Executive Summary

Summary
Title gnupg security update
Informations
Name RHSA-2013:1458 First vendor Publication 2013-10-24
Vendor RedHat Last vendor Modification 2013-10-24
Severity (Vendor) Moderate Revision 01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:P)
Cvss Base Score 5.8 Attack Range Network
Cvss Impact Score 4.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

An updated gnupg package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64

3. Description:

The GNU Privacy Guard (GnuPG or GPG) is a tool for encrypting data and creating digital signatures, compliant with the proposed OpenPGP Internet standard and the S/MIME standard.

It was found that GnuPG was vulnerable to the Yarom/Falkner flush+reload cache side-channel attack on the RSA secret exponent. An attacker able to execute a process on the logical CPU that shared the L3 cache with the GnuPG process (such as a different local user or a user of a KVM guest running on the same host with the kernel same-page merging functionality enabled) could possibly use this flaw to obtain portions of the RSA secret key. (CVE-2013-4242)

A denial of service flaw was found in the way GnuPG parsed certain compressed OpenPGP packets. An attacker could use this flaw to send specially crafted input data to GnuPG, making GnuPG enter an infinite loop when parsing data. (CVE-2013-4402)

It was found that importing a corrupted public key into a GnuPG keyring database corrupted that keyring. An attacker could use this flaw to trick a local user into importing a specially crafted public key into their keyring database, causing the keyring to be corrupted and preventing its further use. (CVE-2012-6085)

It was found that GnuPG did not properly interpret the key flags in a PGP key packet. GPG could accept a key for uses not indicated by its holder. (CVE-2013-4351)

Red Hat would like to thank Werner Koch for reporting the CVE-2013-4402 issue. Upstream acknowledges Taylor R Campbell as the original reporter.

All gnupg users are advised to upgrade to this updated package, which contains backported patches to correct these issues.

4. Solution:

Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

5. Bugs fixed (http://bugzilla.redhat.com/):

891142 - CVE-2012-6085 GnuPG: read_block() corrupt key input validation 988589 - CVE-2013-4242 GnuPG susceptible to Yarom/Falkner flush+reload cache side-channel attack 1010137 - CVE-2013-4351 gnupg: treats no-usage-permitted keys as all-usages-permitted 1015685 - CVE-2013-4402 GnuPG: infinite recursion in the compressed packet parser DoS

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2013-1458.html

CWE : Common Weakness Enumeration

% Id Name
50 % CWE-20 Improper Input Validation
25 % CWE-310 Cryptographic Issues
25 % CWE-200 Information Exposure

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:17831
 
Oval ID: oval:org.mitre.oval:def:17831
Title: USN-1682-1 -- gnupg, gnupg2 vulnerability
Description: GnuPG could be made to corrupt the keyring if it imported a specially crafted key.
Family: unix Class: patch
Reference(s): USN-1682-1
CVE-2012-6085
Version: 7
Platform(s): Ubuntu 12.10
Ubuntu 12.04
Ubuntu 11.10
Ubuntu 10.04
Ubuntu 8.04
Product(s): gnupg
gnupg2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17876
 
Oval ID: oval:org.mitre.oval:def:17876
Title: USN-1923-1 -- gnupg, libgcrypt11 vulnerability
Description: GnuPG and Libgcrypt could be made to expose sensitive information.
Family: unix Class: patch
Reference(s): USN-1923-1
CVE-2013-4242
Version: 7
Platform(s): Ubuntu 13.04
Ubuntu 12.10
Ubuntu 12.04
Ubuntu 10.04
Product(s): gnupg
libgcrypt11
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18341
 
Oval ID: oval:org.mitre.oval:def:18341
Title: DSA-2601-1 gnupg - missing input sanitation
Description: KB Sriram discovered that GnuPG, the GNU Privacy Guard did not sufficiently sanitise public keys on import, which could lead to memory and keyring corruption.
Family: unix Class: patch
Reference(s): DSA-2601-1
CVE-2012-6085
Version: 7
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
Product(s): gnupg
gnupg2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18882
 
Oval ID: oval:org.mitre.oval:def:18882
Title: DSA-2730-1 gnupg - information leak
Description: Yarom and Falkner discovered that RSA secret keys could be leaked via a side channel attack, where a malicious local user could obtain private key information from another user on the system.
Family: unix Class: patch
Reference(s): DSA-2730-1
CVE-2013-4242
Version: 8
Platform(s): Debian GNU/Linux 6.0
Debian GNU/Linux 7
Debian GNU/kFreeBSD 6.0
Debian GNU/kFreeBSD 7
Product(s): gnupg
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18887
 
Oval ID: oval:org.mitre.oval:def:18887
Title: DSA-2731-1 libgcrypt11 - information leak
Description: Yarom and Falkner discovered that RSA secret keys in applications using the libgcrypt11 library, for example GnuPG 2.x, could be leaked via a side channel attack, where a malicious local user could obtain private key information from another user on the system.
Family: unix Class: patch
Reference(s): DSA-2731-1
CVE-2013-4242
Version: 8
Platform(s): Debian GNU/Linux 6.0
Debian GNU/Linux 7
Debian GNU/kFreeBSD 6.0
Debian GNU/kFreeBSD 7
Product(s): libgcrypt11
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:19160
 
Oval ID: oval:org.mitre.oval:def:19160
Title: USN-1987-1 -- gnupg, gnupg2 vulnerabilities
Description: Several security issues were fixed in GnuPG.
Family: unix Class: patch
Reference(s): USN-1987-1
CVE-2013-4351
CVE-2013-4402
Version: 5
Platform(s): Ubuntu 13.04
Ubuntu 12.10
Ubuntu 12.04
Ubuntu 10.04
Product(s): gnupg
gnupg2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:19904
 
Oval ID: oval:org.mitre.oval:def:19904
Title: DSA-2773-1 gnupg - several
Description: Two vulnerabilities were discovered in GnuPG, the GNU privacy guard, a free PGP replacement.
Family: unix Class: patch
Reference(s): DSA-2773-1
CVE-2013-4351
CVE-2013-4402
Version: 5
Platform(s): Debian GNU/Linux 6.0
Debian GNU/Linux 7
Debian GNU/kFreeBSD 6.0
Debian GNU/kFreeBSD 7
Product(s): gnupg
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20090
 
Oval ID: oval:org.mitre.oval:def:20090
Title: DSA-2774-1 gnupg2 - several
Description: Two vulnerabilities were discovered in GnuPG 2, the GNU privacy guard, a free PGP replacement.
Family: unix Class: patch
Reference(s): DSA-2774-1
CVE-2013-4351
CVE-2013-4402
Version: 5
Platform(s): Debian GNU/Linux 6.0
Debian GNU/Linux 7
Debian GNU/kFreeBSD 6.0
Debian GNU/kFreeBSD 7
Product(s): gnupg2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20690
 
Oval ID: oval:org.mitre.oval:def:20690
Title: RHSA-2013:1459: gnupg2 security update (Moderate)
Description: The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.
Family: unix Class: patch
Reference(s): RHSA-2013:1459-00
CESA-2013:1459
CVE-2012-6085
CVE-2013-4351
CVE-2013-4402
Version: 45
Platform(s): Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
CentOS Linux 5
CentOS Linux 6
Product(s): gnupg2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20833
 
Oval ID: oval:org.mitre.oval:def:20833
Title: RHSA-2013:1458: gnupg security update (Moderate)
Description: The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.
Family: unix Class: patch
Reference(s): RHSA-2013:1458-00
CESA-2013:1458
CVE-2012-6085
CVE-2013-4242
CVE-2013-4351
CVE-2013-4402
Version: 59
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Product(s): gnupg
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21277
 
Oval ID: oval:org.mitre.oval:def:21277
Title: RHSA-2013:1457: libgcrypt security update (Moderate)
Description: GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload.
Family: unix Class: patch
Reference(s): RHSA-2013:1457-00
CESA-2013:1457
CVE-2013-4242
Version: 4
Platform(s): Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
CentOS Linux 5
CentOS Linux 6
Product(s): libgcrypt
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23444
 
Oval ID: oval:org.mitre.oval:def:23444
Title: DEPRECATED: ELSA-2013:1457: libgcrypt security update (Moderate)
Description: GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload.
Family: unix Class: patch
Reference(s): ELSA-2013:1457-00
CVE-2013-4242
Version: 7
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): libgcrypt
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23451
 
Oval ID: oval:org.mitre.oval:def:23451
Title: ELSA-2013:1458: gnupg security update (Moderate)
Description: The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.
Family: unix Class: patch
Reference(s): ELSA-2013:1458-00
CVE-2012-6085
CVE-2013-4242
CVE-2013-4351
CVE-2013-4402
Version: 21
Platform(s): Oracle Linux 5
Product(s): gnupg
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23470
 
Oval ID: oval:org.mitre.oval:def:23470
Title: DEPRECATED: ELSA-2013:1459: gnupg2 security update (Moderate)
Description: The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.
Family: unix Class: patch
Reference(s): ELSA-2013:1459-00
CVE-2012-6085
CVE-2013-4351
CVE-2013-4402
Version: 18
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): gnupg2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23894
 
Oval ID: oval:org.mitre.oval:def:23894
Title: ELSA-2013:1459: gnupg2 security update (Moderate)
Description: The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.
Family: unix Class: patch
Reference(s): ELSA-2013:1459-00
CVE-2012-6085
CVE-2013-4351
CVE-2013-4402
Version: 17
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): gnupg2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24005
 
Oval ID: oval:org.mitre.oval:def:24005
Title: ELSA-2013:1457: libgcrypt security update (Moderate)
Description: GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload.
Family: unix Class: patch
Reference(s): ELSA-2013:1457-00
CVE-2013-4242
Version: 6
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): libgcrypt
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24793
 
Oval ID: oval:org.mitre.oval:def:24793
Title: SUSE-SU-2013:1578-1 -- Security update for gpg
Description: This GnuPG LTSS roll-up update fixes two security issues: * CVE-2013-4351: GnuPG treated no-usage-permitted keys as all-usages-permitted. * CVE-2013-4402: An infinite recursion in the compressed packet parser was fixed. * CVE-2013-4242: GnuPG allowed local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload. * CVE-2012-6085: The read_block function in g10/import.c in GnuPG 1.4.x, when importing a key, allowed remote attackers to corrupt the public keyring database or cause a denial of service (application crash) via a crafted length field of an OpenPGP packet.
Family: unix Class: patch
Reference(s): SUSE-SU-2013:1578-1
CVE-2013-4351
CVE-2013-4402
CVE-2013-4242
CVE-2012-6085
Version: 3
Platform(s): SUSE Linux Enterprise Server 10
Product(s): gpg
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25073
 
Oval ID: oval:org.mitre.oval:def:25073
Title: SUSE-SU-2013:1058-1 -- Security update for gpg2
Description: This update for gpg2 provides the following fixes: * Set proper file permissions when en/de-crypting files (bnc#780943) * Fix an issue that could cause corruption of the public keys database. (CVE-2012-6085, #798465) * Select proper ciphers when running in FIPS mode (bnc#808958) Security Issue reference * CVE-2012-6085 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6085 >
Family: unix Class: patch
Reference(s): SUSE-SU-2013:1058-1
CVE-2012-6085
Version: 3
Platform(s): SUSE Linux Enterprise Server 11
SUSE Linux Enterprise Desktop 11
Product(s): gpg2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25232
 
Oval ID: oval:org.mitre.oval:def:25232
Title: SUSE-SU-2013:1058-2 -- Security update for gpg2
Description: This update for gpg2 provides the following fixes: * #780943: Set proper file permissions when en/de-crypting files. * #798465: Fix an issue that could cause corruption of the public keys database. (CVE-2012-6085) * #808958: Select proper ciphers when running in FIPS mode. Security Issue reference: * CVE-2012-6085 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6085 >
Family: unix Class: patch
Reference(s): SUSE-SU-2013:1058-2
CVE-2012-6085
Version: 3
Platform(s): SUSE Linux Enterprise Server 11
SUSE Linux Enterprise Desktop 11
Product(s): gpg2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25288
 
Oval ID: oval:org.mitre.oval:def:25288
Title: SUSE-SU-2013:1576-1 -- Security update for gpg2
Description: This GnuPG update fixes two security issues: * CVE-2013-4351: GnuPG treated no-usage-permitted keys as all-usages-permitted. * CVE-2013-4402: An infinite recursion in the compressed packet parser was fixed.
Family: unix Class: patch
Reference(s): SUSE-SU-2013:1576-1
CVE-2013-4351
CVE-2013-4402
Version: 3
Platform(s): SUSE Linux Enterprise Server 11
SUSE Linux Enterprise Desktop 11
Product(s): gpg2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25331
 
Oval ID: oval:org.mitre.oval:def:25331
Title: SUSE-SU-2014:0704-1 -- Security update for libgcrypt
Description: libgcrypt has been updated to fix a cryptographic weakness. * CVE-2013-4242: libgcrypt was affected by the Yarom/Falkner flush+reload side-channel attach on RSA secret keys, that could have potentially leaked the key data to attackers on the same machine.
Family: unix Class: patch
Reference(s): SUSE-SU-2014:0704-1
CVE-2013-4242
Version: 3
Platform(s): SUSE Linux Enterprise Server 11
Product(s): libgcrypt
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25338
 
Oval ID: oval:org.mitre.oval:def:25338
Title: SUSE-SU-2014:0750-1 -- Security update for gpg2
Description: This is a SLES 11 SP1 LTSS rollup update for gpg2. The following security issues have been fixed: * CVE-2013-4402: The compressed packet parser in GnuPG allowed remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message. * CVE-2013-4351: GnuPG treated a key flags subpacket with all bits cleared (no usage permitted) as if it has all bits set (all usage permitted), which might have allowed remote attackers to bypass intended cryptographic protection mechanisms by leveraging the subkey. * CVE-2012-6085: The read_block function in g10/import.c in GnuPG, when importing a key, allowed remote attackers to corrupt the public keyring database or cause a denial of service (application crash) via a crafted length field of an OpenPGP packet. Also the following non-security bugs have been fixed: * set the umask before opening a file for writing (bnc#780943) * select proper ciphers when running in FIPS mode (bnc#808958) * add missing options to opts table (bnc#778723)
Family: unix Class: patch
Reference(s): SUSE-SU-2014:0750-1
CVE-2013-4402
CVE-2013-4351
CVE-2012-6085
Version: 3
Platform(s): SUSE Linux Enterprise Server 11
Product(s): gpg2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25485
 
Oval ID: oval:org.mitre.oval:def:25485
Title: SUSE-SU-2013:1352-1 -- Security update for libgcrypt
Description: This update of libgcrypt mitigates the Yarom/Falkner flush+reload side-channel attack on RSA secret keys (CVE-2013-4242). Security Issue reference: * CVE-2013-4242 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4242 >
Family: unix Class: patch
Reference(s): SUSE-SU-2013:1352-1
CVE-2013-4242
Version: 3
Platform(s): SUSE Linux Enterprise Server 11
SUSE Linux Enterprise Desktop 11
Product(s): libgcrypt
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25751
 
Oval ID: oval:org.mitre.oval:def:25751
Title: SUSE-SU-2013:1577-1 -- Security update for gpg
Description: This GnuPG LTSS roll-up update fixes two security issues: * CVE-2013-4351: GnuPG treated no-usage-permitted keys as all-usages-permitted. * CVE-2013-4402: An infinite recursion in the compressed packet parser was fixed. * CVE-2013-4242: GnuPG allowed local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload. * CVE-2012-6085: The read_block function in g10/import.c in GnuPG 1.4.x, when importing a key, allowed remote attackers to corrupt the public keyring database or cause a denial of service (application crash) via a crafted length field of an OpenPGP packet.
Family: unix Class: patch
Reference(s): SUSE-SU-2013:1577-1
CVE-2013-4351
CVE-2013-4402
CVE-2013-4242
CVE-2012-6085
Version: 3
Platform(s): SUSE Linux Enterprise Server 10
Product(s): gpg
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26022
 
Oval ID: oval:org.mitre.oval:def:26022
Title: SUSE-SU-2013:1061-1 -- Security update for gpg
Description: This update for gpg provides the following fixes: * Set proper file permissions when en/de-crypting files (bnc#780943) * Fix an issue that could cause corruption of the public keys database. (CVE-2012-6085, bnc#798465) Security Issue reference: * CVE-2012-6085 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6085 >
Family: unix Class: patch
Reference(s): SUSE-SU-2013:1061-1
CVE-2012-6085
Version: 3
Platform(s): SUSE Linux Enterprise Server 10
SUSE Linux Enterprise Desktop 10
Product(s): gpg
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26955
 
Oval ID: oval:org.mitre.oval:def:26955
Title: DEPRECATED: ELSA-2013-1458 -- gnupg security update (moderate)
Description: [1.4.5-18] - fix CVE-2013-4351 gpg treats no-usage-permitted keys as all-usages-permitted [1.4.5-17] - fix CVE-2012-6085 GnuPG: read_block() corrupt key input validation - fix CVE-2013-4242 GnuPG susceptible to Yarom/Falkner side-channel attack - fix CVE-2013-4402 GnuPG: infinite recursion in the compressed packet parser [1.4.5-15] - fix error when decrypting certain files (#510500)
Family: unix Class: patch
Reference(s): ELSA-2013-1458
CVE-2013-4242
CVE-2012-6085
CVE-2013-4351
CVE-2013-4402
Version: 4
Platform(s): Oracle Linux 5
Product(s): gnupg
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27177
 
Oval ID: oval:org.mitre.oval:def:27177
Title: DEPRECATED: ELSA-2013-1457 -- libgcrypt security update (moderate)
Description: [1.4.5-11] - fix CVE-2013-4242 GnuPG/libgcrypt susceptible to cache side-channel attack [1.4.5-10] - Add GCRYCTL_SET_ENFORCED_FIPS_FLAG command
Family: unix Class: patch
Reference(s): ELSA-2013-1457
CVE-2013-4242
Version: 4
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): libgcrypt
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27428
 
Oval ID: oval:org.mitre.oval:def:27428
Title: DEPRECATED: ELSA-2013-1459 -- gnupg2 security update (moderate)
Description: [2.0.14-6] - fix CVE-2013-4351 gpg treats no-usage-permitted keys as all-usages-permitted [2.0.14-5] - fix CVE-2012-6085 GnuPG: read_block() corrupt key input validation - fix CVE-2013-4402 GnuPG: infinite recursion in the compressed packet parser
Family: unix Class: patch
Reference(s): ELSA-2013-1459
CVE-2012-6085
CVE-2013-4351
CVE-2013-4402
Version: 4
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): gnupg2
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 96
Application 9
Os 4
Os 2
Os 2

Information Assurance Vulnerability Management (IAVM)

Date Description
2014-05-01 IAVM : 2014-A-0062 - Multiple Vulnerabilities In McAfee Email Gateway
Severity : Category I - VMSKEY : V0050005

Nessus® Vulnerability Scanner

Date Description
2016-06-22 Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2016-0062.nasl - Type : ACT_GATHER_INFO
2016-02-22 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL75253136.nasl - Type : ACT_GATHER_INFO
2016-02-22 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL50413110.nasl - Type : ACT_GATHER_INFO
2016-02-22 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL40131068.nasl - Type : ACT_GATHER_INFO
2016-02-22 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL11785283.nasl - Type : ACT_GATHER_INFO
2015-05-20 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2013-1061-1.nasl - Type : ACT_GATHER_INFO
2015-01-19 Name : The remote Solaris system is missing a security patch for third-party software.
File : solaris11_gnupg_20140731.nasl - Type : ACT_GATHER_INFO
2015-01-19 Name : The remote Solaris system is missing a security patch for third-party software.
File : solaris11_libgcrypt_20140512.nasl - Type : ACT_GATHER_INFO
2014-11-08 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2013-1527.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-736.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-455.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-716.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-758.nasl - Type : ACT_GATHER_INFO
2014-06-10 Name : The remote Fedora host is missing a security update.
File : fedora_2014-6851.nasl - Type : ACT_GATHER_INFO
2014-02-23 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201402-24.nasl - Type : ACT_GATHER_INFO
2013-11-14 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2013-237.nasl - Type : ACT_GATHER_INFO
2013-11-14 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2013-236.nasl - Type : ACT_GATHER_INFO
2013-11-13 Name : The remote Fedora host is missing a security update.
File : fedora_2013-18647.nasl - Type : ACT_GATHER_INFO
2013-10-27 Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2013-1458.nasl - Type : ACT_GATHER_INFO
2013-10-27 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2013-1457.nasl - Type : ACT_GATHER_INFO
2013-10-27 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2013-1459.nasl - Type : ACT_GATHER_INFO
2013-10-27 Name : The remote Fedora host is missing one or more security updates.
File : fedora_2013-18814.nasl - Type : ACT_GATHER_INFO
2013-10-25 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-1457.nasl - Type : ACT_GATHER_INFO
2013-10-25 Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2013-1458.nasl - Type : ACT_GATHER_INFO
2013-10-25 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-1459.nasl - Type : ACT_GATHER_INFO
2013-10-25 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1457.nasl - Type : ACT_GATHER_INFO
2013-10-25 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1458.nasl - Type : ACT_GATHER_INFO
2013-10-25 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1459.nasl - Type : ACT_GATHER_INFO
2013-10-25 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20131024_gnupg2_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2013-10-25 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20131024_gnupg_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2013-10-25 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20131024_libgcrypt_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2013-10-25 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_gpg2-131008.nasl - Type : ACT_GATHER_INFO
2013-10-15 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2013-287-01.nasl - Type : ACT_GATHER_INFO
2013-10-15 Name : The remote Fedora host is missing a security update.
File : fedora_2013-18866.nasl - Type : ACT_GATHER_INFO
2013-10-15 Name : The remote Fedora host is missing a security update.
File : fedora_2013-18807.nasl - Type : ACT_GATHER_INFO
2013-10-15 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2013-287-02.nasl - Type : ACT_GATHER_INFO
2013-10-13 Name : The remote Fedora host is missing a security update.
File : fedora_2013-18676.nasl - Type : ACT_GATHER_INFO
2013-10-11 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2013-247.nasl - Type : ACT_GATHER_INFO
2013-10-11 Name : The remote Fedora host is missing a security update.
File : fedora_2013-18543.nasl - Type : ACT_GATHER_INFO
2013-10-11 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2773.nasl - Type : ACT_GATHER_INFO
2013-10-11 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2774.nasl - Type : ACT_GATHER_INFO
2013-10-10 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1987-1.nasl - Type : ACT_GATHER_INFO
2013-10-06 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_749b55872da111e3b1a9b499baab0cbe.nasl - Type : ACT_GATHER_INFO
2013-10-01 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2013-225.nasl - Type : ACT_GATHER_INFO
2013-10-01 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2013-226.nasl - Type : ACT_GATHER_INFO
2013-08-20 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_689c2bf7070111e39a25002590860428.nasl - Type : ACT_GATHER_INFO
2013-08-16 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_libgcrypt-130813.nasl - Type : ACT_GATHER_INFO
2013-08-15 Name : The remote Fedora host is missing a security update.
File : fedora_2013-13940.nasl - Type : ACT_GATHER_INFO
2013-08-10 Name : The remote Fedora host is missing a security update.
File : fedora_2013-13975.nasl - Type : ACT_GATHER_INFO
2013-08-05 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2013-215-01.nasl - Type : ACT_GATHER_INFO
2013-08-02 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2013-205.nasl - Type : ACT_GATHER_INFO
2013-08-02 Name : The remote Fedora host is missing a security update.
File : fedora_2013-13678.nasl - Type : ACT_GATHER_INFO
2013-08-02 Name : The remote Fedora host is missing a security update.
File : fedora_2013-13671.nasl - Type : ACT_GATHER_INFO
2013-08-01 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1923-1.nasl - Type : ACT_GATHER_INFO
2013-07-30 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2731.nasl - Type : ACT_GATHER_INFO
2013-07-30 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2730.nasl - Type : ACT_GATHER_INFO
2013-07-18 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_gpg2-130613.nasl - Type : ACT_GATHER_INFO
2013-07-18 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_gpg2-130612.nasl - Type : ACT_GATHER_INFO
2013-06-21 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_gpg2-8576.nasl - Type : ACT_GATHER_INFO
2013-06-21 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_gpg-8575.nasl - Type : ACT_GATHER_INFO
2013-06-21 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_gpg2-130516.nasl - Type : ACT_GATHER_INFO
2013-01-21 Name : The remote Fedora host is missing a security update.
File : fedora_2013-0477.nasl - Type : ACT_GATHER_INFO
2013-01-21 Name : The remote Fedora host is missing a security update.
File : fedora_2013-0459.nasl - Type : ACT_GATHER_INFO
2013-01-21 Name : The remote Fedora host is missing a security update.
File : fedora_2013-0222.nasl - Type : ACT_GATHER_INFO
2013-01-14 Name : The remote Fedora host is missing a security update.
File : fedora_2013-0258.nasl - Type : ACT_GATHER_INFO
2013-01-10 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1682-1.nasl - Type : ACT_GATHER_INFO
2013-01-10 Name : The remote Fedora host is missing a security update.
File : fedora_2013-0148.nasl - Type : ACT_GATHER_INFO
2013-01-10 Name : The remote Fedora host is missing a security update.
File : fedora_2013-0377.nasl - Type : ACT_GATHER_INFO
2013-01-07 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2601.nasl - Type : ACT_GATHER_INFO
2013-01-03 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2013-001.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
Date Informations
2017-08-29 09:26:29
  • Multiple Updates
2016-12-08 09:25:45
  • Multiple Updates
2016-09-09 09:24:46
  • Multiple Updates
2016-06-28 20:10:20
  • Multiple Updates
2016-04-27 02:25:11
  • Multiple Updates
2014-02-17 11:57:31
  • Multiple Updates
2014-01-03 21:24:15
  • Multiple Updates
2013-12-31 13:22:51
  • Multiple Updates
2013-12-04 21:23:23
  • Multiple Updates
2013-12-04 17:23:04
  • Multiple Updates
2013-11-06 21:34:26
  • Multiple Updates
2013-10-31 13:25:31
  • Multiple Updates
2013-10-29 13:21:55
  • Multiple Updates
2013-10-24 21:21:44
  • First insertion