0.10 AND openssl DPKG is earlier than 0.9.8a-7ubuntu0.10 AND libssl-dev DPKG is earlier than 0.9.8a-7ubuntu0.10 OR Release section Ubuntu 8.10 is installed AND Architecture section Architecture independent section Installed architecture is all AND openssl-doc DPKG is earlier than 0.9.8g-10.1ubuntu2.5 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section libcrypto0.9.8-udeb DPKG is earlier than 0.9.8g-10.1ubuntu2.5 AND libssl0.9.8-dbg DPKG is earlier than 0.9.8g-10.1ubuntu2.5 AND libssl0.9.8 DPKG is earlier than 0.9.8g-10.1ubuntu2.5 AND libssl-dev DPKG is earlier than 0.9.8g-10.1ubuntu2.5 AND openssl DPKG is earlier than 0.9.8g-10.1ubuntu2.5

Definition Id: oval:org.mitre.oval:def:13737

Oval ID:	oval:org.mitre.oval:def:13737
Title:	DSA-1874-1 nss -- several
Description:	Several vulnerabilities have been discovered in the Network Security Service libraries. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-2404 Moxie Marlinspike discovered that a buffer overflow in the regular expression parser could lead to the execution of arbitrary code. CVE-2009-2408 Dan Kaminsky discovered that NULL characters in certificate names could lead to man-in-the-middle attacks by tricking the user into accepting a rogue certificate. CVE-2009-2409 Certificates with MD2 hash signatures are no longer accepted since they’re no longer considered cryptographically secure. The old stable distribution doesn’t contain nss. For the stable distribution, these problems have been fixed in version 3.12.3.1-0lenny1. For the unstable distribution, these problems have been fixed in version 3.12.3.1-1. We recommend that you upgrade your nss packages.
Family:	unix	Class:	patch
Reference(s):	DSA-1874-1 CVE-2009-2404 CVE-2009-2408 CVE-2009-2409	Version:	5
Platform(s):	Debian GNU/Linux 5.0	Product(s):	nss
Definition Synopsis:
Debian GNU/Linux 5.0 is installed Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa Packages section libnss3-dev DPKG is earlier than 3.12.3.1-0lenny1 AND libnss3-1d-dbg DPKG is earlier than 3.12.3.1-0lenny1 AND libnss3-tools DPKG is earlier than 3.12.3.1-0lenny1 AND libnss3-1d DPKG is earlier than 3.12.3.1-0lenny1

Definition Id: oval:org.mitre.oval:def:13780

Oval ID:	oval:org.mitre.oval:def:13780
Title:	USN-810-2 -- nspr update
Description:	USN-810-1 fixed vulnerabilities in NSS. This update provides the NSPR needed to use the new NSS. Original advisory details: Moxie Marlinspike discovered that NSS did not properly handle regular expressions in certificate names. A remote attacker could create a specially crafted certificate to cause a denial of service or execute arbitrary code as the user invoking the program. Moxie Marlinspike and Dan Kaminsky independently discovered that NSS did not properly handle certificates with NULL characters in the certificate name. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. Dan Kaminsky discovered NSS would still accept certificates with MD2 hash signatures. As a result, an attacker could potentially create a malicious trusted certificate to impersonate another site
Family:	unix	Class:	patch
Reference(s):	USN-810-2 CVE-2009-2404 CVE-2009-2408 CVE-2009-2409	Version:	5
Platform(s):	Ubuntu 8.10 Ubuntu 8.04 Ubuntu 9.04	Product(s):	nspr
Definition Synopsis:
Release section Ubuntu 8.10 is installed AND Supported architectures section Installed architecture is sparc AND Installed architecture is i386 AND Installed architecture is amd64 AND Installed architecture is lpia AND Installed architecture is powerpc AND Packages section libnspr4-dev DPKG is earlier than 4.7.5-0ubuntu0.8.10.1 AND libnspr4-0d-dbg DPKG is earlier than 4.7.5-0ubuntu0.8.10.1 AND libnspr4-0d DPKG is earlier than 4.7.5-0ubuntu0.8.10.1 OR Release section Ubuntu 8.04 is installed AND Supported architectures section Installed architecture is sparc AND Installed architecture is i386 AND Installed architecture is amd64 AND Installed architecture is lpia AND Installed architecture is powerpc AND Packages section libnspr4-dev DPKG is earlier than 4.7.5-0ubuntu0.8.04.1 AND libnspr4-0d-dbg DPKG is earlier than 4.7.5-0ubuntu0.8.04.1 AND libnspr4-0d DPKG is earlier than 4.7.5-0ubuntu0.8.04.1 OR Release section Ubuntu 9.04 is installed AND Supported architectures section Installed architecture is sparc AND Installed architecture is i386 AND Installed architecture is amd64 AND Installed architecture is lpia AND Installed architecture is powerpc AND Packages section libnspr4-dev DPKG is earlier than 4.7.5-0ubuntu0.9.04.1 AND libnspr4-0d-dbg DPKG is earlier than 4.7.5-0ubuntu0.9.04.1 AND libnspr4-0d DPKG is earlier than 4.7.5-0ubuntu0.9.04.1

Definition Id: oval:org.mitre.oval:def:13850

Oval ID:	oval:org.mitre.oval:def:13850
Title:	USN-810-1 -- nss vulnerabilities
Description:	Moxie Marlinspike discovered that NSS did not properly handle regular expressions in certificate names. A remote attacker could create a specially crafted certificate to cause a denial of service or execute arbitrary code as the user invoking the program. Moxie Marlinspike and Dan Kaminsky independently discovered that NSS did not properly handle certificates with NULL characters in the certificate name. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. Dan Kaminsky discovered NSS would still accept certificates with MD2 hash signatures. As a result, an attacker could potentially create a malicious trusted certificate to impersonate another site
Family:	unix	Class:	patch
Reference(s):	USN-810-1 CVE-2009-2404 CVE-2009-2408 CVE-2009-2409	Version:	5
Platform(s):	Ubuntu 8.10 Ubuntu 8.04 Ubuntu 9.04	Product(s):	nss
Definition Synopsis:
Release section Ubuntu 8.10 is installed AND Supported architectures section Installed architecture is sparc AND Installed architecture is i386 AND Installed architecture is amd64 AND Installed architecture is lpia AND Installed architecture is powerpc AND Packages section libnss3-dev DPKG is earlier than 3.12.3.1-0ubuntu0.8.10.1 AND libnss3-1d-dbg DPKG is earlier than 3.12.3.1-0ubuntu0.8.10.1 AND libnss3-0d DPKG is earlier than 3.12.3.1-0ubuntu0.8.10.1 AND libnss3-1d DPKG is earlier than 3.12.3.1-0ubuntu0.8.10.1 AND libnss3-tools DPKG is earlier than 3.12.3.1-0ubuntu0.8.10.1 OR Release section Ubuntu 8.04 is installed AND Supported architectures section Installed architecture is sparc AND Installed architecture is i386 AND Installed architecture is amd64 AND Installed architecture is lpia AND Installed architecture is powerpc AND Packages section libnss3-dev DPKG is earlier than 3.12.3.1-0ubuntu0.8.04.1 AND libnss3-1d-dbg DPKG is earlier than 3.12.3.1-0ubuntu0.8.04.1 AND libnss3-0d DPKG is earlier than 3.12.3.1-0ubuntu0.8.04.1 AND libnss3-1d DPKG is earlier than 3.12.3.1-0ubuntu0.8.04.1 AND libnss3-tools DPKG is earlier than 3.12.3.1-0ubuntu0.8.04.1 OR Release section Ubuntu 9.04 is installed AND Supported architectures section Installed architecture is sparc AND Installed architecture is i386 AND Installed architecture is amd64 AND Installed architecture is lpia AND Installed architecture is powerpc AND Packages section libnss3-dev DPKG is earlier than 3.12.3.1-0ubuntu0.9.04.1 AND libnss3-1d-dbg DPKG is earlier than 3.12.3.1-0ubuntu0.9.04.1 AND libnss3-0d DPKG is earlier than 3.12.3.1-0ubuntu0.9.04.1 AND libnss3-1d DPKG is earlier than 3.12.3.1-0ubuntu0.9.04.1 AND libnss3-tools DPKG is earlier than 3.12.3.1-0ubuntu0.9.04.1

Definition Id: oval:org.mitre.oval:def:20167

Oval ID:	oval:org.mitre.oval:def:20167
Title:	DSA-1935-1 gnutls13 gnutls26 - SSL certificate
Description:	Dan Kaminsky and Moxie Marlinspike discovered that gnutls, an implementation of the TLS/SSL protocol, does not properly handle a '\0' character in a domain name in the subject's Common Name or Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. (<a href="http://security-tracker.debian.org/tracker/CVE-2009-2730">CVE-2009-2730</a>)
Family:	unix	Class:	patch
Reference(s):	DSA-1935-1 CVE-2009-2409 CVE-2009-2730	Version:	5
Platform(s):	Debian GNU/Linux 4.0 Debian GNU/Linux 5.0	Product(s):	gnutls13 gnutls26
Definition Synopsis:
Release section Debian GNU/Linux 4.0 is installed. AND gnutls13 DPKG is earlier than 0:1.4.4-3+etch5 AND Release section Debian GNU/Linux 5.0 is installed AND gnutls26 DPKG is earlier than 0:2.4.2-6+lenny2

Definition Id: oval:org.mitre.oval:def:22412

Oval ID:	oval:org.mitre.oval:def:22412
Title:	ELSA-2009:1186: nspr and nss security, bug fix, and enhancement update (Critical)
Description:	The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.
Family:	unix	Class:	patch
Reference(s):	ELSA-2009:1186-01 CVE-2009-2404 CVE-2009-2408 CVE-2009-2409	Version:	17
Platform(s):	Oracle Linux 5	Product(s):	nspr nss
Definition Synopsis:
Oracle Linux 5.x rpm test nspr-devel is earlier than 0:4.7.4-1.el5_3.1 AND nspr is earlier than 0:4.7.4-1.el5_3.1 AND nss is earlier than 0:3.12.3.99.3-1.el5_3.2 AND nss-tools is earlier than 0:3.12.3.99.3-1.el5_3.2 AND nss-pkcs11-devel is earlier than 0:3.12.3.99.3-1.el5_3.2 AND nss-devel is earlier than 0:3.12.3.99.3-1.el5_3.2

Definition Id: oval:org.mitre.oval:def:22748

Oval ID:	oval:org.mitre.oval:def:22748
Title:	ELSA-2009:1232: gnutls security update (Moderate)
Description:	libgnutls in GnuTLS before 2.8.2 does not properly handle a '\0' character in a domain name in the subject's (1) Common Name (CN) or (2) Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
Family:	unix	Class:	patch
Reference(s):	ELSA-2009:1232-01 CVE-2009-2730	Version:	6
Platform(s):	Oracle Linux 5	Product(s):	gnutls
Definition Synopsis:
Oracle Linux 5.x rpm test gnutls-devel is earlier than 0:1.4.1-3.el5_3.5 AND gnutls-utils is earlier than 0:1.4.1-3.el5_3.5 AND gnutls is earlier than 0:1.4.1-3.el5_3.5

Definition Id: oval:org.mitre.oval:def:25180

Oval ID:	oval:org.mitre.oval:def:25180
Title:	Vulnerability in OpenSSL 0.9.8 through 0.9.8k, might allow remote attackers to spoof certificates
Description:	The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2009-2409	Version:	4
Platform(s):	Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows 7 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2	Product(s):	OpenSSL
Definition Synopsis:
Check vulnerable OpenSSL Check vulnerable versions of OpenSSL Check if the version of OpenSSL 0.9.8 before 0.9.8k AND OpenSSL is installed OR Check vulnerable OpenSSL (32_bit) Check vulnerable versions of OpenSSL (32_bit) Check if the version of OpenSSL 0.9.8 before 0.9.8k (32_bit) AND OpenSSL (32_bit) is installed AND Check if the version of ssleay32.dll 0.9.8 before 0.9.8k ProgramFilesDir AND Check if the version of ssleay32.dll 0.9.8 before 0.9.8k ProgramFilesDir x86 AND Check if the version of ssleay32.dll 0.9.8 before 0.9.8k Sytem32 and SysWOW64

Definition Id: oval:org.mitre.oval:def:28253

Oval ID:	oval:org.mitre.oval:def:28253
Title:	DEPRECATED: ELSA-2010-0054 -- openssl security update (moderate)
Description:	[0.9.8e-12.1] - fix CVE-2009-2409 - drop MD2 algorithm from EVP tables (#510197) - fix CVE-2009-4355 - do not leak memory when CRYPTO_cleanup_all_ex_data() is called prematurely by application (#546707)
Family:	unix	Class:	patch
Reference(s):	ELSA-2010-0054 CVE-2009-4355 CVE-2009-2409	Version:	4
Platform(s):	Oracle Linux 5	Product(s):	openssl
Definition Synopsis:
Oracle Linux 5.x Packages match section openssl is earlier than 0:0.9.8e-12.el5_4.1 AND openssl-devel is earlier than 0:0.9.8e-12.el5_4.1 AND openssl-perl is earlier than 0:0.9.8e-12.el5_4.1

Definition Id: oval:org.mitre.oval:def:29071

Oval ID:	oval:org.mitre.oval:def:29071
Title:	USN-810-3 -- NSS regression
Description:	USN-810-1 fixed vulnerabilities in NSS. Jozsef Kadlecsik noticed that the new libraries on amd64 did not correctly set stack memory flags, and caused applications using NSS (e.g. Firefox) to have an executable stack. This reduced the effectiveness of some defensive security protections. This update fixes the problem.
Family:	unix	Class:	patch
Reference(s):	USN-810-3 CVE-2009-2404 CVE-2009-2408 CVE-2009-2409	Version:	3
Platform(s):	Ubuntu 9.04 Ubuntu 8.10 Ubuntu 8.04	Product(s):	nss
Definition Synopsis:
Ubuntu 9.04 release section Ubuntu 9.04 is installed AND libnss3-1d is earlier than 0:3.12.3.1-0ubuntu0.9.04.2 AND Ubuntu 8.10 release section Ubuntu 8.10 is installed AND libnss3-1d is earlier than 0:3.12.3.1-0ubuntu0.8.10.2 AND Ubuntu 8.04 release section Ubuntu 8.04 is installed AND libnss3-1d is earlier than 0:3.12.3.1-0ubuntu0.8.04.2

Definition Id: oval:org.mitre.oval:def:29169

Oval ID:	oval:org.mitre.oval:def:29169
Title:	RHSA-2009:1186 -- nspr and nss security, bug fix, and enhancement update (Critical)
Description:	Updated nspr and nss packages that fix security issues, bugs, and add an enhancement are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team.
Family:	unix	Class:	patch
Reference(s):	RHSA-2009:1186 CVE-2009-2404 CVE-2009-2408 CVE-2009-2409	Version:	3
Platform(s):	Red Hat Enterprise Linux 5	Product(s):	nspr nss
Definition Synopsis:
The operating system installed on the system is Red Hat Enterprise Linux 5 Packages match section nspr-devel is earlier than 0:4.7.4-1.el5_3.1 AND nss-devel is earlier than 0:3.12.3.99.3-1.el5_3.2 AND nss-pkcs11-devel is earlier than 0:3.12.3.99.3-1.el5_3.2 AND nspr is earlier than 0:4.7.4-1.el5_3.1 AND nss is earlier than 0:3.12.3.99.3-1.el5_3.2 AND nss-tools is earlier than 0:3.12.3.99.3-1.el5_3.2

Definition Id: oval:org.mitre.oval:def:29281

Oval ID:	oval:org.mitre.oval:def:29281
Title:	RHSA-2009:1232 -- gnutls security update (Moderate)
Description:	Updated gnutls packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS).
Family:	unix	Class:	patch
Reference(s):	RHSA-2009:1232 CVE-2009-2730	Version:	3
Platform(s):	Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 4	Product(s):	gnutls
Definition Synopsis:
Red Hat Enterprise Linux 5 release section The operating system installed on the system is Red Hat Enterprise Linux 5 Packages match section gnutls-devel is earlier than 0:1.4.1-3.el5_3.5 AND gnutls is earlier than 0:1.4.1-3.el5_3.5 AND gnutls-utils is earlier than 0:1.4.1-3.el5_3.5 AND Red Hat Enterprise Linux 4 release section The operating system installed on the system is Red Hat Enterprise Linux 4 Packages match section gnutls is earlier than 0:1.0.20-4.el4_8.3 AND gnutls-devel is earlier than 0:1.0.20-4.el4_8.3

Definition Id: oval:org.mitre.oval:def:6631

Oval ID:	oval:org.mitre.oval:def:6631
Title:	Network Security Services Library Supports Certificates With Weak MD2 Hash Signatures
Description:	The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-2409	Version:	5
Platform(s):	VMWare ESX Server 4.0	Product(s):
Definition Synopsis:
VMware ESX Server 4.0 is installed AND Patch ESX400-201005401-SG is not installed

Definition Id: oval:org.mitre.oval:def:7155

Oval ID:	oval:org.mitre.oval:def:7155
Title:	VMware ESX, Service Console update for OpenSSL, GnuTLS, NSS and NSPR.
Description:	The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-2409	Version:	5
Platform(s):	VMWare ESX Server 4.0	Product(s):
Definition Synopsis:
VMware ESX Server 4.0 is installed AND Patch ESX400-201009401-SG is not installed.

Definition Id: oval:org.mitre.oval:def:8111

Oval ID:	oval:org.mitre.oval:def:8111
Title:	DSA-1874 nss -- several vulnerabilities
Description:	Several vulnerabilities have been discovered in the Network Security Service libraries. The Common Vulnerabilities and Exposures project identifies the following problems: Moxie Marlinspike discovered that a buffer overflow in the regular expression parser could lead to the execution of arbitrary code. Dan Kaminsky discovered that NULL characters in certificate names could lead to man-in-the-middle attacks by tricking the user into accepting a rogue certificate. Certificates with MD2 hash signatures are no longer accepted since they're no longer considered cryptographically secure. The old stable distribution (etch) doesn't contain nss.
Family:	unix	Class:	patch
Reference(s):	DSA-1874 CVE-2009-2404 CVE-2009-2408 CVE-2009-2409	Version:	3
Platform(s):	Debian GNU/Linux 5.0	Product(s):	nss
Definition Synopsis:
Debian GNU/Linux 5.0 is installed Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa Packages section libnss3-dev is earlier than 3.12.3.1-0lenny1 AND libnss3-1d-dbg is earlier than 3.12.3.1-0lenny1 AND libnss3-tools is earlier than 3.12.3.1-0lenny1 AND libnss3-1d is earlier than 3.12.3.1-0lenny1

Definition Id: oval:org.mitre.oval:def:8289

Oval ID:	oval:org.mitre.oval:def:8289
Title:	DSA-1935 gnutls13 gnutls26 -- several vulnerabilities
Description:	Dan Kaminsky and Moxie Marlinspike discovered that gnutls, an implementation of the TLS/SSL protocol, does not properly handle a "\0" character in a domain name in the subject's Common Name or Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. (CVE-2009-2730) In addition, with this update, certificates with MD2 hash signatures are no longer accepted since they're no longer considered cryptographically secure. It only affects the oldstable distribution (etch).(CVE-2009-2409)
Family:	unix	Class:	patch
Reference(s):	DSA-1935 CVE-2009-2409 CVE-2009-2730	Version:	3
Platform(s):	Debian GNU/Linux 5.0 Debian GNU/Linux 4.0	Product(s):	gnutls13 gnutls26
Definition Synopsis:
Release section Debian GNU/Linux 5.0 is installed AND Architecture section Architecture independent section Installed architecture is all AND gnutls-doc is earlier than 2.4.2-6+lenny2 OR Architecture dependent section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is mipsel AND Installed architecture is hppa AND Packages section libgnutls-dev is earlier than 2.4.2-6+lenny2 AND libgnutls26-dbg is earlier than 2.4.2-6+lenny2 AND libgnutls26 is earlier than 2.4.2-6+lenny2 AND gnutls-bin is earlier than 2.4.2-6+lenny2 AND guile-gnutls is earlier than 2.4.2-6+lenny2 OR Release section Debian GNU/Linux 4.0 is installed. AND Architecture section Architecture independent section Installed architecture is all AND gnutls-doc is earlier than 1.4.4-3+etch5 AND libgnutls13 is earlier than 1.4.4-3+etch5 AND gnutls-bin is earlier than 1.4.4-3+etch5 AND libgnutls-dev is earlier than 1.4.4-3+etch5 AND libgnutls13-dbg is earlier than 1.4.4-3+etch5

Definition Id: oval:org.mitre.oval:def:8409

Oval ID:	oval:org.mitre.oval:def:8409
Title:	VMware GnuTLS vulnerability
Description:	libgnutls in GnuTLS before 2.8.2 does not properly handle a '\0' character in a domain name in the subject's (1) Common Name (CN) or (2) Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-2730	Version:	4
Platform(s):	VMWare ESX Server 4.0	Product(s):
Definition Synopsis:
VMware ESX Server 4.0 is installed AND Patch ESX400-200911233-SG is not installed

Definition Id: oval:org.mitre.oval:def:8594

Oval ID:	oval:org.mitre.oval:def:8594
Title:	VMware Network Security Services (NSS) certificate spoofing vulnerability by using MD2 design flaw
Description:	The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-2409	Version:	4
Platform(s):	VMWare ESX Server 4.0	Product(s):
Definition Synopsis:
VMware ESX Server 4.0 is installed AND Patch ESX400-200912403-SG is not installed

CPE : Common Platform Enumeration

Type	Description	Count
Application	Gnu Gnutls cpe:2.3:a:gnu:gnutls:2.8.1:::::::* cpe:2.3:a:gnu:gnutls:2.8.0:::::::* cpe:2.3:a:gnu:gnutls:2.7.4:::::::* cpe:2.3:a:gnu:gnutls:2.7.3:::::::* cpe:2.3:a:gnu:gnutls:2.7.2:::::::* cpe:2.3:a:gnu:gnutls:2.7.1:::::::* cpe:2.3:a:gnu:gnutls:2.7.0:::::::* cpe:2.3:a:gnu:gnutls:2.6.6:::::::* cpe:2.3:a:gnu:gnutls:2.6.5:::::::* cpe:2.3:a:gnu:gnutls:2.6.4:::::::* cpe:2.3:a:gnu:gnutls:2.6.3:::::::* cpe:2.3:a:gnu:gnutls:2.6.2:::::::* cpe:2.3:a:gnu:gnutls:2.6.1:::::::* cpe:2.3:a:gnu:gnutls:2.6.0:::::::* cpe:2.3:a:gnu:gnutls:2.5.0:::::::* cpe:2.3:a:gnu:gnutls:2.4.3:::::::* cpe:2.3:a:gnu:gnutls:2.4.2:::::::* cpe:2.3:a:gnu:gnutls:2.4.1:::::::* cpe:2.3:a:gnu:gnutls:2.4.0:::::::* cpe:2.3:a:gnu:gnutls:2.3.9:::::::* cpe:2.3:a:gnu:gnutls:2.3.8:::::::* cpe:2.3:a:gnu:gnutls:2.3.7:::::::* cpe:2.3:a:gnu:gnutls:2.3.6:::::::* cpe:2.3:a:gnu:gnutls:2.3.5:::::::* cpe:2.3:a:gnu:gnutls:2.3.4:::::::* cpe:2.3:a:gnu:gnutls:2.3.3:::::::* cpe:2.3:a:gnu:gnutls:2.3.2:::::::* cpe:2.3:a:gnu:gnutls:2.3.11:::::::* cpe:2.3:a:gnu:gnutls:2.3.10:::::::* cpe:2.3:a:gnu:gnutls:2.3.1:::::::* cpe:2.3:a:gnu:gnutls:2.3.0:::::::* cpe:2.3:a:gnu:gnutls:2.2.5:::::::* cpe:2.3:a:gnu:gnutls:2.2.4:::::::* cpe:2.3:a:gnu:gnutls:2.2.3:::::::* cpe:2.3:a:gnu:gnutls:2.2.2:::::::* cpe:2.3:a:gnu:gnutls:2.2.1:::::::* cpe:2.3:a:gnu:gnutls:2.2.0:::::::* cpe:2.3:a:gnu:gnutls:2.1.8:::::::* cpe:2.3:a:gnu:gnutls:2.1.7:::::::* cpe:2.3:a:gnu:gnutls:2.1.6:::::::* cpe:2.3:a:gnu:gnutls:2.1.5:::::::* cpe:2.3:a:gnu:gnutls:2.1.4:::::::* cpe:2.3:a:gnu:gnutls:2.1.3:::::::* cpe:2.3:a:gnu:gnutls:2.1.2:::::::* cpe:2.3:a:gnu:gnutls:2.1.1:::::::* cpe:2.3:a:gnu:gnutls:2.1.0:::::::* cpe:2.3:a:gnu:gnutls:2.0.4:::::::* cpe:2.3:a:gnu:gnutls:2.0.3:::::::* cpe:2.3:a:gnu:gnutls:2.0.2:::::::* cpe:2.3:a:gnu:gnutls:2.0.1:::::::* cpe:2.3:a:gnu:gnutls:2.0.0:::::::* cpe:2.3:a:gnu:gnutls:1.7.9:::::::* cpe:2.3:a:gnu:gnutls:1.7.8:::::::* cpe:2.3:a:gnu:gnutls:1.7.7:::::::* cpe:2.3:a:gnu:gnutls:1.7.6:::::::* cpe:2.3:a:gnu:gnutls:1.7.5:::::::* cpe:2.3:a:gnu:gnutls:1.7.4:::::::* cpe:2.3:a:gnu:gnutls:1.7.3:::::::* cpe:2.3:a:gnu:gnutls:1.7.2:::::::* cpe:2.3:a:gnu:gnutls:1.7.19:::::::* cpe:2.3:a:gnu:gnutls:1.7.18:::::::* cpe:2.3:a:gnu:gnutls:1.7.17:::::::* cpe:2.3:a:gnu:gnutls:1.7.16:::::::* cpe:2.3:a:gnu:gnutls:1.7.15:::::::* cpe:2.3:a:gnu:gnutls:1.7.14:::::::* cpe:2.3:a:gnu:gnutls:1.7.13:::::::* cpe:2.3:a:gnu:gnutls:1.7.12:::::::* cpe:2.3:a:gnu:gnutls:1.7.11:::::::* cpe:2.3:a:gnu:gnutls:1.7.10:::::::* cpe:2.3:a:gnu:gnutls:1.7.1:::::::* cpe:2.3:a:gnu:gnutls:1.7.0:::::::* cpe:2.3:a:gnu:gnutls:1.6.3:::::::* cpe:2.3:a:gnu:gnutls:1.6.2:::::::* cpe:2.3:a:gnu:gnutls:1.6.1:::::::* cpe:2.3:a:gnu:gnutls:1.6.0:::::::* cpe:2.3:a:gnu:gnutls:1.5.5:::::::* cpe:2.3:a:gnu:gnutls:1.5.4:::::::* cpe:2.3:a:gnu:gnutls:1.5.3:::::::* cpe:2.3:a:gnu:gnutls:1.5.2:::::::* cpe:2.3:a:gnu:gnutls:1.5.1:::::::* cpe:2.3:a:gnu:gnutls:1.5.0:::::::* cpe:2.3:a:gnu:gnutls:1.4.5:::::::* cpe:2.3:a:gnu:gnutls:1.4.4:::::::* cpe:2.3:a:gnu:gnutls:1.4.3:::::::* cpe:2.3:a:gnu:gnutls:1.4.2:::::::* cpe:2.3:a:gnu:gnutls:1.4.1:::::::* cpe:2.3:a:gnu:gnutls:1.4.0:::::::* cpe:2.3:a:gnu:gnutls:1.3.5:::::::* cpe:2.3:a:gnu:gnutls:1.3.4:::::::* cpe:2.3:a:gnu:gnutls:1.3.3:::::::* cpe:2.3:a:gnu:gnutls:1.3.2:::::::* cpe:2.3:a:gnu:gnutls:1.3.1:::::::* cpe:2.3:a:gnu:gnutls:1.3.0:::::::* cpe:2.3:a:gnu:gnutls:1.2.9:::::::* cpe:2.3:a:gnu:gnutls:1.2.8.1a1:::::::* cpe:2.3:a:gnu:gnutls:1.2.8:::::::* cpe:2.3:a:gnu:gnutls:1.2.7:::::::* cpe:2.3:a:gnu:gnutls:1.2.6:::::::* cpe:2.3:a:gnu:gnutls:1.2.5:::::::* cpe:2.3:a:gnu:gnutls:1.2.4:::::::* cpe:2.3:a:gnu:gnutls:1.2.3:::::::* cpe:2.3:a:gnu:gnutls:1.2.2:::::::* cpe:2.3:a:gnu:gnutls:1.2.11:::::::* cpe:2.3:a:gnu:gnutls:1.2.10:::::::* cpe:2.3:a:gnu:gnutls:1.2.1:::::::* cpe:2.3:a:gnu:gnutls:1.2.0:::::::* cpe:2.3:a:gnu:gnutls:1.1.23:::::::* cpe:2.3:a:gnu:gnutls:1.1.22:::::::* cpe:2.3:a:gnu:gnutls:1.1.21:::::::* cpe:2.3:a:gnu:gnutls:1.1.20:::::::* cpe:2.3:a:gnu:gnutls:1.1.19:::::::* cpe:2.3:a:gnu:gnutls:1.1.18:::::::* cpe:2.3:a:gnu:gnutls:1.1.17:::::::* cpe:2.3:a:gnu:gnutls:1.1.16:::::::* cpe:2.3:a:gnu:gnutls:1.1.15:::::::* cpe:2.3:a:gnu:gnutls:1.1.14:::::::* cpe:2.3:a:gnu:gnutls:1.1.13:::::::* cpe:2.3:a:gnu:gnutls:1.0.25:::::::* cpe:2.3:a:gnu:gnutls:1.0.24:::::::* cpe:2.3:a:gnu:gnutls:1.0.23:::::::* cpe:2.3:a:gnu:gnutls:1.0.22:::::::* cpe:2.3:a:gnu:gnutls:1.0.21:::::::* cpe:2.3:a:gnu:gnutls:1.0.20:::::::* cpe:2.3:a:gnu:gnutls:1.0.19:::::::* cpe:2.3:a:gnu:gnutls:1.0.18:::::::* cpe:2.3:a:gnu:gnutls:1.0.17:::::::* cpe:2.3:a:gnu:gnutls:1.0.16:::::::* cpe:2.3:a:gnu:gnutls::::::::	128
Application	Mozilla Firefox cpe:2.3:a:mozilla:firefox::::::::	1
Application	Mozilla Nss cpe:2.3:a:mozilla:nss:3.9.5:::::::* cpe:2.3:a:mozilla:nss:3.9:::::::* cpe:2.3:a:mozilla:nss:3.8:::::::* cpe:2.3:a:mozilla:nss:3.7.7:::::::* cpe:2.3:a:mozilla:nss:3.7.5:::::::* cpe:2.3:a:mozilla:nss:3.7.3:::::::* cpe:2.3:a:mozilla:nss:3.7.2:::::::* cpe:2.3:a:mozilla:nss:3.7.1:::::::* cpe:2.3:a:mozilla:nss:3.7:::::::* cpe:2.3:a:mozilla:nss:3.6.1:::::::* cpe:2.3:a:mozilla:nss:3.6:::::::* cpe:2.3:a:mozilla:nss:3.5:::::::* cpe:2.3:a:mozilla:nss:3.4.3:::::::* cpe:2.3:a:mozilla:nss:3.4.2:::::::* cpe:2.3:a:mozilla:nss:3.4.1:::::::* cpe:2.3:a:mozilla:nss:3.4:::::::* cpe:2.3:a:mozilla:nss:3.3.2:::::::* cpe:2.3:a:mozilla:nss:3.3.1:::::::* cpe:2.3:a:mozilla:nss:3.3:::::::* cpe:2.3:a:mozilla:nss:3.2.1:::::::* cpe:2.3:a:mozilla:nss:3.2:::::::* cpe:2.3:a:mozilla:nss:3.12.2:::::::* cpe:2.3:a:mozilla:nss:3.12.1:::::::* cpe:2.3:a:mozilla:nss:3.12:::::::* cpe:2.3:a:mozilla:nss:3.11.8:::::::* cpe:2.3:a:mozilla:nss:3.11.7:::::::* cpe:2.3:a:mozilla:nss:3.11.4:::::::* cpe:2.3:a:mozilla:nss:3.11.2:::::::* cpe:2.3:a:mozilla:nss:3.10:::::::* cpe:2.3:a:mozilla:nss:3.0:::::::* cpe:2.3:a:mozilla:nss::::::::	31

OpenVAS Exploits

Date	Description
2012-08-10	Name : Gentoo Security Advisory GLSA 201206-18 (GnuTLS) File : nvt/glsa_201206_18.nasl
2012-04-16	Name : VMSA-2010-0009: ESXi utilities and ESX Service Console third party updates File : nvt/gb_VMSA-2010-0009.nasl
2012-02-12	Name : Gentoo Security Advisory GLSA 201110-05 (gnutls) File : nvt/glsa_201110_05.nasl
2011-08-09	Name : CentOS Update for gnutls CESA-2009:1232 centos4 i386 File : nvt/gb_CESA-2009_1232_gnutls_centos4_i386.nasl
2011-08-09	Name : CentOS Update for seamonkey CESA-2009:1432 centos3 i386 File : nvt/gb_CESA-2009_1432_seamonkey_centos3_i386.nasl
2011-08-09	Name : CentOS Update for java CESA-2009:1584 centos5 i386 File : nvt/gb_CESA-2009_1584_java_centos5_i386.nasl
2011-08-09	Name : CentOS Update for openssl CESA-2010:0054 centos5 i386 File : nvt/gb_CESA-2010_0054_openssl_centos5_i386.nasl
2011-08-09	Name : CentOS Update for gnutls CESA-2010:0166 centos5 i386 File : nvt/gb_CESA-2010_0166_gnutls_centos5_i386.nasl
2010-05-12	Name : Mac OS X 10.6.2 Update / Mac OS X Security Update 2009-006 File : nvt/macosx_upd_10_6_2_secupd_2009-006.nasl
2010-04-30	Name : Mandriva Update for java-1.6.0-openjdk MDVSA-2010:084 (java-1.6.0-openjdk) File : nvt/gb_mandriva_MDVSA_2010_084.nasl
2010-03-31	Name : RedHat Update for openssl RHSA-2010:0163-01 File : nvt/gb_RHSA-2010_0163-01_openssl.nasl
2010-03-31	Name : RedHat Update for gnutls RHSA-2010:0166-01 File : nvt/gb_RHSA-2010_0166-01_gnutls.nasl
2010-03-31	Name : CentOS Update for openssl CESA-2010:0163 centos4 i386 File : nvt/gb_CESA-2010_0163_openssl_centos4_i386.nasl
2010-03-31	Name : CentOS Update for openssl CESA-2010:0163 centos3 i386 File : nvt/gb_CESA-2010_0163_openssl_centos3_i386.nasl
2010-03-02	Name : Mandriva Update for x11-driver-video-ati MDVA-2010:084 (x11-driver-video-ati) File : nvt/gb_mandriva_MDVA_2010_084.nasl
2010-01-20	Name : RedHat Update for openssl RHSA-2010:0054-01 File : nvt/gb_RHSA-2010_0054-01_openssl.nasl
2009-12-14	Name : Gentoo Security Advisory GLSA 200912-01 (openssl) File : nvt/glsa_200912_01.nasl
2009-12-10	Name : Mandriva Security Advisory MDVSA-2009:197-3 (nss) File : nvt/mdksa_2009_197_3.nasl
2009-12-10	Name : Mandriva Security Advisory MDVSA-2009:308 (gnutls) File : nvt/mdksa_2009_308.nasl
2009-12-10	Name : Mandriva Security Advisory MDVSA-2009:310 (openssl) File : nvt/mdksa_2009_310.nasl
2009-11-23	Name : Debian Security Advisory DSA 1935-1 (gnutls13 gnutls26) File : nvt/deb_1935_1.nasl
2009-11-23	Name : CentOS Security Advisory CESA-2009:1584 (java-1.6.0-openjdk) File : nvt/ovcesa2009_1584.nasl
2009-11-17	Name : Fedora Core 10 FEDORA-2009-11490 (java-1.6.0-openjdk) File : nvt/fcore_2009_11490.nasl
2009-11-17	Name : Fedora Core 12 FEDORA-2009-11489 (java-1.6.0-openjdk) File : nvt/fcore_2009_11489.nasl
2009-11-17	Name : Fedora Core 11 FEDORA-2009-11486 (java-1.6.0-openjdk) File : nvt/fcore_2009_11486.nasl
2009-11-17	Name : RedHat Security Advisory RHSA-2009:1584 File : nvt/RHSA_2009_1584.nasl
2009-11-17	Name : RedHat Security Advisory RHSA-2009:1571 File : nvt/RHSA_2009_1571.nasl
2009-11-11	Name : RedHat Security Advisory RHSA-2009:1560 File : nvt/RHSA_2009_1560.nasl
2009-10-13	Name : Mandrake Security Advisory MDVSA-2009:258 (openssl) File : nvt/mdksa_2009_258.nasl
2009-10-11	Name : SLES11: Security update for GnuTLS File : nvt/sles11_gnutls0.nasl
2009-10-10	Name : SLES9: Security update for GnuTLS File : nvt/sles9p5057720.nasl
2009-09-28	Name : Fedora Core 10 FEDORA-2009-8622 (gnutls) File : nvt/fcore_2009_8622.nasl
2009-09-28	Name : Mandrake Security Advisory MDVSA-2009:237 (openssl) File : nvt/mdksa_2009_237.nasl
2009-09-28	Name : Mandrake Security Advisory MDVSA-2009:238 (openssl) File : nvt/mdksa_2009_238.nasl
2009-09-28	Name : Mandrake Security Advisory MDVSA-2009:239 (openssl) File : nvt/mdksa_2009_239.nasl
2009-09-28	Name : Fedora Core 11 FEDORA-2009-8565 (gnutls) File : nvt/fcore_2009_8565.nasl
2009-09-21	Name : Debian Security Advisory DSA 1888-1 (openssl, openssl097) File : nvt/deb_1888_1.nasl
2009-09-21	Name : SuSE Security Summary SUSE-SR:2009:015 File : nvt/suse_sr_2009_015.nasl
2009-09-15	Name : CentOS Security Advisory CESA-2009:1432 (seamonkey) File : nvt/ovcesa2009_1432.nasl
2009-09-15	Name : Ubuntu USN-830-1 (openssl) File : nvt/ubuntu_830_1.nasl
2009-09-15	Name : Mandrake Security Advisory MDVSA-2009:197-2 (nss) File : nvt/mdksa_2009_197_2.nasl
2009-09-15	Name : RedHat Security Advisory RHSA-2009:1432 File : nvt/RHSA_2009_1432.nasl
2009-09-02	Name : Mandrake Security Advisory MDVSA-2009:210 (gnutls) File : nvt/mdksa_2009_210.nasl
2009-09-02	Name : Ubuntu USN-809-1 (gnutls26) File : nvt/ubuntu_809_1.nasl
2009-09-02	Name : RedHat Security Advisory RHSA-2009:1232 File : nvt/RHSA_2009_1232.nasl
2009-09-02	Name : CentOS Security Advisory CESA-2009:1232 (gnutls) File : nvt/ovcesa2009_1232.nasl
2009-09-02	Name : Debian Security Advisory DSA 1874-1 (nss) File : nvt/deb_1874_1.nasl
2009-09-02	Name : FreeBSD Ports: gnutls File : nvt/freebsd_gnutls5.nasl
2009-09-02	Name : Mandrake Security Advisory MDVSA-2009:216 (mozilla-thunderbird) File : nvt/mdksa_2009_216.nasl
2009-08-17	Name : Mandrake Security Advisory MDVSA-2009:197 (nss) File : nvt/mdksa_2009_197.nasl
2009-08-17	Name : RedHat Security Advisory RHSA-2009:1207 File : nvt/RHSA_2009_1207.nasl
2009-08-17	Name : RedHat Security Advisory RHSA-2009:1190 File : nvt/RHSA_2009_1190.nasl
2009-08-17	Name : RedHat Security Advisory RHSA-2009:1186 File : nvt/RHSA_2009_1186.nasl
2009-08-17	Name : Ubuntu USN-810-1 (nss) File : nvt/ubuntu_810_1.nasl
2009-08-17	Name : Ubuntu USN-810-2 (fixed) File : nvt/ubuntu_810_2.nasl
2009-08-17	Name : RedHat Security Advisory RHSA-2009:1184 File : nvt/RHSA_2009_1184.nasl
2009-08-05	Name : Firefox SSL Server Spoofing Vulnerability (Win) File : nvt/gb_firefox_ssl_spoof_vuln_win.nasl
2009-08-05	Name : OpenSSL/GnuTLS SSL Server Spoofing Vulnerability (Win) File : nvt/gb_openssl_n_gnutls_ssl_spoof_vuln_win.nasl
0000-00-00	Name : Slackware Advisory SSA:2009-290-01 gnutls File : nvt/esoft_slk_ssa_2009_290_01.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
56960	GnuTLS libgnutls X.509 Certificate Multiple Fields NULL Character Spoofing SS...
56752	Network Security Services (NSS) Library X.509 Certificate MD2 Hash Collision ...

Nessus® Vulnerability Scanner

Date	Description
2016-03-08	Name : The remote VMware ESX host is missing a security-related patch. File : vmware_VMSA-2010-0019_remote.nasl - Type : ACT_GATHER_INFO
2016-03-08	Name : The remote VMware ESX host is missing a security-related patch. File : vmware_VMSA-2010-0001_remote.nasl - Type : ACT_GATHER_INFO
2016-03-08	Name : The remote VMware ESX / ESXi host is missing a security-related patch. File : vmware_VMSA-2010-0009_remote.nasl - Type : ACT_GATHER_INFO
2016-03-08	Name : The remote VMware ESX host is missing a security-related patch. File : vmware_VMSA-2010-0015_remote.nasl - Type : ACT_GATHER_INFO
2014-11-26	Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2014-0008.nasl - Type : ACT_GATHER_INFO
2014-11-26	Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2014-0007.nasl - Type : ACT_GATHER_INFO
2014-10-10	Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL15663.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1431.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1232.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1184.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1432.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1584.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0054.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0163.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0166.nasl - Type : ACT_GATHER_INFO
2013-06-29	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1584.nasl - Type : ACT_GATHER_INFO
2013-03-09	Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-810-3.nasl - Type : ACT_GATHER_INFO
2013-01-24	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1207.nasl - Type : ACT_GATHER_INFO
2013-01-24	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1190.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090731_nspr_and_nss_for_SL_4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20100325_openssl_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20100325_gnutls_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20100119_openssl_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20091109_java__jdk_1_6_0__on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090731_nspr_and_nss_for_SL_5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090909_seamonkey_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090826_gnutls_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-06-25	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201206-18.nasl - Type : ACT_GATHER_INFO
2012-01-04	Name : The remote server is affected by multiple vulnerabilities. File : openssl_0_9_8l.nasl - Type : ACT_GATHER_INFO
2011-10-12	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201110-05.nasl - Type : ACT_GATHER_INFO
2011-04-23	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1662.nasl - Type : ACT_GATHER_INFO
2010-12-08	Name : The remote VMware ESX host is missing one or more security-related patches. File : vmware_VMSA-2010-0019.nasl - Type : ACT_GATHER_INFO
2010-10-04	Name : The remote VMware ESX host is missing one or more security-related patches. File : vmware_VMSA-2010-0015.nasl - Type : ACT_GATHER_INFO
2010-07-30	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-239.nasl - Type : ACT_GATHER_INFO
2010-06-01	Name : The remote VMware ESXi / ESX host is missing one or more security-related pat... File : vmware_VMSA-2010-0009.nasl - Type : ACT_GATHER_INFO
2010-05-11	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0166.nasl - Type : ACT_GATHER_INFO
2010-05-11	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0163.nasl - Type : ACT_GATHER_INFO
2010-04-29	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-084.nasl - Type : ACT_GATHER_INFO
2010-03-29	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0166.nasl - Type : ACT_GATHER_INFO
2010-03-26	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0163.nasl - Type : ACT_GATHER_INFO
2010-02-24	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1874.nasl - Type : ACT_GATHER_INFO
2010-02-24	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1888.nasl - Type : ACT_GATHER_INFO
2010-02-24	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1935.nasl - Type : ACT_GATHER_INFO
2010-02-15	Name : The remote openSUSE host is missing a security update. File : suse_11_2_gnutls-100208.nasl - Type : ACT_GATHER_INFO
2010-01-21	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0054.nasl - Type : ACT_GATHER_INFO
2010-01-20	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0054.nasl - Type : ACT_GATHER_INFO
2010-01-08	Name : The remote VMware ESX host is missing a security-related patch. File : vmware_VMSA-2010-0001.nasl - Type : ACT_GATHER_INFO
2009-12-04	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-310.nasl - Type : ACT_GATHER_INFO
2009-12-04	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-308.nasl - Type : ACT_GATHER_INFO
2009-12-02	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200912-01.nasl - Type : ACT_GATHER_INFO
2009-11-30	Name : The remote openSUSE host is missing a security update. File : suse_11_0_java-1_6_0-openjdk-091125.nasl - Type : ACT_GATHER_INFO
2009-11-30	Name : The remote openSUSE host is missing a security update. File : suse_11_2_java-1_6_0-openjdk-091127.nasl - Type : ACT_GATHER_INFO
2009-11-30	Name : The remote openSUSE host is missing a security update. File : suse_11_1_java-1_6_0-openjdk-091125.nasl - Type : ACT_GATHER_INFO
2009-11-23	Name : The remote VMware ESXi / ESX host is missing one or more security-related pat... File : vmware_VMSA-2009-0016.nasl - Type : ACT_GATHER_INFO
2009-11-18	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200911-02.nasl - Type : ACT_GATHER_INFO
2009-11-17	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1584.nasl - Type : ACT_GATHER_INFO
2009-11-16	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-859-1.nasl - Type : ACT_GATHER_INFO
2009-11-16	Name : The remote Fedora host is missing a security update. File : fedora_2009-11490.nasl - Type : ACT_GATHER_INFO
2009-11-16	Name : The remote Fedora host is missing a security update. File : fedora_2009-11489.nasl - Type : ACT_GATHER_INFO
2009-11-16	Name : The remote Fedora host is missing a security update. File : fedora_2009-11486.nasl - Type : ACT_GATHER_INFO
2009-11-11	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1571.nasl - Type : ACT_GATHER_INFO
2009-11-10	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1560.nasl - Type : ACT_GATHER_INFO
2009-11-09	Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2009-006.nasl - Type : ACT_GATHER_INFO
2009-11-09	Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_10_6_2.nasl - Type : ACT_GATHER_INFO
2009-10-19	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2009-290-01.nasl - Type : ACT_GATHER_INFO
2009-10-08	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-258.nasl - Type : ACT_GATHER_INFO
2009-10-06	Name : The remote openSUSE host is missing a security update. File : suse_gnutls-6471.nasl - Type : ACT_GATHER_INFO
2009-09-28	Name : The remote Fedora host is missing a security update. File : fedora_2009-8565.nasl - Type : ACT_GATHER_INFO
2009-09-28	Name : The remote Fedora host is missing a security update. File : fedora_2009-8622.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12501.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_gnutls-090901.nasl - Type : ACT_GATHER_INFO
2009-09-22	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-238.nasl - Type : ACT_GATHER_INFO
2009-09-15	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-830-1.nasl - Type : ACT_GATHER_INFO
2009-09-11	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1432.nasl - Type : ACT_GATHER_INFO
2009-09-11	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1431.nasl - Type : ACT_GATHER_INFO
2009-09-10	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1432.nasl - Type : ACT_GATHER_INFO
2009-09-10	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1431.nasl - Type : ACT_GATHER_INFO
2009-09-09	Name : The remote openSUSE host is missing a security update. File : suse_11_1_gnutls-090901.nasl - Type : ACT_GATHER_INFO
2009-09-09	Name : The remote openSUSE host is missing a security update. File : suse_11_0_gnutls-090901.nasl - Type : ACT_GATHER_INFO
2009-08-27	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1232.nasl - Type : ACT_GATHER_INFO
2009-08-27	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1232.nasl - Type : ACT_GATHER_INFO
2009-08-24	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-210.nasl - Type : ACT_GATHER_INFO
2009-08-20	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-809-1.nasl - Type : ACT_GATHER_INFO
2009-08-20	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_856a6f848b3011de806200e0815b8da8.nasl - Type : ACT_GATHER_INFO
2009-08-10	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-197.nasl - Type : ACT_GATHER_INFO
2009-08-05	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-810-2.nasl - Type : ACT_GATHER_INFO
2009-08-05	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-810-1.nasl - Type : ACT_GATHER_INFO
2009-07-31	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1186.nasl - Type : ACT_GATHER_INFO
2009-07-31	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1184.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:29:00	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	2
Oval ID(s)	20
CPE ID(s)	160
osvdb(s)	2
Openvas Exploit(s)	59
Nessus® Exploit(s)	89

	Related
7.5	CVE-2009-2730
5.1	CVE-2009-2409
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 2 more Alert(s)

7.5 - DSA-1935

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Nessus® Vulnerability Scanner

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU