Executive Summary
Summary | |
---|---|
Title | openssl security update |
Informations | |||
---|---|---|---|
Name | DSA-2837 | First vendor Publication | 2014-01-07 |
Vendor | Debian | Last vendor Modification | 2014-01-07 |
Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:N/I:N/A:P) | |||
---|---|---|---|
Cvss Base Score | 4.3 | Attack Range | Network |
Cvss Impact Score | 2.9 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Anton Johannson discovered that an invalid TLS handshake package could crash OpenSSL with a NULL pointer dereference. The oldstable distribution (squeeze) is not affected. For the stable distribution (wheezy), this problem has been fixed in version 1.0.1e-2+deb7u3. For the unstable distribution (sid), this problem has been fixed in version 1.0.1f-1. We recommend that you upgrade your openssl packages. |
Original Source
Url : http://www.debian.org/security/2014/dsa-2837 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-20 | Improper Input Validation |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:21357 | |||
Oval ID: | oval:org.mitre.oval:def:21357 | ||
Title: | DSA-2837-1 openssl - programming error | ||
Description: | Anton Johansson discovered that an invalid TLS handshake package could crash OpenSSL with a NULL pointer dereference. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-2837-1 CVE-2013-4353 | Version: | 5 |
Platform(s): | Debian GNU/Linux 7 Debian GNU/kFreeBSD 7 | Product(s): | openssl |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:22420 | |||
Oval ID: | oval:org.mitre.oval:def:22420 | ||
Title: | The ssl3_take_mac function in ssl/s3_both.c in OpenSSL 1.0.1 before 1.0.1f allows remote TLS servers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Next Protocol Negotiation record in a TLS handshake | ||
Description: | The ssl3_take_mac function in ssl/s3_both.c in OpenSSL 1.0.1 before 1.0.1f allows remote TLS servers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Next Protocol Negotiation record in a TLS handshake. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2013-4353 | Version: | 3 |
Platform(s): | Red Hat Enterprise Linux 6 CentOS Linux 6 | Product(s): | OpenSSL |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:22428 | |||
Oval ID: | oval:org.mitre.oval:def:22428 | ||
Title: | AIX OpenSSH Vulnerability | ||
Description: | The ssl3_take_mac function in ssl/s3_both.c in OpenSSL 1.0.1 before 1.0.1f allows remote TLS servers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Next Protocol Negotiation record in a TLS handshake. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2013-4353 | Version: | 4 |
Platform(s): | IBM AIX 5.3 IBM AIX 6.1 IBM AIX 7.1 | Product(s): | |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:25032 | |||
Oval ID: | oval:org.mitre.oval:def:25032 | ||
Title: | Vulnerability in OpenSSL 1.0.1 before 1.0.1f, allows remote TLS servers to cause a denial of service (NULL pointer dereference and application crash) | ||
Description: | The ssl3_take_mac function in ssl/s3_both.c in OpenSSL 1.0.1 before 1.0.1f allows remote TLS servers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Next Protocol Negotiation record in a TLS handshake. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2013-4353 | Version: | 3 |
Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows 7 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2 | Product(s): | OpenSSL |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
Information Assurance Vulnerability Management (IAVM)
Date | Description |
---|---|
2014-05-01 | IAVM : 2014-A-0062 - Multiple Vulnerabilities In McAfee Email Gateway Severity : Category I - VMSKEY : V0050005 |
2014-04-24 | IAVM : 2014-B-0046 - Multiple Vulnerabilities in HP System Management Homepage (SMH) Severity : Category I - VMSKEY : V0049737 |
2014-04-17 | IAVM : 2014-B-0041 - Multiple Vulnerabilities in Splunk Severity : Category I - VMSKEY : V0049577 |
Snort® IPS/IDS
Date | Description |
---|---|
2019-10-01 | OpenSSL TLS record tampering denial of service attempt RuleID : 51334 - Revision : 1 - Type : SERVER-OTHER |
2019-10-01 | OpenSSL TLS record tampering denial of service attempt RuleID : 51333 - Revision : 1 - Type : SERVER-OTHER |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_openssl_20140731.nasl - Type : ACT_GATHER_INFO |
2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_openssl_20140623.nasl - Type : ACT_GATHER_INFO |
2014-11-26 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2014-0032.nasl - Type : ACT_GATHER_INFO |
2014-11-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0416.nasl - Type : ACT_GATHER_INFO |
2014-11-08 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2014-0041.nasl - Type : ACT_GATHER_INFO |
2014-08-10 | Name : The remote Fedora host is missing a security update. File : fedora_2014-9308.nasl - Type : ACT_GATHER_INFO |
2014-08-10 | Name : The remote Fedora host is missing a security update. File : fedora_2014-9301.nasl - Type : ACT_GATHER_INFO |
2014-07-15 | Name : The remote host contains an application that is affected by an information di... File : macosx_libreoffice_423.nasl - Type : ACT_GATHER_INFO |
2014-07-15 | Name : The remote host contains an application that is affected by an information di... File : libreoffice_423.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-63.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-62.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-60.nasl - Type : ACT_GATHER_INFO |
2014-04-18 | Name : The remote web server is affected by multiple vulnerabilities. File : hpsmh_7_3_2.nasl - Type : ACT_GATHER_INFO |
2014-04-16 | Name : The remote web server contains an application that is affected by multiple Op... File : splunk_603.nasl - Type : ACT_GATHER_INFO |
2014-04-16 | Name : The remote AIX host is running a vulnerable version of OpenSSL. File : aix_openssl_advisory6.nasl - Type : ACT_GATHER_INFO |
2014-02-23 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201402-25.nasl - Type : ACT_GATHER_INFO |
2014-02-05 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2014-273.nasl - Type : ACT_GATHER_INFO |
2014-02-04 | Name : The remote Fedora host is missing a security update. File : fedora_2014-1560.nasl - Type : ACT_GATHER_INFO |
2014-01-28 | Name : The remote Fedora host is missing a security update. File : fedora_2014-1567.nasl - Type : ACT_GATHER_INFO |
2014-01-14 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2014-013-02.nasl - Type : ACT_GATHER_INFO |
2014-01-13 | Name : The remote Fedora host is missing a security update. File : fedora_2014-0474.nasl - Type : ACT_GATHER_INFO |
2014-01-12 | Name : The remote Fedora host is missing a security update. File : fedora_2014-0476.nasl - Type : ACT_GATHER_INFO |
2014-01-12 | Name : The remote Fedora host is missing a security update. File : fedora_2014-0456.nasl - Type : ACT_GATHER_INFO |
2014-01-10 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2079-1.nasl - Type : ACT_GATHER_INFO |
2014-01-10 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20140108_openssl_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2014-01-09 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0015.nasl - Type : ACT_GATHER_INFO |
2014-01-09 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-0015.nasl - Type : ACT_GATHER_INFO |
2014-01-09 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-0015.nasl - Type : ACT_GATHER_INFO |
2014-01-08 | Name : The remote service may be affected by multiple vulnerabilities. File : openssl_1_0_1f.nasl - Type : ACT_GATHER_INFO |
2014-01-08 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2837.nasl - Type : ACT_GATHER_INFO |
2014-01-07 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_5aaa257e772d11e3a65a3c970e169bc2.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:32:28 |
|
2014-01-10 00:22:42 |
|
2014-01-09 13:23:03 |
|
2014-01-07 17:18:24 |
|