Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Informations
NameMDVSA-2009:323First vendor Publication2009-12-07
VendorMandrivaLast vendor Modification2009-12-07
Severity (Vendor) N/ARevisionN/A

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score7.5Attack RangeNetwork
Cvss Impact Score6.4Attack ComplexityLow
Cvss Expoit Score10AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

Multiple vulnerabilities has been found and corrected in apache:

Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service (memory consumption) via multiple calls, as demonstrated by initial SSL client handshakes to the Apache HTTP Server mod_ssl that specify a compression algorithm (CVE-2008-1678). Note that this security issue does not really apply as zlib compression is not enabled in the openssl build provided by Mandriva, but apache is patched to address this issue anyway (conserns 2008.1 only).

mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request (CVE-2009-1191).

Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via wildcards in a pathname in an FTP URI (CVE-2008-2939). Note that this security issue was initially addressed with MDVSA-2008:195 but the patch fixing the issue was added but not applied in 2009.0.

The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file (CVE-2009-1195).

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests (CVE-2009-1890).

Fix a potential Denial-of-Service attack against mod_deflate or other modules, by forcing the server to consume CPU time in compressing a large file after a client disconnects (CVE-2009-1891).

The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command (CVE-2009-3094).

The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11. NOTE: as of 20090903, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes (CVE-2009-3095).

Apache is affected by SSL injection or man-in-the-middle attacks due to a design flaw in the SSL and/or TLS protocols. A short term solution was released Sat Nov 07 2009 by the ASF team to mitigate these problems. Apache will now reject in-session renegotiation (CVE-2009-3555).

Packages for 2008.0 are being provided due to extended support for Corporate products.

This update provides a solution to these vulnerabilities.

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDVSA-2009:323

CWE : Common Weakness Enumeration

idName
CWE-399Resource Management Errors
CWE-310Cryptographic Issues
CWE-264Permissions, Privileges, and Access Controls
CWE-189Numeric Errors (CWE/SANS Top 25)
CWE-79Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)
CWE-20Improper Input Validation
CWE-16Configuration

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:9754
 
Oval ID: oval:org.mitre.oval:def:9754
Title: Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service (memory consumption) via multiple calls, as demonstrated by initial SSL client handshakes to the Apache HTTP Server mod_ssl that specify a compression algorithm.
Description: Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service (memory consumption) via multiple calls, as demonstrated by initial SSL client handshakes to the Apache HTTP Server mod_ssl that specify a compression algorithm.
Family: unix Class: vulnerability
Reference(s): CVE-2008-1678
Version: 5
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7716
 
Oval ID: oval:org.mitre.oval:def:7716
Title: Apache 'mod_proxy_ftp' Wildcard Characters Cross-Site Scripting Vulnerability
Description: Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.
Family: windows Class: vulnerability
Reference(s): CVE-2008-2939
Version: 8
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows 7
Product(s): Apache
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13835
 
Oval ID: oval:org.mitre.oval:def:13835
Title: USN-731-1 -- apache2 vulnerabilities
Description: It was discovered that Apache did not sanitize the method specifier header from an HTTP request when it is returned in an error message, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. This issue only affected Ubuntu 6.06 LTS and 7.10. It was discovered that Apache was vulnerable to a cross-site request forgery in the mod_proxy_balancer balancer manager. If an Apache administrator were tricked into clicking a link on a specially crafted web page, an attacker could trigger commands that could modify the balancer manager configuration. This issue only affected Ubuntu 7.10 and 8.04 LTS. It was discovered that Apache had a memory leak when using mod_ssl with compression. A remote attacker could exploit this to exhaust server memory, leading to a denial of service. This issue only affected Ubuntu 7.10. It was discovered that in certain conditions, Apache did not specify a default character set when returning certain error messages containing UTF-7 encoded data, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. This issue only affected Ubuntu 6.06 LTS and 7.10. It was discovered that when configured as a proxy server, Apache did not limit the number of forwarded interim responses. A malicious remote server could send a large number of interim responses and cause a denial of service via memory exhaustion. It was discovered that mod_proxy_ftp did not sanitize wildcard pathnames when they are returned in directory listings, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output
Family: unix Class: patch
Reference(s): USN-731-1
CVE-2007-6203
CVE-2007-6420
CVE-2008-1678
CVE-2008-2168
CVE-2008-2364
CVE-2008-2939
Version: 5
Platform(s): Ubuntu 7.10
Ubuntu 8.04
Ubuntu 6.06
Product(s): apache2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11316
 
Oval ID: oval:org.mitre.oval:def:11316
Title: Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.
Description: Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.
Family: unix Class: vulnerability
Reference(s): CVE-2008-2939
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21751
 
Oval ID: oval:org.mitre.oval:def:21751
Title: ELSA-2008:0967: httpd security and bug fix update (Moderate)
Description: Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.
Family: unix Class: patch
Reference(s): ELSA-2008:0967-01
CVE-2008-2364
CVE-2008-2939
Version: 13
Platform(s): Oracle Linux 5
Product(s): httpd
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:8261
 
Oval ID: oval:org.mitre.oval:def:8261
Title: Apache 'mod_proxy_ajp' Information Disclosure Vulnerability
Description: mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request.
Family: windows Class: vulnerability
Reference(s): CVE-2009-1191
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows 7
Product(s): Apache
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:8704
 
Oval ID: oval:org.mitre.oval:def:8704
Title: Apache 'Options' and 'AllowOverride' Directives Security Bypass Vulnerability
Description: The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.
Family: windows Class: vulnerability
Reference(s): CVE-2009-1195
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows 7
Product(s): Apache
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7270
 
Oval ID: oval:org.mitre.oval:def:7270
Title: DSA-1816 apache2 -- insufficient security check
Description: It was discovered that the Apache web server did not properly handle the "Options=" parameter to the AllowOverride directive: In the stable distribution (lenny), local users could (via .htaccess) enable script execution in Server Side Includes even in configurations where the AllowOverride directive contained only Options=IncludesNoEXEC. In the oldstable distribution (etch), local users could (via .htaccess) enable script execution in Server Side Includes and CGI script execution in configurations where the AllowOverride directive contained any "Options=" value. The oldstable distribution (etch), this problem has been fixed in version 2.2.3-4+etch8.
Family: unix Class: patch
Reference(s): DSA-1816
CVE-2009-1195
Version: 3
Platform(s): Debian GNU/Linux 5.0
Debian GNU/Linux 4.0
Product(s): apache2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13764
 
Oval ID: oval:org.mitre.oval:def:13764
Title: DSA-1816-1 apache2 -- insufficient security check
Description: It was discovered that the Apache web server did not properly handle the "Options=" parameter to the AllowOverride directive: In the stable distribution , local users could enable script execution in Server Side Includes even in configurations where the AllowOverride directive contained only Options=IncludesNoEXEC. In the oldstable distribution , local users could enable script execution in Server Side Includes and CGI script execution in configurations where the AllowOverride directive contained any "Options=" value. For the stable distribution, this problem has been fixed in version 2.2.9-10+lenny3. The oldstable distribution, this problem has been fixed in version 2.2.3-4+etch8. For the testing distribution and the unstable distribution, this problem will be fixed in version 2.2.11-6. This advisory also provides updated apache2-mpm-itk packages which have been recompiled against the new apache2 packages. We recommend that you upgrade your apache2 packages.
Family: unix Class: patch
Reference(s): DSA-1816-1
CVE-2009-1195
Version: 5
Platform(s): Debian GNU/Linux 5.0
Debian GNU/Linux 4.0
Product(s): apache2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12377
 
Oval ID: oval:org.mitre.oval:def:12377
Title: HP-UX Apache-based Web Server, Local Information Disclosure, Increase of Privilege, Remote Denial of Service (DoS)
Description: The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.
Family: unix Class: vulnerability
Reference(s): CVE-2009-1195
Version: 7
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11094
 
Oval ID: oval:org.mitre.oval:def:11094
Title: The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.
Description: The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.
Family: unix Class: vulnerability
Reference(s): CVE-2009-1195
Version: 5
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22777
 
Oval ID: oval:org.mitre.oval:def:22777
Title: ELSA-2009:1075: httpd security update (Moderate)
Description: The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.
Family: unix Class: patch
Reference(s): ELSA-2009:1075-01
CVE-2008-1678
CVE-2009-1195
Version: 13
Platform(s): Oracle Linux 5
Product(s): httpd
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9403
 
Oval ID: oval:org.mitre.oval:def:9403
Title: The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.
Description: The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.
Family: unix Class: vulnerability
Reference(s): CVE-2009-1890
Version: 5
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:8616
 
Oval ID: oval:org.mitre.oval:def:8616
Title: Apache 'mod_proxy' Remote Denial Of Service Vulnerability
Description: The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.
Family: windows Class: vulnerability
Reference(s): CVE-2009-1890
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows 7
Product(s): Apache
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13643
 
Oval ID: oval:org.mitre.oval:def:13643
Title: USN-802-2 -- apache2 regression
Description: USN-802-1 fixed vulnerabilities in Apache. The upstream fix for CVE-2009-1891 introduced a regression that would cause Apache children to occasionally segfault when mod_deflate is used. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that mod_proxy_http did not properly handle a large amount of streamed data when used as a reverse proxy. A remote attacker could exploit this and cause a denial of service via memory resource consumption. This issue affected Ubuntu 8.04 LTS, 8.10 and 9.04. It was discovered that mod_deflate did not abort compressing large files when the connection was closed. A remote attacker could exploit this and cause a denial of service via CPU resource consumption
Family: unix Class: patch
Reference(s): USN-802-2
CVE-2009-1891
CVE-2009-1890
Version: 5
Platform(s): Ubuntu 8.04
Ubuntu 9.04
Ubuntu 6.06
Ubuntu 8.10
Product(s): apache2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12330
 
Oval ID: oval:org.mitre.oval:def:12330
Title: HP-UX Apache-based Web Server, Local Information Disclosure, Increase of Privilege, Remote Denial of Service (DoS)
Description: The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.
Family: unix Class: vulnerability
Reference(s): CVE-2009-1890
Version: 7
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9248
 
Oval ID: oval:org.mitre.oval:def:9248
Title: The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).
Description: The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).
Family: unix Class: vulnerability
Reference(s): CVE-2009-1891
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:8632
 
Oval ID: oval:org.mitre.oval:def:8632
Title: Apache 'mod_deflate' Connection State Denial Of Service Vulnerability
Description: The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).
Family: windows Class: vulnerability
Reference(s): CVE-2009-1891
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows 7
Product(s): Apache
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7600
 
Oval ID: oval:org.mitre.oval:def:7600
Title: DSA-1834 apache2 -- denial of service
Description: A denial of service flaw was found in the Apache mod_proxy module when it was used as a reverse proxy. A remote attacker could use this flaw to force a proxy process to consume large amounts of CPU time. This issue did not affect Debian 4.0 "etch". A denial of service flaw was found in the Apache mod_deflate module. This module continued to compress large files until compression was complete, even if the network connection that requested the content was closed before compression completed. This would cause mod_deflate to consume large amounts of CPU if mod_deflate was enabled for a large file. A similar flaw related to HEAD requests for compressed content was also fixed. The oldstable distribution (etch), these problems have been fixed in version 2.2.3-4+etch9.
Family: unix Class: patch
Reference(s): DSA-1834
CVE-2009-1890
CVE-2009-1891
Version: 3
Platform(s): Debian GNU/Linux 5.0
Debian GNU/Linux 4.0
Product(s): apache2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:19296
 
Oval ID: oval:org.mitre.oval:def:19296
Title: DSA-1834-1 apache2 apache2-mpm-itk - denial of service
Description: A denial of service flaw was found in the Apache mod_proxy module when it was used as a reverse proxy. A remote attacker could use this flaw to force a proxy process to consume large amounts of CPU time. This issue did not affect Debian 4.0 "etch".
Family: unix Class: patch
Reference(s): DSA-1834-1
CVE-2009-1890
CVE-2009-1891
Version: 5
Platform(s): Debian GNU/Linux 4.0
Debian GNU/Linux 5.0
Product(s): apache2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13769
 
Oval ID: oval:org.mitre.oval:def:13769
Title: DSA-1834-2 apache2 -- denial of service
Description: The previous update caused a regression for apache2 in Debian 4.0 "etch". Using mod_deflate together with mod_php could cause segfaults when a client aborts a connection. This update corrects this flaw. For reference the original advisory text is below. A denial of service flaw was found in the Apache mod_proxy module when it was used as a reverse proxy. A remote attacker could use this flaw to force a proxy process to consume large amounts of CPU time. This issue did not affect Debian 4.0 "etch". A denial of service flaw was found in the Apache mod_deflate module. This module continued to compress large files until compression was complete, even if the network connection that requested the content was closed before compression completed. This would cause mod_deflate to consume large amounts of CPU if mod_deflate was enabled for a large file. A similar flaw related to HEAD requests for compressed content was also fixed. The oldstable distribution, this problem has been fixed in version 2.2.3-4+etch10. The other distributions stable, testing and unstable were not affected by the regression. This advisory also provides updated apache2-mpm-itk packages which have been recompiled against the new apache2 packages. Updated packages for apache2-mpm-itk for the s390 architecture are not included yet. They will be released as soon as they become available. We recommend that you upgrade your apache2, apache2-mpm-itk package.
Family: unix Class: patch
Reference(s): DSA-1834-2
CVE-2009-1890
CVE-2009-1891
Version: 5
Platform(s): Debian GNU/Linux 4.0
Product(s): apache2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13185
 
Oval ID: oval:org.mitre.oval:def:13185
Title: USN-802-1 -- apache2 vulnerabilities
Description: It was discovered that mod_proxy_http did not properly handle a large amount of streamed data when used as a reverse proxy. A remote attacker could exploit this and cause a denial of service via memory resource consumption. This issue affected Ubuntu 8.04 LTS, 8.10 and 9.04. It was discovered that mod_deflate did not abort compressing large files when the connection was closed. A remote attacker could exploit this and cause a denial of service via CPU resource consumption
Family: unix Class: patch
Reference(s): USN-802-1
CVE-2009-1890
CVE-2009-1891
Version: 5
Platform(s): Ubuntu 8.04
Ubuntu 9.04
Ubuntu 6.06
Ubuntu 8.10
Product(s): apache2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12361
 
Oval ID: oval:org.mitre.oval:def:12361
Title: HP-UX Apache-based Web Server, Local Information Disclosure, Increase of Privilege, Remote Denial of Service (DoS)
Description: The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).
Family: unix Class: vulnerability
Reference(s): CVE-2009-1891
Version: 7
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22875
 
Oval ID: oval:org.mitre.oval:def:22875
Title: ELSA-2009:1148: httpd security update (Important)
Description: The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).
Family: unix Class: patch
Reference(s): ELSA-2009:1148-01
CVE-2009-1890
CVE-2009-1891
Version: 13
Platform(s): Oracle Linux 5
Product(s): httpd
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:8087
 
Oval ID: oval:org.mitre.oval:def:8087
Title: Apache mod_proxy_ftp Module Insufficient Input Validation Denial Of Service Vulnerability
Description: The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command.
Family: windows Class: vulnerability
Reference(s): CVE-2009-3094
Version: 8
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows 7
Product(s): Apache
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:10981
 
Oval ID: oval:org.mitre.oval:def:10981
Title: The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command.
Description: The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command.
Family: unix Class: vulnerability
Reference(s): CVE-2009-3094
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9363
 
Oval ID: oval:org.mitre.oval:def:9363
Title: The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.
Description: The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.
Family: unix Class: vulnerability
Reference(s): CVE-2009-3095
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:8662
 
Oval ID: oval:org.mitre.oval:def:8662
Title: Apache mod_proxy_ftp Module Insufficient Input Validation Access Restriction Bypass Vulnerability
Description: The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.
Family: windows Class: vulnerability
Reference(s): CVE-2009-3095
Version: 8
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows 7
Product(s): Apache
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13296
 
Oval ID: oval:org.mitre.oval:def:13296
Title: USN-860-1 -- apache2 vulnerabilities
Description: Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3 protocols. If an attacker could perform a man in the middle attack at the start of a TLS connection, the attacker could inject arbitrary content at the beginning of the user�s session. The flaw is with TLS renegotiation and potentially affects any software that supports this feature. Attacks against the HTTPS protocol are known, with the severity of the issue depending on the safeguards used in the web application. Until the TLS protocol and underlying libraries are adjusted to defend against this vulnerability, a partial, temporary workaround has been applied to Apache that disables client initiated TLS renegotiation. This update does not protect against server initiated TLS renegotiation when using SSLVerifyClient and SSLCipherSuite on a per Directory or Location basis. Users can defend againt server inititiated TLS renegotiation attacks by adjusting their Apache configuration to use SSLVerifyClient and SSLCipherSuite only on the server or virtual host level. It was discovered that mod_proxy_ftp in Apache did not properly sanitize its input when processing replies to EPASV and PASV commands. An attacker could use this to cause a denial of service in the Apache child process. Another flaw was discovered in mod_proxy_ftp. If Apache is configured as a reverse proxy, an attacker could send a crafted HTTP header to bypass intended access controls and send arbitrary commands to the FTP server
Family: unix Class: patch
Reference(s): USN-860-1
CVE-2009-3555
CVE-2009-3094
CVE-2009-3095
Version: 5
Platform(s): Ubuntu 8.04
Ubuntu 8.10
Ubuntu 9.10
Ubuntu 6.06
Ubuntu 9.04
Product(s): apache2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:8535
 
Oval ID: oval:org.mitre.oval:def:8535
Title: HP-UX Running OpenSSL, Remote Unauthorized Data Injection, Denial of Service (DoS)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: vulnerability
Reference(s): CVE-2009-3555
Version: 6
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:8366
 
Oval ID: oval:org.mitre.oval:def:8366
Title: HP-UX Running Apache, Remote Unauthorized Data Injection, Denial of Service (DoS)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: vulnerability
Reference(s): CVE-2009-3555
Version: 6
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:8201
 
Oval ID: oval:org.mitre.oval:def:8201
Title: DSA-1934 apache2 -- multiple issues
Description: A design flaw has been found in the TLS and SSL protocol that allows an attacker to inject arbitrary content at the beginning of a TLS/SSL connection. The attack is related to the way how TLS and SSL handle session renegotiations. CVE-2009-3555 has been assigned to this vulnerability. As a partial mitigation against this attack, this apache2 update disables client-initiated renegotiations. This should fix the vulnerability for the majority of Apache configurations in use. NOTE: This is not a complete fix for the problem. The attack is still possible in configurations where the server initiates the renegotiation. This is the case for the following configurations (the information in the changelog of the updated packages is slightly inaccurate): As a workaround, you may rearrange your configuration in a way that SSLVerifyClient and SSLCipherSuite are only used on the server or virtual host level. A complete fix for the problem will require a protocol change. Further information will be included in a separate announcement about this issue. In addition, this update fixes the following issues in Apache's mod_proxy_ftp: Insufficient input validation in the mod_proxy_ftp module allowed remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command. Insufficient input validation in the mod_proxy_ftp module allowed remote authenticated attackers to bypass intended access restrictions and send arbitrary FTP commands to an FTP server. The oldstable distribution (etch), these problems have been fixed in version 2.2.3-4+etch11.
Family: unix Class: patch
Reference(s): DSA-1934
CVE-2009-3094
CVE-2009-3095
CVE-2009-3555
Version: 3
Platform(s): Debian GNU/Linux 5.0
Debian GNU/Linux 4.0
Product(s): apache2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7973
 
Oval ID: oval:org.mitre.oval:def:7973
Title: Security Vulnerability in the Transport Layer Security (TLS) and Secure Sockets Layer 3.0 (SSLv3) Protocols Involving Handshake Renegotiation Affects Applications Utilizing Network Security Services (NSS)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: vulnerability
Reference(s): CVE-2009-3555
Version: 1
Platform(s): Sun Solaris 8
Sun Solaris 9
Sun Solaris 10
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7478
 
Oval ID: oval:org.mitre.oval:def:7478
Title: VMware ESX, Service Console update for OpenSSL, GnuTLS, NSS and NSPR.
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: vulnerability
Reference(s): CVE-2009-3555
Version: 5
Platform(s): VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7315
 
Oval ID: oval:org.mitre.oval:def:7315
Title: TLS/SSL Renegotiation Vulnerability
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: windows Class: vulnerability
Reference(s): CVE-2009-3555
Version: 23
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Vista
Microsoft Windows 7
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21877
 
Oval ID: oval:org.mitre.oval:def:21877
Title: RHSA-2010:0164: openssl097a security update (Moderate)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: patch
Reference(s): RHSA-2010:0164-01
CESA-2010:0164
CVE-2009-3555
Version: 4
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Product(s): openssl097a
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21828
 
Oval ID: oval:org.mitre.oval:def:21828
Title: RHSA-2010:0166: gnutls security update (Moderate)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: patch
Reference(s): RHSA-2010:0166-01
CESA-2010:0166
CVE-2009-2409
CVE-2009-3555
Version: 29
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Product(s): gnutls
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21587
 
Oval ID: oval:org.mitre.oval:def:21587
Title: RHSA-2010:0165: nss security update (Moderate)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: patch
Reference(s): RHSA-2010:0165-01
CESA-2010:0165
CVE-2009-3555
Version: 4
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Product(s): nspr
nss
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21255
 
Oval ID: oval:org.mitre.oval:def:21255
Title: RHSA-2010:0155: java-1.4.2-ibm security and bug fix update (Moderate)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: patch
Reference(s): RHSA-2010:0155-01
CVE-2009-3555
Version: 4
Platform(s): Red Hat Enterprise Linux 5
Product(s): java-1.4.2-ibm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20357
 
Oval ID: oval:org.mitre.oval:def:20357
Title: Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: vulnerability
Reference(s): CVE-2009-3555
Version: 4
Platform(s): VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13623
 
Oval ID: oval:org.mitre.oval:def:13623
Title: DSA-1934-1 apache2 -- multiple issues
Description: A design flaw has been found in the TLS and SSL protocol that allows an attacker to inject arbitrary content at the beginning of a TLS/SSL connection. The attack is related to the way how TLS and SSL handle session renegotiations. CVE-2009-3555 has been assigned to this vulnerability. As a partial mitigation against this attack, this apache2 update disables client-initiated renegotiations. This should fix the vulnerability for the majority of Apache configurations in use. NOTE: This is not a complete fix for the problem. The attack is still possible in configurations where the server initiates the renegotiation. This is the case for the following configurations: - - The "SSLVerifyClient" directive is used in a Directory or Location context. - - The "SSLCipherSuite" directive is used in a Directory or Location context. As a workaround, you may rearrange your configuration in a way that SSLVerifyClient and SSLCipherSuite are only used on the server or virtual host level. A complete fix for the problem will require a protocol change. Further information will be included in a separate announcement about this issue. In addition, this update fixes the following issues in Apache's mod_proxy_ftp: CVE-2009-3094: Insufficient input validation in the mod_proxy_ftp module allowed remote FTP servers to cause a denial of service via a malformed reply to an EPSV command. CVE-2009-3095: Insufficient input validation in the mod_proxy_ftp module allowed remote authenticated attackers to bypass intended access restrictions and send arbitrary FTP commands to an FTP server. For the stable distribution, these problems have been fixed in version 2.2.9-10+lenny6. This version also includes some non-security bug fixes that were scheduled for inclusion in the next stable point release. The oldstable distribution, these problems have been fixed in version 2.2.3-4+etch11. For the testing distribution and the unstable distribution, these problems will be fixed in version 2.2.14-2. This advisory also provides updated apache2-mpm-itk packages which have been recompiled against the new apache2 packages. Updated apache2-mpm-itk packages for the armel architecture are not included yet. They will be released as soon as they become available. We recommend that you upgrade your apache2 and apache2-mpm-itk packages.
Family: unix Class: patch
Reference(s): DSA-1934-1
CVE-2009-3094
CVE-2009-3095
CVE-2009-3555
Version: 5
Platform(s): Debian GNU/Linux 5.0
Debian GNU/Linux 4.0
Product(s): apache2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13532
 
Oval ID: oval:org.mitre.oval:def:13532
Title: USN-927-6 -- nss vulnerability
Description: USN-927-1 fixed vulnerabilities in NSS on Ubuntu 9.10. This update provides the corresponding updates for Ubuntu 9.04. Original advisory details: Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3 protocols. If an attacker could perform a man in the middle attack at the start of a TLS connection, the attacker could inject arbitrary content at the beginning of the user�s session. This update adds support for the new new renegotiation extension and will use it when the server supports it.
Family: unix Class: patch
Reference(s): USN-927-6
CVE-2009-3555
Version: 5
Platform(s): Ubuntu 9.04
Product(s): nss
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13529
 
Oval ID: oval:org.mitre.oval:def:13529
Title: USN-990-2 -- apache2 vulnerability
Description: USN-860-1 introduced a partial workaround to Apache that disabled client initiated TLS renegotiation in order to mitigate CVE-2009-3555. USN-990-1 introduced the new RFC5746 renegotiation extension in openssl, and completely resolves the issue. After updating openssl, an Apache server will allow both patched and unpatched web browsers to connect, but unpatched browsers will not be able to renegotiate. This update introduces the new SSLInsecureRenegotiation directive for Apache that may be used to re-enable insecure renegotiations with unpatched web browsers. If an attacker could perform a man in the middle attack at the start of a TLS connection, the attacker could inject arbitrary content at the beginning of the user�s session. This update adds backported support for the new RFC5746 renegotiation extension and will use it when both the client and the server support it.
Family: unix Class: patch
Reference(s): USN-990-2
CVE-2009-3555
Version: 5
Platform(s): Ubuntu 8.04
Ubuntu 10.04
Ubuntu 9.10
Ubuntu 6.06
Ubuntu 9.04
Product(s): apache2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13440
 
Oval ID: oval:org.mitre.oval:def:13440
Title: USN-927-4 -- nss vulnerability
Description: USN-927-1 fixed vulnerabilities in nss in Ubuntu 9.10. This update provides the corresponding updates for Ubuntu 8.04 LTS. Original advisory details: Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3 protocols. If an attacker could perform a man in the middle attack at the start of a TLS connection, the attacker could inject arbitrary content at the beginning of the user�s session. This update adds support for the new new renegotiation extension and will use it when the server supports it.
Family: unix Class: patch
Reference(s): USN-927-4
CVE-2009-3555
Version: 5
Platform(s): Ubuntu 8.04
Product(s): nss
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13424
 
Oval ID: oval:org.mitre.oval:def:13424
Title: USN-990-1 -- openssl vulnerability
Description: Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3 protocols. If an attacker could perform a man in the middle attack at the start of a TLS connection, the attacker could inject arbitrary content at the beginning of the user�s session. This update adds backported support for the new RFC5746 renegotiation extension and will use it when both the client and the server support it. ATTENTION: After applying this update, a patched server will allow both patched and unpatched clients to connect, but unpatched clients will not be able to renegotiate
Family: unix Class: patch
Reference(s): USN-990-1
CVE-2009-3555
Version: 5
Platform(s): Ubuntu 8.04
Ubuntu 10.04
Ubuntu 9.10
Ubuntu 6.06
Ubuntu 9.04
Product(s): openssl
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13085
 
Oval ID: oval:org.mitre.oval:def:13085
Title: USN-927-1 -- nss vulnerability
Description: Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3 protocols. If an attacker could perform a man in the middle attack at the start of a TLS connection, the attacker could inject arbitrary content at the beginning of the user�s session. This update adds support for the new new renegotiation extension and will use it when the server supports it.
Family: unix Class: patch
Reference(s): USN-927-1
CVE-2009-3555
Version: 5
Platform(s): Ubuntu 9.10
Product(s): nss
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11617
 
Oval ID: oval:org.mitre.oval:def:11617
Title: AIX OpenSSL session renegotiation vulnerability
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: vulnerability
Reference(s): CVE-2009-3555
Version: 3
Platform(s): IBM AIX 5.2
IBM AIX 5.3
IBM AIX 6.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11578
 
Oval ID: oval:org.mitre.oval:def:11578
Title: Security Vulnerability in the Transport Layer Security (TLS) and Secure Sockets Layer 3.0 (SSLv3) Protocols Involving Handshake Renegotiation Affects OpenSSL
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: vulnerability
Reference(s): CVE-2009-3555
Version: 3
Platform(s): Sun Solaris 10
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:10088
 
Oval ID: oval:org.mitre.oval:def:10088
Title: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: vulnerability
Reference(s): CVE-2009-3555
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23090
 
Oval ID: oval:org.mitre.oval:def:23090
Title: ELSA-2010:0164: openssl097a security update (Moderate)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: patch
Reference(s): ELSA-2010:0164-01
CVE-2009-3555
Version: 6
Platform(s): Oracle Linux 5
Product(s): openssl097a
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23000
 
Oval ID: oval:org.mitre.oval:def:23000
Title: ELSA-2010:0166: gnutls security update (Moderate)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: patch
Reference(s): ELSA-2010:0166-01
CVE-2009-2409
CVE-2009-3555
Version: 13
Platform(s): Oracle Linux 5
Product(s): gnutls
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22993
 
Oval ID: oval:org.mitre.oval:def:22993
Title: ELSA-2010:0165: nss security update (Moderate)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: patch
Reference(s): ELSA-2010:0165-01
CVE-2009-3555
Version: 6
Platform(s): Oracle Linux 5
Product(s): nspr
nss
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22913
 
Oval ID: oval:org.mitre.oval:def:22913
Title: ELSA-2010:0155: java-1.4.2-ibm security and bug fix update (Moderate)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: patch
Reference(s): ELSA-2010:0155-01
CVE-2009-3555
Version: 6
Platform(s): Oracle Linux 5
Product(s): java-1.4.2-ibm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22820
 
Oval ID: oval:org.mitre.oval:def:22820
Title: ELSA-2009:1579: httpd security update (Moderate)
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: unix Class: patch
Reference(s): ELSA-2009:1579-02
CVE-2009-3094
CVE-2009-3095
CVE-2009-3555
Version: 17
Platform(s): Oracle Linux 5
Product(s): httpd
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25097
 
Oval ID: oval:org.mitre.oval:def:25097
Title: Vulnerability in OpenSSL before 0.9.8i, allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL
Description: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Family: windows Class: vulnerability
Reference(s): CVE-2009-3555
Version: 4
Platform(s): Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows 8
Microsoft Windows 8.1
Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2
Product(s): OpenSSL
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28269
 
Oval ID: oval:org.mitre.oval:def:28269
Title: ELSA-2010-0339 -- java-1.6.0-openjdk security update (important)
Description: [1:1.6.0.0-1.11.b16.0.1.el5] - Add oracle-enterprise.patch [1:1.6.0.0-1.11.b16.el5] - Remove javaws alternative due to conflict with java-1.6.0-sun's alternatives [1:1.6.0-1.10.b16] - Update to openjdk build b16 - Update to icedtea6-1.6 - Added tzdata-java requirement - Added autoconf and automake build requirement - Added tzdata-java requirement - Added java-1.6.0-openjdk-gcc-stack-markings.patch - Added java-1.6.0-openjdk-memory-barriers.patch - Added java-1.6.0-openjdk-jar-misc.patch - Added java-1.6.0-openjdk-linux-separate-debuginfo.patch - Added java-1.6.0-openjdk-securitypatches-20100323.patch - Added STRIP_KEEP_SYMTAB=libjvm* to install section, fix bz530402 - Resolves: rhbz#576124 [1:1.6.0-1.8.b09] - Added java-1.6.0-openjdk-debuginfo.patch - Added java-1.6.0-openjdk-elf-debuginfo.patch
Family: unix Class: patch
Reference(s): ELSA-2010-0339
CVE-2010-0082
CVE-2010-0084
CVE-2010-0085
CVE-2010-0088
CVE-2010-0091
CVE-2010-0092
CVE-2010-0093
CVE-2010-0094
CVE-2010-0095
CVE-2010-0837
CVE-2010-0838
CVE-2010-0840
CVE-2010-0845
CVE-2010-0847
CVE-2010-0848
CVE-2009-3555
Version: 2
Platform(s): Oracle Linux 5
Product(s): java-1.6.0-openjdk
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28188
 
Oval ID: oval:org.mitre.oval:def:28188
Title: ELSA-2010-0768 -- java-1.6.0-openjdk security and bug fix update (important)
Description: [1.6.0.0-1.16.b17.0.1.el5] - Add oracle-enterprise.patch [1.6.0.0-1.16.b17.el5] - Updated 1.7.5 tarball (contains additional security fixes) - Resolves: bz639951 [1.6.0.0-1.15.b17.el5] - Rebuild - Resolves: bz639951 [1.6.0.0-1.14.b17.el5] - Synched with el6 branch - Updated to IcedTea 1.7.5 - Resolves: bz639951 - Also resolves 619800 and 621303
Family: unix Class: patch
Reference(s): ELSA-2010-0768
CVE-2010-3541
CVE-2010-3548
CVE-2010-3549
CVE-2010-3551
CVE-2010-3553
CVE-2010-3554
CVE-2010-3557
CVE-2010-3561
CVE-2010-3562
CVE-2010-3564
CVE-2010-3565
CVE-2010-3567
CVE-2010-3568
CVE-2010-3569
CVE-2010-3573
CVE-2010-3574
CVE-2009-3555
Version: 2
Platform(s): Oracle Linux 5
Product(s): java-1.6.0-openjdk
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27881
 
Oval ID: oval:org.mitre.oval:def:27881
Title: ELSA-2010-0166 -- gnutls security update (moderate)
Description: [1.4.1-3.8] - fix safe renegotiation on SSL3 protocol [1.4.1-3.7] - implement safe renegotiation - CVE-2009-3555 (#533125) - do not allow MD2 in certificate signatures by default - CVE-2009-2409 (#510197)
Family: unix Class: patch
Reference(s): ELSA-2010-0166
CVE-2009-2409
CVE-2009-3555
Version: 2
Platform(s): Oracle Linux 5
Product(s): gnutls
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27748
 
Oval ID: oval:org.mitre.oval:def:27748
Title: ELSA-2010-0162 -- openssl security update (important)
Description: [0.9.8e-12.6] - fix CVE-2009-3245 - add missing bn_wexpand return checks (#570924) [0.9.8e-12.5] - fix CVE-2010-0433 - do not pass NULL princ to krb5_kt_get_entry which in the RHEL-5 and newer versions will crash in such case (#569774) [0.9.8e-12.4] - do not disable SSLv2 in the renegotiation patch - SSLv2 does not support renegotiation - allow unsafe renegotiation on clients with SSL_OP_LEGACY_SERVER_CONNECT [0.9.8e-12.3] - mention the RFC5746 in the CVE-2009-3555 doc [0.9.8e-12.2] - fix CVE-2009-3555 - support the safe renegotiation extension and do not allow legacy renegotiation on the server by default (#533125)
Family: unix Class: patch
Reference(s): ELSA-2010-0162
CVE-2010-0433
CVE-2009-3245
CVE-2009-3555
Version: 2
Platform(s): Oracle Linux 5
Product(s): openssl
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27295
 
Oval ID: oval:org.mitre.oval:def:27295
Title: ELSA-2010-0164 -- openssl097a security update (moderate)
Description: [0.9.7a-9.2] - CVE-2009-3555 - support the secure renegotiation RFC (#533125)
Family: unix Class: patch
Reference(s): ELSA-2010-0164
CVE-2009-3555
Version: 2
Platform(s): Oracle Linux 5
Product(s): openssl097a
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application1
Application152
Application121
Application1
Application30
Application61

ExploitDB Exploits

idDescription
2009-12-21TLS Renegotiation Vulnerability PoC Exploit

OpenVAS Exploits

DateDescription
2012-08-10Name : Gentoo Security Advisory GLSA 201206-18 (GnuTLS)
File : nvt/glsa_201206_18.nasl
2012-04-30Name : Gentoo Security Advisory GLSA 201203-22 (nginx)
File : nvt/glsa_201203_22.nasl
2012-03-16Name : VMSA-2011-0003.2 Third party component updates for VMware vCenter Server, vCe...
File : nvt/gb_VMSA-2011-0003.nasl
2012-02-12Name : Gentoo Security Advisory GLSA 201110-05 (gnutls)
File : nvt/glsa_201110_05.nasl
2011-08-09Name : CentOS Update for httpd CESA-2009:1579 centos3 i386
File : nvt/gb_CESA-2009_1579_httpd_centos3_i386.nasl
2011-08-09Name : CentOS Update for httpd CESA-2009:1579 centos5 i386
File : nvt/gb_CESA-2009_1579_httpd_centos5_i386.nasl
2011-08-09Name : CentOS Update for httpd CESA-2009:1580 centos4 i386
File : nvt/gb_CESA-2009_1580_httpd_centos4_i386.nasl
2011-08-09Name : CentOS Update for openssl CESA-2010:0162 centos5 i386
File : nvt/gb_CESA-2010_0162_openssl_centos5_i386.nasl
2011-08-09Name : CentOS Update for openssl097a CESA-2010:0164 centos5 i386
File : nvt/gb_CESA-2010_0164_openssl097a_centos5_i386.nasl
2011-08-09Name : CentOS Update for nspr CESA-2010:0165 centos5 i386
File : nvt/gb_CESA-2010_0165_nspr_centos5_i386.nasl
2011-08-09Name : CentOS Update for gnutls CESA-2010:0166 centos5 i386
File : nvt/gb_CESA-2010_0166_gnutls_centos5_i386.nasl
2011-08-09Name : CentOS Update for java CESA-2010:0339 centos5 i386
File : nvt/gb_CESA-2010_0339_java_centos5_i386.nasl
2011-08-09Name : CentOS Update for httpd CESA-2009:1075 centos5 i386
File : nvt/gb_CESA-2009_1075_httpd_centos5_i386.nasl
2011-08-09Name : CentOS Update for httpd CESA-2009:1148 centos5 i386
File : nvt/gb_CESA-2009_1148_httpd_centos5_i386.nasl
2011-08-09Name : CentOS Update for httpd CESA-2009:1205 centos3 i386
File : nvt/gb_CESA-2009_1205_httpd_centos3_i386.nasl
2011-08-09Name : CentOS Update for java CESA-2010:0768 centos5 i386
File : nvt/gb_CESA-2010_0768_java_centos5_i386.nasl
2011-03-09Name : Gentoo Security Advisory GLSA 201006-18 (sun-jre-bin sun-jdk emul-linux-x86-j...
File : nvt/glsa_201006_18.nasl
2011-03-07Name : Debian Security Advisory DSA 2161-2 (openjdk-6)
File : nvt/deb_2161_2.nasl
2011-01-04Name : HP-UX Update for Java HPSBUX02608
File : nvt/gb_hp_ux_HPSBUX02608.nasl
2011-01-04Name : HP-UX Update for Apache-based Web Server HPSBUX02612
File : nvt/gb_hp_ux_HPSBUX02612.nasl
2010-12-02Name : Fedora Update for java-1.6.0-openjdk FEDORA-2010-16312
File : nvt/gb_fedora_2010_16312_java-1.6.0-openjdk_fc14.nasl
2010-11-23Name : Fedora Update for openssl FEDORA-2010-17826
File : nvt/gb_fedora_2010_17826_openssl_fc12.nasl
2010-11-16Name : Fedora Update for nss FEDORA-2010-15989
File : nvt/gb_fedora_2010_15989_nss_fc12.nasl
2010-11-16Name : Fedora Update for proftpd FEDORA-2010-17220
File : nvt/gb_fedora_2010_17220_proftpd_fc12.nasl
2010-11-04Name : Ubuntu Update for openjdk-6, openjdk-6b18 vulnerabilities USN-1010-1
File : nvt/gb_ubuntu_USN_1010_1.nasl
2010-10-22Name : Fedora Update for java-1.6.0-openjdk FEDORA-2010-16240
File : nvt/gb_fedora_2010_16240_java-1.6.0-openjdk_fc12.nasl
2010-10-22Name : Fedora Update for java-1.6.0-openjdk FEDORA-2010-16294
File : nvt/gb_fedora_2010_16294_java-1.6.0-openjdk_fc13.nasl
2010-10-19Name : RedHat Update for java-1.6.0-openjdk RHSA-2010:0768-01
File : nvt/gb_RHSA-2010_0768-01_java-1.6.0-openjdk.nasl
2010-09-27Name : Ubuntu Update for openssl vulnerability USN-990-1
File : nvt/gb_ubuntu_USN_990_1.nasl
2010-09-27Name : Ubuntu Update for apache2 vulnerability USN-990-2
File : nvt/gb_ubuntu_USN_990_2.nasl
2010-08-11Name : Remote Code Execution Vulnerabilities in SChannel (980436)
File : nvt/secpod_ms10-049.nasl
2010-07-26Name : Ubuntu Update for nss vulnerability USN-927-6
File : nvt/gb_ubuntu_USN_927_6.nasl
2010-07-02Name : Ubuntu Update for nss vulnerability USN-927-4
File : nvt/gb_ubuntu_USN_927_4.nasl
2010-07-02Name : Ubuntu Update for nspr update USN-927-5
File : nvt/gb_ubuntu_USN_927_5.nasl
2010-06-28Name : Fedora Update for gnutls FEDORA-2010-9487
File : nvt/gb_fedora_2010_9487_gnutls_fc12.nasl
2010-06-25Name : Fedora Update for openssl FEDORA-2010-9421
File : nvt/gb_fedora_2010_9421_openssl_fc11.nasl
2010-06-25Name : Fedora Update for gnutls FEDORA-2010-9518
File : nvt/gb_fedora_2010_9518_gnutls_fc13.nasl
2010-06-18Name : Fedora Update for openssl FEDORA-2010-9639
File : nvt/gb_fedora_2010_9639_openssl_fc12.nasl
2010-06-07Name : Fedora Update for httpd FEDORA-2010-6055
File : nvt/gb_fedora_2010_6055_httpd_fc12.nasl
2010-06-07Name : HP-UX Update for Java HPSBUX02524
File : nvt/gb_hp_ux_HPSBUX02524.nasl
2010-06-07Name : HP-UX Update for Apache-based Web Server HPSBUX02531
File : nvt/gb_hp_ux_HPSBUX02531.nasl
2010-05-28Name : Java for Mac OS X 10.5 Update 7
File : nvt/macosx_java_for_10_5_upd_7.nasl
2010-05-28Name : Java for Mac OS X 10.6 Update 2
File : nvt/macosx_java_for_10_6_upd_2.nasl
2010-05-28Name : Fedora Update for openssl FEDORA-2010-8742
File : nvt/gb_fedora_2010_8742_openssl_fc12.nasl
2010-05-12Name : Mac OS X Security Update 2008-007
File : nvt/macosx_secupd_2008-007.nasl
2010-05-12Name : Mac OS X 10.5.7 Update / Mac OS X Security Update 2009-002
File : nvt/macosx_upd_10_5_7_secupd_2009-002.nasl
2010-05-12Name : Mac OS X 10.6.2 Update / Mac OS X Security Update 2009-006
File : nvt/macosx_upd_10_6_2_secupd_2009-006.nasl
2010-05-12Name : Mac OS X 10.6.3 Update / Mac OS X Security Update 2010-002
File : nvt/macosx_upd_10_6_3_secupd_2010-002.nasl
2010-05-07Name : Fedora Update for httpd FEDORA-2010-6131
File : nvt/gb_fedora_2010_6131_httpd_fc11.nasl
2010-04-30Name : HP-UX Update for OpenSSL HPSBUX02517
File : nvt/gb_hp_ux_HPSBUX02517.nasl
2010-04-30Name : Mandriva Update for java-1.6.0-openjdk MDVSA-2010:084 (java-1.6.0-openjdk)
File : nvt/gb_mandriva_MDVSA_2010_084.nasl
2010-04-29Name : Mandriva Update for firefox MDVSA-2010:070-1 (firefox)
File : nvt/gb_mandriva_MDVSA_2010_070_1.nasl
2010-04-29Name : Mandriva Update for openssl MDVSA-2010:076-1 (openssl)
File : nvt/gb_mandriva_MDVSA_2010_076_1.nasl
2010-04-29Name : SuSE Update for MozillaFirefox,MozillaThunderbird,seamonkey,mozilla-nss SUSE-...
File : nvt/gb_suse_2010_021.nasl
2010-04-19Name : Mandriva Update for openssl MDVSA-2010:076 (openssl)
File : nvt/gb_mandriva_MDVSA_2010_076.nasl
2010-04-19Name : Fedora Update for openssl FEDORA-2010-5357
File : nvt/gb_fedora_2010_5357_openssl_fc11.nasl
2010-04-16Name : Mandriva Update for firefox MDVSA-2010:070 (firefox)
File : nvt/gb_mandriva_MDVSA_2010_070.nasl
2010-04-16Name : Ubuntu Update for nss vulnerability USN-927-1
File : nvt/gb_ubuntu_USN_927_1.nasl
2010-04-09Name : Fedora Update for java-1.6.0-openjdk FEDORA-2010-6025
File : nvt/gb_fedora_2010_6025_java-1.6.0-openjdk_fc12.nasl
2010-04-09Name : Fedora Update for java-1.6.0-openjdk FEDORA-2010-6039
File : nvt/gb_fedora_2010_6039_java-1.6.0-openjdk_fc11.nasl
2010-04-09Name : Mandriva Update for nss MDVSA-2010:069 (nss)
File : nvt/gb_mandriva_MDVSA_2010_069.nasl
2010-04-09Name : Ubuntu Update for openjdk-6 vulnerabilities USN-923-1
File : nvt/gb_ubuntu_USN_923_1.nasl
2010-04-07Name : Oracle Java SE Multiple Vulnerabilities (Linux)
File : nvt/gb_oracle_java_se_mult_vuln_lin_apr10.nasl
2010-04-07Name : Oracle Java SE Multiple Vulnerabilities (Windows)
File : nvt/gb_oracle_java_se_mult_vuln_win_apr10.nasl
2010-04-06Name : Mac OS X Security Update 2010-001
File : nvt/macosx_secupd_2010-001.nasl
2010-04-06Name : FreeBSD Ports: seamonkey
File : nvt/freebsd_seamonkey0.nasl
2010-04-06Name : RedHat Update for java-1.6.0-openjdk RHSA-2010:0339-01
File : nvt/gb_RHSA-2010_0339-01_java-1.6.0-openjdk.nasl
2010-03-31Name : CentOS Update for openssl CESA-2010:0163 centos3 i386
File : nvt/gb_CESA-2010_0163_openssl_centos3_i386.nasl
2010-03-31Name : CentOS Update for openssl CESA-2010:0163 centos4 i386
File : nvt/gb_CESA-2010_0163_openssl_centos4_i386.nasl
2010-03-31Name : CentOS Update for nspr CESA-2010:0165 centos4 i386
File : nvt/gb_CESA-2010_0165_nspr_centos4_i386.nasl
2010-03-31Name : CentOS Update for gnutls CESA-2010:0167 centos4 i386
File : nvt/gb_CESA-2010_0167_gnutls_centos4_i386.nasl
2010-03-31Name : Fedora Update for nss FEDORA-2010-3905
File : nvt/gb_fedora_2010_3905_nss_fc11.nasl
2010-03-31Name : RedHat Update for openssl RHSA-2010:0162-01
File : nvt/gb_RHSA-2010_0162-01_openssl.nasl
2010-03-31Name : RedHat Update for openssl RHSA-2010:0163-01
File : nvt/gb_RHSA-2010_0163-01_openssl.nasl
2010-03-31Name : RedHat Update for openssl097a RHSA-2010:0164-01
File : nvt/gb_RHSA-2010_0164-01_openssl097a.nasl
2010-03-31Name : RedHat Update for nss RHSA-2010:0165-01
File : nvt/gb_RHSA-2010_0165-01_nss.nasl
2010-03-31Name : RedHat Update for gnutls RHSA-2010:0166-01
File : nvt/gb_RHSA-2010_0166-01_gnutls.nasl
2010-03-31Name : RedHat Update for gnutls RHSA-2010:0167-01
File : nvt/gb_RHSA-2010_0167-01_gnutls.nasl
2010-03-12Name : Mandriva Update for cacti MDVA-2010:089 (cacti)
File : nvt/gb_mandriva_MDVA_2010_089.nasl
2010-03-02Name : Fedora Update for nss FEDORA-2010-1127
File : nvt/gb_fedora_2010_1127_nss_fc12.nasl
2010-03-02Name : Mandriva Update for rsh MDVA-2010:076 (rsh)
File : nvt/gb_mandriva_MDVA_2010_076.nasl
2010-03-02Name : Mandriva Update for x11-driver-video-ati MDVA-2010:084 (x11-driver-video-ati)
File : nvt/gb_mandriva_MDVA_2010_084.nasl
2010-03-02Name : Fedora Update for httpd FEDORA-2009-12747
File : nvt/gb_fedora_2009_12747_httpd_fc11.nasl
2010-02-19Name : Mandriva Update for mandriva-release MDVA-2010:069 (mandriva-release)
File : nvt/gb_mandriva_MDVA_2010_069.nasl
2010-02-11Name : Microsoft Windows TLS/SSL Spoofing Vulnerability (977377)
File : nvt/gb_ms_tls_ssl_spoofing_vuln.nasl
2010-01-22Name : Mandriva Update for openssl MDVSA-2010:022 (openssl)
File : nvt/gb_mandriva_MDVSA_2010_022.nasl
2009-12-30Name : Fedora Core 12 FEDORA-2009-12229 (tomcat-native)
File : nvt/fcore_2009_12229.nasl
2009-12-30Name : Fedora Core 11 FEDORA-2009-12305 (tomcat-native)
File : nvt/fcore_2009_12305.nasl
2009-12-30Name : Fedora Core 12 FEDORA-2009-12606 (httpd)
File : nvt/fcore_2009_12606.nasl
2009-12-30Name : Fedora Core 11 FEDORA-2009-13236 (proftpd)
File : nvt/fcore_2009_13236.nasl
2009-12-30Name : Fedora Core 12 FEDORA-2009-13250 (proftpd)
File : nvt/fcore_2009_13250.nasl
2009-12-14Name : Fedora Core 10 FEDORA-2009-12604 (httpd)
File : nvt/fcore_2009_12604.nasl
2009-12-14Name : Gentoo Security Advisory GLSA 200912-01 (openssl)
File : nvt/glsa_200912_01.nasl
2009-12-14Name : Fedora Core 12 FEDORA-2009-12968 (nss-util)
File : nvt/fcore_2009_12968.nasl
2009-12-10Name : Mandriva Security Advisory MDVSA-2009:323 (apache)
File : nvt/mdksa_2009_323.nasl
2009-12-10Name : FreeBSD Security Advisory (FreeBSD-SA-09:15.ssl.asc)
File : nvt/freebsdsa_ssl.nasl
2009-12-10Name : Fedora Core 12 FEDORA-2009-12750 (nginx)
File : nvt/fcore_2009_12750.nasl
2009-12-10Name : Fedora Core 10 FEDORA-2009-12775 (nginx)
File : nvt/fcore_2009_12775.nasl
2009-12-10Name : Fedora Core 11 FEDORA-2009-12782 (nginx)
File : nvt/fcore_2009_12782.nasl
2009-11-23Name : SuSE Security Advisory SUSE-SA:2009:057 (openssl)
File : nvt/suse_sa_2009_057.nasl
2009-11-23Name : SLES9: Security update for OpenSSL
File : nvt/sles9p5062661.nasl
2009-11-17Name : SLES10: Security update for OpenSSL
File : nvt/sles10_compat-openssl02.nasl
2009-11-17Name : CentOS Security Advisory CESA-2009:1579 (httpd)
File : nvt/ovcesa2009_1579.nasl
2009-11-17Name : CentOS Security Advisory CESA-2009:1580 (httpd)
File : nvt/ovcesa2009_1580.nasl
2009-11-17Name : SLES11: Security update for libopenssl
File : nvt/sles11_libopenssl0_9_82.nasl
2009-11-17Name : Mac OS X Version
File : nvt/macosx_version.nasl
2009-11-17Name : RedHat Security Advisory RHSA-2009:1579
File : nvt/RHSA_2009_1579.nasl
2009-11-17Name : RedHat Security Advisory RHSA-2009:1580
File : nvt/RHSA_2009_1580.nasl
2009-11-17Name : SLES10: Security update for OpenSSL
File : nvt/sles10_openssl3.nasl
2009-10-27Name : SLES10: Security update for Apache 2
File : nvt/sles10_apache21.nasl
2009-10-27Name : SLES11: Security update for Apache 2
File : nvt/sles11_apache2.nasl
2009-10-27Name : SuSE Security Advisory SUSE-SA:2009:050 (apache2,libapr1)
File : nvt/suse_sa_2009_050.nasl
2009-10-27Name : SLES9: Security update for Apache 2
File : nvt/sles9p5060942.nasl
2009-10-22Name : HP-UX Update for Apache-based Web Server HPSBUX02465
File : nvt/gb_hp_ux_HPSBUX02465.nasl
2009-10-13Name : SLES10: Security update for Apache 2
File : nvt/sles10_apache20.nasl
2009-10-10Name : SLES9: Security update for Apache 2
File : nvt/sles9p5037600.nasl
2009-09-28Name : RedHat Security Advisory RHSA-2009:1461
File : nvt/RHSA_2009_1461.nasl
2009-09-28Name : Mandrake Security Advisory MDVSA-2009:240 (apache)
File : nvt/mdksa_2009_240.nasl
2009-09-16Name : Apache 'mod_proxy_ftp' Module Command Injection Vulnerability (Linux)
File : nvt/secpod_apache_mod_proxy_ftp_cmd_inj_vuln.nasl
2009-09-16Name : Apache 'mod_proxy_ftp' Module Denial Of Service Vulnerability (Linux)
File : nvt/secpod_apache_mod_proxy_ftp_dos_vuln.nasl
2009-09-02Name : Fedora Core 11 FEDORA-2009-8812 (httpd)
File : nvt/fcore_2009_8812.nasl
2009-09-02Name : Ubuntu USN-802-2 (apache2)
File : nvt/ubuntu_802_2.nasl
2009-09-02Name : FreeBSD Ports: apache
File : nvt/freebsd_apache15.nasl
2009-08-17Name : CentOS Security Advisory CESA-2009:1205 (httpd)
File : nvt/ovcesa2009_1205.nasl
2009-08-17Name : Debian Security Advisory DSA 1834-2 (apache2)
File : nvt/deb_1834_2.nasl
2009-08-17Name : RedHat Security Advisory RHSA-2009:1205
File : nvt/RHSA_2009_1205.nasl
2009-08-17Name : Mandrake Security Advisory MDVSA-2009:168 (apache)
File : nvt/mdksa_2009_168.nasl
2009-07-29Name : RedHat Security Advisory RHSA-2009:1148
File : nvt/RHSA_2009_1148.nasl
2009-07-29Name : RedHat Security Advisory RHSA-2009:1156
File : nvt/RHSA_2009_1156.nasl
2009-07-29Name : Debian Security Advisory DSA 1834-1 (apache2)
File : nvt/deb_1834_1.nasl
2009-07-29Name : Gentoo Security Advisory GLSA 200907-04 (apache)
File : nvt/glsa_200907_04.nasl
2009-07-29Name : Mandrake Security Advisory MDVSA-2009:149 (apache)
File : nvt/mdksa_2009_149.nasl
2009-07-29Name : Ubuntu USN-799-1 (dbus)
File : nvt/ubuntu_799_1.nasl
2009-07-29Name : Ubuntu USN-801-1 (tiff)
File : nvt/ubuntu_801_1.nasl
2009-07-29Name : Ubuntu USN-802-1 (apache2)
File : nvt/ubuntu_802_1.nasl
2009-07-29Name : CentOS Security Advisory CESA-2009:1148 (httpd)
File : nvt/ovcesa2009_1148.nasl
2009-07-15Name : Mandrake Security Advisory MDVSA-2009:124-1 (apache)
File : nvt/mdksa_2009_124_1.nasl
2009-07-15Name : Apache 'mod_deflate' Denial Of Service Vulnerability - July09
File : nvt/gb_apache_mod_deflate_dos_vuln_jul09.nasl
2009-07-07Name : Apache 'mod_proxy_http.c' Denial Of Service Vulnerability
File : nvt/gb_apache_mod_proxy_dos_vuln.nasl
2009-06-23Name : Debian Security Advisory DSA 1816-1 (apache2)
File : nvt/deb_1816_1.nasl
2009-06-15Name : Ubuntu USN-787-1 (apache2)
File : nvt/ubuntu_787_1.nasl
2009-06-05Name : Ubuntu USN-719-1 (libpam-krb5)
File : nvt/ubuntu_719_1.nasl
2009-06-05Name : Ubuntu USN-720-1 (php5)
File : nvt/ubuntu_720_1.nasl
2009-06-05Name : Mandrake Security Advisory MDVSA-2009:102 (apache)
File : nvt/mdksa_2009_102.nasl
2009-06-05Name : RedHat Security Advisory RHSA-2009:1075
File : nvt/RHSA_2009_1075.nasl
2009-06-05Name : Mandrake Security Advisory MDVSA-2009:124 (apache)
File : nvt/mdksa_2009_124.nasl
2009-06-05Name : CentOS Security Advisory CESA-2009:1075 (httpd)
File : nvt/ovcesa2009_1075.nasl
2009-06-03Name : Solaris Update for Apache 2 120543-14
File : nvt/gb_solaris_120543_14.nasl
2009-06-03Name : Solaris Update for Apache 2 120544-14
File : nvt/gb_solaris_120544_14.nasl
2009-05-28Name : Apache 'Options' and 'AllowOverride' Directives Security Bypass Vulnerability
File : nvt/apache_CVE_2009_1195.nasl
2009-05-05Name : HP-UX Update for Apache Web Server Suite HPSBUX02401
File : nvt/gb_hp_ux_HPSBUX02401.nasl
2009-04-30Name : Apache mod_proxy_ajp Information Disclosure Vulnerability
File : nvt/secpod_apache_mod_proxy_ajp_info_disc_vuln.nasl
2009-04-09Name : Mandriva Update for apache MDVSA-2008:195 (apache)
File : nvt/gb_mandriva_MDVSA_2008_195.nasl
2009-03-13Name : Ubuntu USN-731-1 (apache2)
File : nvt/ubuntu_731_1.nasl
2009-03-13Name : FreeBSD Ports: apache
File : nvt/freebsd_apache14.nasl
2009-03-06Name : RedHat Update for httpd RHSA-2008:0967-01
File : nvt/gb_RHSA-2008_0967-01_httpd.nasl
2009-02-27Name : CentOS Update for httpd CESA-2008:0967 centos3 i386
File : nvt/gb_CESA-2008_0967_httpd_centos3_i386.nasl
2009-02-27Name : CentOS Update for httpd CESA-2008:0967 centos3 x86_64
File : nvt/gb_CESA-2008_0967_httpd_centos3_x86_64.nasl
2009-02-27Name : CentOS Update for httpd CESA-2008:0967 centos4 i386
File : nvt/gb_CESA-2008_0967_httpd_centos4_i386.nasl
2009-02-27Name : CentOS Update for httpd CESA-2008:0967 centos4 x86_64
File : nvt/gb_CESA-2008_0967_httpd_centos4_x86_64.nasl
2009-02-17Name : Fedora Update for httpd FEDORA-2008-6393
File : nvt/gb_fedora_2008_6393_httpd_fc9.nasl
2008-09-24Name : Gentoo Security Advisory GLSA 200807-06 (apache)
File : nvt/glsa_200807_06.nasl
2008-08-22Name : Apache mod_proxy_ftp Wildcard Characters XSS Vulnerability
File : nvt/secpod_apache_mod_proxy_ftp_xss_vuln_900107.nasl
0000-00-00Name : Slackware Advisory SSA:2009-214-01 httpd
File : nvt/esoft_slk_ssa_2009_214_01.nasl
0000-00-00Name : Slackware Advisory SSA:2009-320-01 openssl
File : nvt/esoft_slk_ssa_2009_320_01.nasl
0000-00-00Name : Slackware Advisory SSA:2010-024-01 httpd
File : nvt/esoft_slk_ssa_2010_024_01.nasl
0000-00-00Name : Slackware Advisory SSA:2010-060-02 openssl
File : nvt/esoft_slk_ssa_2010_060_02.nasl
0000-00-00Name : Slackware Advisory SSA:2010-067-01 httpd
File : nvt/esoft_slk_ssa_2010_067_01.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
77832Parallels Plesk Panel Billing System TLS Renegotiation Handshakes MiTM Plaint...
75622Blue Coat Director TLS Renegotiation Handshakes MiTM Plaintext Data Injection
74335Hitachi Web Server TLS Renegotiation Handshakes MiTM Plaintext Data Injection
71961Oracle Fusion Middleware Oracle WebLogic Server TLS Renegotiation Handshakes ...
71951Oracle Multiple Products Oracle Security Service TLS Renegotiation Handshakes...
70620mGuard TLS Renegotiation Handshakes MiTM Plaintext Data Injection
70055Oracle Supply Chain Transportation Management TLS Renegotiation Handshakes Mi...
69561IBM WebSphere MQ Internet Pass-Thru TLS Renegotiation Handshake MiTM Plaintex...
69032Oracle Java SE / Java for Business TLS Renegotiation Handshake MiTM Plaintext...
67029HP Threat Management Services zl Module TLS Renegotiation Handshakes MiTM Pla...
66315HP Insight Manager TLS Renegotiation Handshakes MiTM Plaintext Data Injection
65202OpenOffice.org (OOo) TLS Renegotiation Handshakes MiTM Plaintext Data Injection
64725HP System Management Homepage (SMH) TLS Renegotiation Handshakes MiTM Plainte...
64499ArubaOS HTTPS WebUI Admin Interface TLS Renegotiation Handshakes MiTM Plainte...
64040IBM DB2 TLS Renegotiation Handshakes MiTM Plaintext Data Injection
62877SSH Tectia Audit Player TLS Renegotiation Handshakes MiTM Plaintext Data Inje...
62536Blue Coat Products TLS Renegotiation Handshakes MiTM Plaintext Data Injection
62273Opera TLS Renegotiation Handshakes MiTM Plaintext Data Injection
62210Aruba Mobility Controller TLS Renegotiation Handshakes MiTM Plaintext Data In...
62135Network Security Services (NSS) TLS Renegotiation Handshakes MiTM Plaintext D...
62064IBM Java TLS Renegotiation Handshakes MiTM Plaintext Data Injection
61929IBM WebSphere Application Server TLS Renegotiation Handshakes MiTM Plaintext ...
61785Avaya Products Multiple Product TLS Renegotiation Handshakes MiTM Plaintext D...
61784Sun Java System Multiple Product TLS Renegotiation Handshakes MiTM Plaintext ...
61718IBM WebSphere DataPower TLS Renegotiation Handshakes MiTM Plaintext Data Inje...
61234IBM SDK for Java TLS Renegotiation Handshakes MiTM Plaintext Data Injection
60521Ingate Firewall/SIParator SSL / TLS Renegotiation Handshakes MiTM Plaintext D...
60366Cisco Multiple Devices TLS Renegotiation Handshakes MiTM Plaintext Data Injec...
59974MatrixSSL TLS Renegotiation Handshakes MiTM Plaintext Data Injection
59973Citrix Secure Gateway TLS Renegotiation Handshakes MiTM Plaintext Data Injection
59972GnuTLS TLS Renegotiation Handshakes MiTM Plaintext Data Injection
59971OpenSSL TLS Renegotiation Handshakes MiTM Plaintext Data Injection
59970Mozilla Network Security Services (NSS) SSL / TLS Renegotiation Handshakes Mi...
59969Apache HTTP Server mod_ssl SSL / TLS Renegotiation Handshakes MiTM Plaintext ...
59968Microsoft Multiple Products SSL / TLS Renegotiation Handshakes MiTM Plaintext...
57882Apache HTTP Server mod_proxy_ftp Authorization HTTP Header Arbitrary FTP Comm...
57851Apache HTTP Server mod_proxy_ftp EPSV Command NULL Dereference Remote DoS
55782Apache HTTP Server mod_deflate Module Aborted Connection DoS
55553Apache HTTP Server mod_proxy Module mod_proxy_http.c stream_reqbody_cl Functi...
54733Apache HTTP Server AllowOverride Directive .htaccess Options Bypass
53921Apache HTTP Server mod_proxy_ajp Cross Thread/Session Information Disclosure
47810OpenSSL libssl crypto/comp/c_zlib.c zlib_stateful_init Function Memory Exhaus...
47474Apache HTTP Server mod_proxy_ftp Directory Component Wildcard Character XSS

Information Assurance Vulnerability Management (IAVM)

DateDescription
2012-05-03IAVM : 2012-B-0048 - Multiple Vulnerabilities in HP Systems Insight Manager
Severity : Category I - VMSKEY : V0032178
2012-04-05IAVM : 2012-B-0038 - Multiple Vulnerabilities in HP Onboard Administrator
Severity : Category I - VMSKEY : V0031972
2011-05-12IAVM : 2011-A-0066 - Multiple Vulnerabilities in VMware Products
Severity : Category I - VMSKEY : V0027158

Snort® IPS/IDS

DateDescription
2014-01-10Multiple Products IFRAME src javascript code execution
RuleID : 3679 - Revision : 12 - Type : INDICATOR-OBFUSCATION

Nessus® Vulnerability Scanner

DateDescription
2014-11-26Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2014-0007.nasl - Type : ACT_GATHER_INFO
2014-11-26Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2014-0008.nasl - Type : ACT_GATHER_INFO
2014-10-10Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL10737.nasl - Type : ACT_GATHER_INFO
2014-06-30Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201406-32.nasl - Type : ACT_GATHER_INFO
2014-06-13Name : The remote openSUSE host is missing a security update.
File : suse_11_3_compat-openssl097g-110721.nasl - Type : ACT_GATHER_INFO
2014-06-13Name : The remote openSUSE host is missing a security update.
File : suse_11_3_gnutls-101025.nasl - Type : ACT_GATHER_INFO
2014-06-13Name : The remote openSUSE host is missing a security update.
File : suse_11_3_gnutls-101206.nasl - Type : ACT_GATHER_INFO
2014-06-13Name : The remote openSUSE host is missing a security update.
File : suse_11_3_java-1_6_0-openjdk-101103.nasl - Type : ACT_GATHER_INFO
2014-06-13Name : The remote openSUSE host is missing a security update.
File : suse_11_4_compat-openssl097g-110721.nasl - Type : ACT_GATHER_INFO
2014-06-13Name : The remote openSUSE host is missing a security update.
File : suse_11_3_java-1_6_0-sun-101019.nasl - Type : ACT_GATHER_INFO
2014-04-16Name : The remote AIX host is running a vulnerable version of OpenSSL.
File : aix_ssl_advisory.nasl - Type : ACT_GATHER_INFO
2013-11-21Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201311-13.nasl - Type : ACT_GATHER_INFO
2013-09-25Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201309-15.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2009-1579.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2009-1580.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2008-0967.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0162.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0163.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2010-0164.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0165.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0166.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0167.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0333.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0339.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0768.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2009-1075.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2009-1148.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2009-1205.nasl - Type : ACT_GATHER_INFO
2013-06-29Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2009-1580.nasl - Type : ACT_GATHER_INFO
2013-06-28Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2009-1579.nasl - Type : ACT_GATHER_INFO
2013-02-22Name : The remote Unix host contains a runtime environment that is affected by multi...
File : oracle_java_cpu_mar_2010_unix.nasl - Type : ACT_GATHER_INFO
2013-02-22Name : The remote Unix host contains a programming platform that is affected by mult...
File : oracle_java_cpu_oct_2010_unix.nasl - Type : ACT_GATHER_INFO
2013-02-18Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2626.nasl - Type : ACT_GATHER_INFO
2013-01-24Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2011-0880.nasl - Type : ACT_GATHER_INFO
2013-01-08Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201301-01.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20081111_httpd_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100325_gnutls_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100325_nss_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing a security update.
File : sl_20100325_openssl097a_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100325_openssl_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100325_openssl_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100331_java_1_6_0_openjdk_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100331_java__jdk_1_6_0__on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20090527_httpd_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20090709_httpd_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20101013_java_1_6_0_openjdk_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20101014_java__jdk_1_6_0__on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20090810_httpd_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20101110_java_1_6_0_openjdk_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20091111_httpd_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2012-06-25Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201206-18.nasl - Type : ACT_GATHER_INFO
2012-06-21Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201203-22.nasl - Type : ACT_GATHER_INFO
2012-06-15Name : The remote Windows host contains software that is affected by multiple vulner...
File : hp_systems_insight_manager_700_multiple_vulns.nasl - Type : ACT_GATHER_INFO
2012-05-17Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_4_2-ibm-7036.nasl - Type : ACT_GATHER_INFO
2011-12-13Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_compat-openssl097g-7645.nasl - Type : ACT_GATHER_INFO
2011-10-12Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201110-05.nasl - Type : ACT_GATHER_INFO
2011-07-28Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_compat-openssl097g-110721.nasl - Type : ACT_GATHER_INFO
2011-07-28Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_compat-openssl097g-7644.nasl - Type : ACT_GATHER_INFO
2011-05-13Name : The remote database server is affected by multiple vulnerabilities.
File : oracle_rdbms_cpu_apr_2011.nasl - Type : ACT_GATHER_INFO
2011-05-05Name : The remote openSUSE host is missing a security update.
File : suse_11_2_gnutls-101025.nasl - Type : ACT_GATHER_INFO
2011-05-05Name : The remote openSUSE host is missing a security update.
File : suse_11_2_gnutls-101206.nasl - Type : ACT_GATHER_INFO
2011-05-05Name : The remote openSUSE host is missing a security update.
File : suse_11_2_java-1_6_0-openjdk-101103.nasl - Type : ACT_GATHER_INFO
2011-05-05Name : The remote openSUSE host is missing a security update.
File : suse_11_1_gnutls-101025.nasl - Type : ACT_GATHER_INFO
2011-05-05Name : The remote openSUSE host is missing a security update.
File : suse_11_1_gnutls-101206.nasl - Type : ACT_GATHER_INFO
2011-05-05Name : The remote openSUSE host is missing a security update.
File : suse_11_1_java-1_6_0-openjdk-101103.nasl - Type : ACT_GATHER_INFO
2011-05-02Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12705.nasl - Type : ACT_GATHER_INFO
2011-03-17Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_mozilla-xulrunner190-100407.nasl - Type : ACT_GATHER_INFO
2011-03-17Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_MozillaFirefox-100407.nasl - Type : ACT_GATHER_INFO
2011-02-14Name : The remote VMware ESXi / ESX host is missing one or more security-related pat...
File : vmware_VMSA-2011-0003.nasl - Type : ACT_GATHER_INFO
2011-01-27Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_6_0-sun-7204.nasl - Type : ACT_GATHER_INFO
2011-01-27Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_gnutls-7299.nasl - Type : ACT_GATHER_INFO
2011-01-25Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_java-1_6_0-ibm-101220.nasl - Type : ACT_GATHER_INFO
2011-01-21Name : The remote SuSE 11 host is missing a security update.
File : suse_11_java-1_4_2-ibm-100510.nasl - Type : ACT_GATHER_INFO
2011-01-21Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_java-1_4_2-ibm-101112.nasl - Type : ACT_GATHER_INFO
2011-01-10Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2141.nasl - Type : ACT_GATHER_INFO
2010-12-17Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12658.nasl - Type : ACT_GATHER_INFO
2010-12-16Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_gnutls-101206.nasl - Type : ACT_GATHER_INFO
2010-12-16Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0987.nasl - Type : ACT_GATHER_INFO
2010-12-08Name : The remote VMware ESX host is missing one or more security-related patches.
File : vmware_VMSA-2010-0019.nasl - Type : ACT_GATHER_INFO
2010-12-02Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_libfreebl3-100406.nasl - Type : ACT_GATHER_INFO
2010-12-02Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_libopenssl-devel-100331.nasl - Type : ACT_GATHER_INFO
2010-12-02Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_java-1_6_0-sun-100331.nasl - Type : ACT_GATHER_INFO
2010-12-02Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_java-1_6_0-sun-101019.nasl - Type : ACT_GATHER_INFO
2010-12-02Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_mozilla-xulrunner190-100406.nasl - Type : ACT_GATHER_INFO
2010-12-02Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_MozillaFirefox-100406.nasl - Type : ACT_GATHER_INFO
2010-12-02Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_5_0-ibm-7205.nasl - Type : ACT_GATHER_INFO
2010-12-01Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12659.nasl - Type : ACT_GATHER_INFO
2010-11-18Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0865.nasl - Type : ACT_GATHER_INFO
2010-10-29Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1010-1.nasl - Type : ACT_GATHER_INFO
2010-10-28Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0807.nasl - Type : ACT_GATHER_INFO
2010-10-22Name : The remote openSUSE host is missing a security update.
File : suse_11_2_java-1_6_0-sun-101019.nasl - Type : ACT_GATHER_INFO
2010-10-22Name : The remote openSUSE host is missing a security update.
File : suse_11_1_java-1_6_0-sun-101019.nasl - Type : ACT_GATHER_INFO
2010-10-22Name : The remote Fedora host is missing a security update.
File : fedora_2010-16240.nasl - Type : ACT_GATHER_INFO
2010-10-21Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0786.nasl - Type : ACT_GATHER_INFO
2010-10-20Name : The remote web server may be affected by several issues.
File : apache_2_0_64.nasl - Type : ACT_GATHER_INFO
2010-10-20Name : The remote web server is affected by multiple vulnerabilities
File : apache_2_2_15.nasl - Type : ACT_GATHER_INFO
2010-10-20Name : The remote host has a version of Java that is affected by multiple vulnerabil...
File : macosx_java_10_5_update8.nasl - Type : ACT_GATHER_INFO
2010-10-20Name : The remote host has a version of Java that is affected by multiple vulnerabil...
File : macosx_java_10_6_update3.nasl - Type : ACT_GATHER_INFO
2010-10-20Name : The remote Fedora host is missing a security update.
File : fedora_2010-16294.nasl - Type : ACT_GATHER_INFO
2010-10-18Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0768.nasl - Type : ACT_GATHER_INFO
2010-10-18Name : The remote Fedora host is missing a security update.
File : fedora_2010-16312.nasl - Type : ACT_GATHER_INFO
2010-10-15Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0770.nasl - Type : ACT_GATHER_INFO
2010-10-15Name : The remote Windows host contains a programming platform that is affected by m...
File : oracle_java_cpu_oct_2010.nasl - Type : ACT_GATHER_INFO
2010-10-14Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0768.nasl - Type : ACT_GATHER_INFO
2010-10-11Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_openssl-6655.nasl - Type : ACT_GATHER_INFO
2010-10-11Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_openssl-6944.nasl - Type : ACT_GATHER_INFO
2010-10-11Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_compat-openssl097g-6657.nasl - Type : ACT_GATHER_INFO
2010-10-11Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_apache2-6572.nasl - Type : ACT_GATHER_INFO
2010-10-11Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_mozilla-nss-6978.nasl - Type : ACT_GATHER_INFO
2010-10-11Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_5_0-ibm-7077.nasl - Type : ACT_GATHER_INFO
2010-10-11Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_mozilla-xulrunner190-6971.nasl - Type : ACT_GATHER_INFO
2010-10-11Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_MozillaFirefox-6979.nasl - Type : ACT_GATHER_INFO
2010-10-04Name : The remote VMware ESX host is missing one or more security-related patches.
File : vmware_VMSA-2010-0015.nasl - Type : ACT_GATHER_INFO
2010-09-22Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-990-1.nasl - Type : ACT_GATHER_INFO
2010-09-22Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-990-2.nasl - Type : ACT_GATHER_INFO
2010-09-17Name : The remote web server is affected by multiple vulnerabilities.
File : hpsmh_6_2_0_12.nasl - Type : ACT_GATHER_INFO
2010-09-07Name : The remote database server is affected by multiple issues.
File : db2_95fp6.nasl - Type : ACT_GATHER_INFO
2010-08-11Name : It may be possible to execute arbitrary code on the remote Windows host using...
File : smb_nt_ms10-049.nasl - Type : ACT_GATHER_INFO
2010-07-30Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-102.nasl - Type : ACT_GATHER_INFO
2010-07-26Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-927-6.nasl - Type : ACT_GATHER_INFO
2010-07-07Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12623.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-5942.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-6025.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-6039.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-6131.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-6279.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2009-12747.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-8742.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-9487.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-9518.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-3905.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-3929.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-3956.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-1127.nasl - Type : ACT_GATHER_INFO
2010-07-01Name : The remote Fedora host is missing a security update.
File : fedora_2010-5357.nasl - Type : ACT_GATHER_INFO
2010-06-30Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-927-4.nasl - Type : ACT_GATHER_INFO
2010-06-14Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0339.nasl - Type : ACT_GATHER_INFO
2010-06-11Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12621.nasl - Type : ACT_GATHER_INFO
2010-06-07Name : The remote Windows host has an application installed that is affected by mult...
File : openoffice_321.nasl - Type : ACT_GATHER_INFO
2010-06-04Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201006-18.nasl - Type : ACT_GATHER_INFO
2010-06-01Name : The remote database server is affected by multiple issues.
File : db2_97fp2.nasl - Type : ACT_GATHER_INFO
2010-05-19Name : The remote web server has multiple vulnerabilities.
File : hpsmh_6_1_0_102.nasl - Type : ACT_GATHER_INFO
2010-05-19Name : The remote host has a version of Java that is affected by multiple vulnerabil...
File : macosx_java_10_5_update7.nasl - Type : ACT_GATHER_INFO
2010-05-19Name : The remote host has a version of Java that is affected by multiple vulnerabil...
File : macosx_java_10_6_update2.nasl - Type : ACT_GATHER_INFO
2010-05-11Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0155.nasl - Type : ACT_GATHER_INFO
2010-05-11Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0162.nasl - Type : ACT_GATHER_INFO
2010-05-11Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0163.nasl - Type : ACT_GATHER_INFO
2010-05-11Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2010-0164.nasl - Type : ACT_GATHER_INFO
2010-05-11Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0165.nasl - Type : ACT_GATHER_INFO
2010-05-11Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0166.nasl - Type : ACT_GATHER_INFO
2010-05-11Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0167.nasl - Type : ACT_GATHER_INFO
2010-05-11Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0333.nasl - Type : ACT_GATHER_INFO
2010-05-11Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0337.nasl - Type : ACT_GATHER_INFO
2010-05-11Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2010-0338.nasl - Type : ACT_GATHER_INFO
2010-05-11Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0339.nasl - Type : ACT_GATHER_INFO
2010-04-30Name : The remote openSUSE host is missing a security update.
File : suse_11_2_java-1_6_0-openjdk-100412.nasl - Type : ACT_GATHER_INFO
2010-04-30Name : The remote openSUSE host is missing a security update.
File : suse_11_1_java-1_6_0-openjdk-100428.nasl - Type : ACT_GATHER_INFO
2010-04-30Name : The remote openSUSE host is missing a security update.
File : suse_11_0_java-1_6_0-openjdk-100428.nasl - Type : ACT_GATHER_INFO
2010-04-29Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2010-084.nasl - Type : ACT_GATHER_INFO
2010-04-28Name : The remote database server is affected by multiple issues.
File : db2_9fp9.nasl - Type : ACT_GATHER_INFO
2010-04-19Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2010-076.nasl - Type : ACT_GATHER_INFO
2010-04-14Name : The remote openSUSE host is missing a security update.
File : suse_11_1_mozilla-xulrunner190-100407.nasl - Type : ACT_GATHER_INFO
2010-04-14Name : The remote openSUSE host is missing a security update.
File : suse_11_0_mozilla-xulrunner190-100407.nasl - Type : ACT_GATHER_INFO
2010-04-14Name : The remote openSUSE host is missing a security update.
File : suse_11_1_firefox35upgrade-100407.nasl - Type : ACT_GATHER_INFO
2010-04-14Name : The remote openSUSE host is missing a security update.
File : suse_11_0_firefox35upgrade-100407.nasl - Type : ACT_GATHER_INFO
2010-04-14Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2010-070.nasl - Type : ACT_GATHER_INFO
2010-04-14Name : The remote openSUSE host is missing a security update.
File : suse_11_2_MozillaFirefox-100412.nasl - Type : ACT_GATHER_INFO
2010-04-14Name : The remote openSUSE host is missing a security update.
File : suse_11_1_MozillaFirefox-branding-openSUSE-100413.nasl - Type : ACT_GATHER_INFO
2010-04-13Name : The remote openSUSE host is missing a security update.
File : suse_11_2_libfreebl3-100406.nasl - Type : ACT_GATHER_INFO
2010-04-13Name : The remote openSUSE host is missing a security update.
File : suse_11_2_MozillaThunderbird-100406.nasl - Type : ACT_GATHER_INFO
2010-04-13Name : The remote openSUSE host is missing a security update.
File : suse_11_2_seamonkey-100406.nasl - Type : ACT_GATHER_INFO
2010-04-13Name : The remote openSUSE host is missing a security update.
File : suse_11_1_libfreebl3-100407.nasl - Type : ACT_GATHER_INFO
2010-04-13Name : The remote openSUSE host is missing a security update.
File : suse_11_0_libfreebl3-100407.nasl - Type : ACT_GATHER_INFO
2010-04-13Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_mozilla-nspr-6977.nasl - Type : ACT_GATHER_INFO
2010-04-13Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_mozilla-xulrunner190-6976.nasl - Type : ACT_GATHER_INFO
2010-04-13Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_MozillaFirefox-6970.nasl - Type : ACT_GATHER_INFO
2010-04-12Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-927-1.nasl - Type : ACT_GATHER_INFO
2010-04-09Name : The remote openSUSE host is missing a security update.
File : suse_11_2_java-1_6_0-sun-100331.nasl - Type : ACT_GATHER_INFO
2010-04-09Name : The remote openSUSE host is missing a security update.
File : suse_11_2_libopenssl-devel-100401.nasl - Type : ACT_GATHER_INFO
2010-04-09Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0333.nasl - Type : ACT_GATHER_INFO
2010-04-09Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2010-069.nasl - Type : ACT_GATHER_INFO
2010-04-09Name : The remote openSUSE host is missing a security update.
File : suse_11_1_java-1_6_0-sun-100331.nasl - Type : ACT_GATHER_INFO
2010-04-09Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-923-1.nasl - Type : ACT_GATHER_INFO
2010-04-09Name : The remote openSUSE host is missing a security update.
File : suse_11_0_java-1_6_0-sun-100331.nasl - Type : ACT_GATHER_INFO
2010-04-09Name : The remote openSUSE host is missing a security update.
File : suse_11_1_libopenssl-devel-100331.nasl - Type : ACT_GATHER_INFO
2010-04-02Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12606.nasl - Type : ACT_GATHER_INFO
2010-03-31Name : The remote Windows host contains a web browser that is affected by multiple v...
File : mozilla_firefox_359.nasl - Type : ACT_GATHER_INFO
2010-03-31Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_openssl-6943.nasl - Type : ACT_GATHER_INFO
2010-03-31Name : The remote Windows host contains a mail client that is affected by multiple v...
File : mozilla_thunderbird_304.nasl - Type : ACT_GATHER_INFO
2010-03-31Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_9ccfee393c3b11df9edc000f20797ede.nasl - Type : ACT_GATHER_INFO
2010-03-31Name : The remote Windows host contains a web browser that is affected by multiple v...
File : seamonkey_204.nasl - Type : ACT_GATHER_INFO
2010-03-30Name : The remote Windows host contains a runtime environment that is affected by mu...
File : oracle_java_cpu_mar_2010.nasl - Type : ACT_GATHER_INFO
2010-03-29Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0162.nasl - Type : ACT_GATHER_INFO
2010-03-29Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2010-0164.nasl - Type : ACT_GATHER_INFO
2010-03-29Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0165.nasl - Type : ACT_GATHER_INFO
2010-03-29Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0166.nasl - Type : ACT_GATHER_INFO
2010-03-29Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0167.nasl - Type : ACT_GATHER_INFO
2010-03-29Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_10_6_3.nasl - Type : ACT_GATHER_INFO
2010-03-29Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_SecUpd2010-002.nasl - Type : ACT_GATHER_INFO
2010-03-26Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0163.nasl - Type : ACT_GATHER_INFO
2010-03-23Name : The remote Windows host contains a web browser that is affected by Multiple V...
File : mozilla_firefox_362.nasl - Type : ACT_GATHER_INFO
2010-03-11Name : The remote web server has multiple SSL-related vulnerabilities.
File : openssl_0_9_8m.nasl - Type : ACT_GATHER_INFO
2010-03-09Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2010-067-01.nasl - Type : ACT_GATHER_INFO
2010-03-04Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0130.nasl - Type : ACT_GATHER_INFO
2010-03-02Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2010-060-02.nasl - Type : ACT_GATHER_INFO
2010-03-02Name : The remote host contains a web browser that is affected by multiple issues.
File : opera_1050.nasl - Type : ACT_GATHER_INFO
2010-02-24Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1934.nasl - Type : ACT_GATHER_INFO
2010-02-24Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1834.nasl - Type : ACT_GATHER_INFO
2010-01-25Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2010-024-01.nasl - Type : ACT_GATHER_INFO
2010-01-21Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2010-022.nasl - Type : ACT_GATHER_INFO
2010-01-20Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_SecUpd2010-001.nasl - Type : ACT_GATHER_INFO
2010-01-06Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2009-1075.nasl - Type : ACT_GATHER_INFO
2010-01-06Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2009-1148.nasl - Type : ACT_GATHER_INFO
2009-12-28Name : The remote Fedora host is missing a security update.
File : fedora_2009-13236.nasl - Type : ACT_GATHER_INFO
2009-12-28Name : The remote Fedora host is missing a security update.
File : fedora_2009-13250.nasl - Type : ACT_GATHER_INFO
2009-12-27Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1694.nasl - Type : ACT_GATHER_INFO
2009-12-23Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-337.nasl - Type : ACT_GATHER_INFO
2009-12-18Name : The remote Fedora host is missing a security update.
File : fedora_2009-12229.nasl - Type : ACT_GATHER_INFO
2009-12-18Name : The remote Fedora host is missing a security update.
File : fedora_2009-12305.nasl - Type : ACT_GATHER_INFO
2009-12-18Name : The remote Fedora host is missing a security update.
File : fedora_2009-12606.nasl - Type : ACT_GATHER_INFO
2009-12-10Name : The remote Fedora host is missing a security update.
File : fedora_2009-12604.nasl - Type : ACT_GATHER_INFO
2009-12-10Name : The remote Fedora host is missing a security update.
File : fedora_2009-12968.nasl - Type : ACT_GATHER_INFO
2009-12-08Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-323.nasl - Type : ACT_GATHER_INFO
2009-12-08Name : The remote Fedora host is missing a security update.
File : fedora_2009-12750.nasl - Type : ACT_GATHER_INFO
2009-12-08Name : The remote Fedora host is missing a security update.
File : fedora_2009-12775.nasl - Type : ACT_GATHER_INFO
2009-12-08Name : The remote Fedora host is missing a security update.
File : fedora_2009-12782.nasl - Type : ACT_GATHER_INFO
2009-12-02Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200912-01.nasl - Type : ACT_GATHER_INFO
2009-11-24Name : The remote service allows insecure renegotiation of TLS / SSL connections.
File : ssl_renegotiation.nasl - Type : ACT_GATHER_INFO
2009-11-19Name : The remote openSUSE host is missing a security update.
File : suse_11_2_libopenssl-devel-091113.nasl - Type : ACT_GATHER_INFO
2009-11-19Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-860-1.nasl - Type : ACT_GATHER_INFO
2009-11-19Name : The remote openSUSE host is missing a security update.
File : suse_11_1_libopenssl-devel-091112.nasl - Type : ACT_GATHER_INFO
2009-11-19Name : The remote openSUSE host is missing a security update.
File : suse_11_0_libopenssl-devel-091112.nasl - Type : ACT_GATHER_INFO
2009-11-18Name : The remote openSUSE host is missing a security update.
File : suse_11_1_compat-openssl097g-091113.nasl - Type : ACT_GATHER_INFO
2009-11-18Name : The remote openSUSE host is missing a security update.
File : suse_11_0_compat-openssl097g-091113.nasl - Type : ACT_GATHER_INFO
2009-11-18Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12550.nasl - Type : ACT_GATHER_INFO
2009-11-18Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_openssl-6654.nasl - Type : ACT_GATHER_INFO
2009-11-18Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_compat-openssl097g-6656.nasl - Type : ACT_GATHER_INFO
2009-11-18Name : The remote openSUSE host is missing a security update.
File : suse_11_2_compat-openssl097g-091113.nasl - Type : ACT_GATHER_INFO
2009-11-17Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_libopenssl-devel-091112.nasl - Type : ACT_GATHER_INFO
2009-11-17Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2009-320-01.nasl - Type : ACT_GATHER_INFO
2009-11-17Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_compat-openssl097g-091113.nasl - Type : ACT_GATHER_INFO
2009-11-12Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1579.nasl - Type : ACT_GATHER_INFO
2009-11-12Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1580.nasl - Type : ACT_GATHER_INFO
2009-11-09Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-295.nasl - Type : ACT_GATHER_INFO
2009-11-09Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_10_6_2.nasl - Type : ACT_GATHER_INFO
2009-11-09Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_SecUpd2009-006.nasl - Type : ACT_GATHER_INFO
2009-10-30Name : The remote openSUSE host is missing a security update.
File : suse_apache2-6576.nasl - Type : ACT_GATHER_INFO
2009-10-26Name : The remote openSUSE host is missing a security update.
File : suse_11_0_apache2-091020.nasl - Type : ACT_GATHER_INFO
2009-10-26Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_apache2-091020.nasl - Type : ACT_GATHER_INFO
2009-10-26Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12526.nasl - Type : ACT_GATHER_INFO
2009-10-26Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_apache2-6571.nasl - Type : ACT_GATHER_INFO
2009-10-26Name : The remote openSUSE host is missing a security update.
File : suse_11_1_apache2-091020.nasl - Type : ACT_GATHER_INFO
2009-10-07Name : The remote web server is affected by multiple vulnerabilities.
File : apache_2_2_14.nasl - Type : ACT_GATHER_INFO
2009-09-24Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12258.nasl - Type : ACT_GATHER_INFO
2009-09-23Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-240.nasl - Type : ACT_GATHER_INFO
2009-09-02Name : The remote Fedora host is missing a security update.
File : fedora_2009-8812.nasl - Type : ACT_GATHER_INFO
2009-08-31Name : The remote application server is affected by multiple vulnerabilities.
File : websphere_7_0_0_5.nasl - Type : ACT_GATHER_INFO
2009-08-25Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_e15f2356913911de8f42001aa0166822.nasl - Type : ACT_GATHER_INFO
2009-08-20Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-802-2.nasl - Type : ACT_GATHER_INFO
2009-08-11Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1205.nasl - Type : ACT_GATHER_INFO
2009-08-11Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2009-1205.nasl - Type : ACT_GATHER_INFO
2009-08-03Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2009-214-01.nasl - Type : ACT_GATHER_INFO
2009-08-02Name : The remote web server may be affected by several issues.
File : apache_2_2_12.nasl - Type : ACT_GATHER_INFO
2009-07-21Name : The remote openSUSE host is missing a security update.
File : suse_11_0_apache2-080925.nasl - Type : ACT_GATHER_INFO
2009-07-14Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-802-1.nasl - Type : ACT_GATHER_INFO
2009-07-13Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200907-04.nasl - Type : ACT_GATHER_INFO
2009-07-10Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1148.nasl - Type : ACT_GATHER_INFO
2009-07-10Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-149.nasl - Type : ACT_GATHER_INFO
2009-06-18Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1816.nasl - Type : ACT_GATHER_INFO
2009-06-12Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-787-1.nasl - Type : ACT_GATHER_INFO
2009-06-01Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-124.nasl - Type : ACT_GATHER_INFO
2009-05-28Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1075.nasl - Type : ACT_GATHER_INFO
2009-05-13Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_10_5_7.nasl - Type : ACT_GATHER_INFO
2009-05-13Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_SecUpd2009-002.nasl - Type : ACT_GATHER_INFO
2009-04-23Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2008-0967.nasl - Type : ACT_GATHER_INFO
2009-04-23Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-731-1.nasl - Type : ACT_GATHER_INFO
2009-04-23Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2008-195.nasl - Type : ACT_GATHER_INFO
2009-03-12Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_f18920660e7411de92de000bcdc1757a.nasl - Type : ACT_GATHER_INFO
2009-01-19Name : The remote host is missing Sun Security Patch number 128640-30
File : solaris10_128640.nasl - Type : ACT_GATHER_INFO
2009-01-19Name : The remote host is missing Sun Security Patch number 128641-30
File : solaris10_x86_128641.nasl - Type : ACT_GATHER_INFO
2009-01-19Name : The remote host is missing Sun Security Patch number 128641-30
File : solaris9_x86_128641.nasl - Type : ACT_GATHER_INFO
2009-01-19Name : The remote host is missing Sun Security Patch number 128640-30
File : solaris9_128640.nasl - Type : ACT_GATHER_INFO
2008-11-16Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_apache2-5767.nasl - Type : ACT_GATHER_INFO
2008-11-12Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0967.nasl - Type : ACT_GATHER_INFO
2008-11-05Name : The remote openSUSE host is missing a security update.
File : suse_apache2-5628.nasl - Type : ACT_GATHER_INFO
2008-11-05Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_apache2-5629.nasl - Type : ACT_GATHER_INFO
2008-11-05Name : The remote openSUSE host is missing a security update.
File : suse_apache2-5648.nasl - Type : ACT_GATHER_INFO
2008-10-16Name : The remote web server is vulnerable to a cross-site scripting attack.
File : apache_mod_proxy_ftp_glob_xss.nasl - Type : ACT_ATTACK
2008-10-10Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_SecUpd2008-007.nasl - Type : ACT_GATHER_INFO
2008-08-08Name : The remote Fedora host is missing a security update.
File : fedora_2008-6393.nasl - Type : ACT_GATHER_INFO
2008-07-10Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200807-06.nasl - Type : ACT_GATHER_INFO
2007-10-12Name : The remote host is missing Sun Security Patch number 125437-22
File : solaris10_125437.nasl - Type : ACT_GATHER_INFO
2007-10-12Name : The remote host is missing Sun Security Patch number 125438-22
File : solaris10_x86_125438.nasl - Type : ACT_GATHER_INFO
2007-10-12Name : The remote host is missing Sun Security Patch number 125437-22
File : solaris8_125437.nasl - Type : ACT_GATHER_INFO
2007-10-12Name : The remote host is missing Sun Security Patch number 125438-22
File : solaris9_x86_125438.nasl - Type : ACT_GATHER_INFO
2007-10-12Name : The remote host is missing Sun Security Patch number 125437-22
File : solaris9_125437.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
DateInformations
2014-02-17 11:41:04
  • Multiple Updates