Executive Summary

Summary
Titleopenssl security and bug fix update
Informations
NameRHSA-2015:0716First vendor Publication2015-03-23
VendorRedHatLast vendor Modification2015-03-23
Severity (Vendor) ModerateRevision01

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score7.5Attack RangeNetwork
Cvss Impact Score6.4Attack ComplexityLow
Cvss Expoit Score10AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated openssl packages that fix several security issues and one bug are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

3. Description:

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library.

An invalid pointer use flaw was found in OpenSSL's ASN1_TYPE_cmp() function. A remote attacker could crash a TLS/SSL client or server using OpenSSL via a specially crafted X.509 certificate when the attacker-supplied certificate was verified by the application. (CVE-2015-0286)

An integer underflow flaw, leading to a buffer overflow, was found in the way OpenSSL decoded malformed Base64-encoded inputs. An attacker able to make an application using OpenSSL decode a specially crafted Base64-encoded input (such as a PEM file) could use this flaw to cause the application to crash. Note: this flaw is not exploitable via the TLS/SSL protocol because the data being transferred is not Base64-encoded. (CVE-2015-0292)

A denial of service flaw was found in the way OpenSSL handled SSLv2 handshake messages. A remote attacker could use this flaw to cause a TLS/SSL server using OpenSSL to exit on a failed assertion if it had both the SSLv2 protocol and EXPORT-grade cipher suites enabled. (CVE-2015-0293)

A use-after-free flaw was found in the way OpenSSL imported malformed Elliptic Curve private keys. A specially crafted key file could cause an application using OpenSSL to crash when imported. (CVE-2015-0209)

An out-of-bounds write flaw was found in the way OpenSSL reused certain ASN.1 structures. A remote attacker could possibly use a specially crafted ASN.1 structure that, when parsed by an application, would cause that application to crash. (CVE-2015-0287)

A NULL pointer dereference flaw was found in OpenSSL's X.509 certificate handling implementation. A specially crafted X.509 certificate could cause an application using OpenSSL to crash if the application attempted to convert the certificate to a certificate request. (CVE-2015-0288)

A NULL pointer dereference was found in the way OpenSSL handled certain PKCS#7 inputs. An attacker able to make an application using OpenSSL verify, decrypt, or parse a specially crafted PKCS#7 input could cause that application to crash. TLS/SSL clients and servers using OpenSSL were not affected by this flaw. (CVE-2015-0289)

Red Hat would like to thank the OpenSSL project for reporting CVE-2015-0286, CVE-2015-0287, CVE-2015-0288, CVE-2015-0289, CVE-2015-0292, and CVE-2015-0293. Upstream acknowledges Stephen Henson of the OpenSSL development team as the original reporter of CVE-2015-0286, Emilia Käsper of the OpenSSL development team as the original reporter of CVE-2015-0287, Brian Carpenter as the original reporter of CVE-2015-0288, Michal Zalewski of Google as the original reporter of CVE-2015-0289, Robert Dugal and David Ramos as the original reporters of CVE-2015-0292, and Sean Burford of Google and Emilia Käsper of the OpenSSL development team as the original reporters of CVE-2015-0293.

This update also fixes the following bug:

* When a wrapped Advanced Encryption Standard (AES) key did not require any padding, it was incorrectly padded with 8 bytes, which could lead to data corruption and interoperability problems. With this update, the rounding algorithm in the RFC 5649 key wrapping implementation has been fixed. As a result, the wrapped key conforms to the specification, which prevents the described problems. (BZ#1197667)

All openssl users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.

4. Solution:

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1196737 - CVE-2015-0209 openssl: use-after-free on invalid EC private key import 1202366 - CVE-2015-0286 openssl: invalid pointer use in ASN1_TYPE_cmp() 1202380 - CVE-2015-0287 openssl: ASN.1 structure reuse memory corruption 1202384 - CVE-2015-0289 openssl: PKCS7 NULL pointer dereference 1202395 - CVE-2015-0292 openssl: integer underflow leading to buffer overflow in base64 decoding 1202404 - CVE-2015-0293 openssl: assertion failure in SSLv2 servers 1202418 - CVE-2015-0288 openssl: X509_to_X509_REQ NULL pointer dereference

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2015-0716.html

CWE : Common Weakness Enumeration

%idName
50 %CWE-17Code
25 %CWE-119Failure to Constrain Operations within the Bounds of a Memory Buffer
25 %CWE-20Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:28833
 
Oval ID: oval:org.mitre.oval:def:28833
Title: AIX OpenSSL Denial of Service (invalid read operation and application crash)
Description: The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature.
Family: unix Class: vulnerability
Reference(s): CVE-2015-0286
Version: 4
Platform(s): IBM AIX 6.1
IBM AIX 7.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28933
 
Oval ID: oval:org.mitre.oval:def:28933
Title: Potential security vulnerabilities have been identified with HP-UX running OpenSSL. These vulnerabilities could be exploited remotely to create a remote Denial of Service (DoS) and other vulnerabilites.
Description: The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature.
Family: unix Class: vulnerability
Reference(s): CVE-2015-0286
Version: 3
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28785
 
Oval ID: oval:org.mitre.oval:def:28785
Title: AIX OpenSSL Denial of Service (NULL pointer dereference and application crash)
Description: The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key.
Family: unix Class: vulnerability
Reference(s): CVE-2015-0288
Version: 4
Platform(s): IBM AIX 6.1
IBM AIX 7.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28799
 
Oval ID: oval:org.mitre.oval:def:28799
Title: Potential security vulnerabilities have been identified with HP-UX running OpenSSL. These vulnerabilities could be exploited remotely to create a remote Denial of Service (DoS) and other vulnerabilites.
Description: The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key.
Family: unix Class: vulnerability
Reference(s): CVE-2015-0288
Version: 3
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28868
 
Oval ID: oval:org.mitre.oval:def:28868
Title: AIX OpenSSL Denial of Service (assertion failure and daemon exit)
Description: The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via a crafted CLIENT-MASTER-KEY message.
Family: unix Class: vulnerability
Reference(s): CVE-2015-0293
Version: 4
Platform(s): IBM AIX 6.1
IBM AIX 7.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28849
 
Oval ID: oval:org.mitre.oval:def:28849
Title: Potential security vulnerabilities have been identified with HP-UX running OpenSSL. These vulnerabilities could be exploited remotely to create a remote Denial of Service (DoS) and other vulnerabilites.
Description: The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via a crafted CLIENT-MASTER-KEY message.
Family: unix Class: vulnerability
Reference(s): CVE-2015-0293
Version: 3
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28514
 
Oval ID: oval:org.mitre.oval:def:28514
Title: RHSA-2015:0800 -- openssl security update (Moderate)
Description: OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library. It was discovered that OpenSSL would accept ephemeral RSA keys when using non-export RSA cipher suites. A malicious server could make a TLS/SSL client using OpenSSL use a weaker key exchange method. (CVE-2015-0204)
Family: unix Class: patch
Reference(s): RHSA-2015:0800
CESA-2015:0800
CVE-2014-8275
CVE-2015-0204
CVE-2015-0287
CVE-2015-0288
CVE-2015-0289
CVE-2015-0292
CVE-2015-0293
Version: 3
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Product(s): openssl
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28795
 
Oval ID: oval:org.mitre.oval:def:28795
Title: AIX OpenSSL Denial of Service (memory corruption and application crash)
Description: Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import.
Family: unix Class: vulnerability
Reference(s): CVE-2015-0209
Version: 4
Platform(s): IBM AIX 6.1
IBM AIX 7.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28557
 
Oval ID: oval:org.mitre.oval:def:28557
Title: Potential security vulnerabilities have been identified with HP-UX running OpenSSL. These vulnerabilities could be exploited remotely to create a remote Denial of Service (DoS) and other vulnerabilites.
Description: Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import.
Family: unix Class: vulnerability
Reference(s): CVE-2015-0209
Version: 3
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28541
 
Oval ID: oval:org.mitre.oval:def:28541
Title: AIX OpenSSL Denial of Service (invalid write operation and memory corruption)
Description: The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse.
Family: unix Class: vulnerability
Reference(s): CVE-2015-0287
Version: 4
Platform(s): IBM AIX 6.1
IBM AIX 7.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28791
 
Oval ID: oval:org.mitre.oval:def:28791
Title: Potential security vulnerabilities have been identified with HP-UX running OpenSSL. These vulnerabilities could be exploited remotely to create a remote Denial of Service (DoS) and other vulnerabilites.
Description: The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse.
Family: unix Class: vulnerability
Reference(s): CVE-2015-0287
Version: 3
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28671
 
Oval ID: oval:org.mitre.oval:def:28671
Title: AIX OpenSSL Denial of Service (NULL pointer dereference and application crash)
Description: The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c.
Family: unix Class: vulnerability
Reference(s): CVE-2015-0289
Version: 4
Platform(s): IBM AIX 6.1
IBM AIX 7.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28477
 
Oval ID: oval:org.mitre.oval:def:28477
Title: Potential security vulnerabilities have been identified with HP-UX running OpenSSL. These vulnerabilities could be exploited remotely to create a remote Denial of Service (DoS) and other vulnerabilites.
Description: The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c.
Family: unix Class: vulnerability
Reference(s): CVE-2015-0289
Version: 3
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28905
 
Oval ID: oval:org.mitre.oval:def:28905
Title: AIX OpenSSL Denial of Service (memory corruption)
Description: Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.
Family: unix Class: vulnerability
Reference(s): CVE-2015-0292
Version: 4
Platform(s): IBM AIX 6.1
IBM AIX 7.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28275
 
Oval ID: oval:org.mitre.oval:def:28275
Title: Potential security vulnerabilities have been identified with HP-UX running OpenSSL. These vulnerabilities could be exploited remotely to create a remote Denial of Service (DoS) and other vulnerabilites.
Description: Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.
Family: unix Class: vulnerability
Reference(s): CVE-2015-0292
Version: 3
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application193

Information Assurance Vulnerability Management (IAVM)

DateDescription
2015-09-24IAVM : 2015-A-0222 - Multiple Security Vulnerabilities in Apple iOS
Severity : Category I - VMSKEY : V0061471
2015-07-16IAVM : 2015-A-0154 - Multiple Vulnerabilities in Oracle Fusion Middleware
Severity : Category I - VMSKEY : V0061081
2015-07-16IAVM : 2015-A-0160 - Multiple Vulnerabilities in Oracle Linux and Virtualization
Severity : Category I - VMSKEY : V0061123
2015-06-25IAVM : 2015-A-0135 - Multiple Vulnerabilities in Blue Coat ProxySG
Severity : Category I - VMSKEY : V0060997

Snort® IPS/IDS

DateDescription
2015-07-19OpenSSL denial-of-service via crafted x.509 certificate attempt
RuleID : 34889 - Revision : 3 - Type : SERVER-OTHER

Nessus® Vulnerability Scanner

DateDescription
2016-04-14Name : The remote device is missing a vendor-supplied security patch.
File : cisco-sa-20150320-openssl-ios.nasl - Type : ACT_GATHER_INFO
2016-04-14Name : The remote device is missing a vendor-supplied security patch.
File : cisco-sa-20150320-openssl-iosxe.nasl - Type : ACT_GATHER_INFO
2016-04-07Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2016-682.nasl - Type : ACT_GATHER_INFO
2016-03-29Name : The remote web server is affected by multiple vulnerabilities.
File : hpsmh_7_2_6.nasl - Type : ACT_GATHER_INFO
2016-03-14Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-327.nasl - Type : ACT_GATHER_INFO
2016-03-10Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20160309_openssl098e_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2016-03-09Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2016-0372.nasl - Type : ACT_GATHER_INFO
2016-03-09Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2016-0372.nasl - Type : ACT_GATHER_INFO
2016-03-09Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2016-0372.nasl - Type : ACT_GATHER_INFO
2016-03-08Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-0678-1.nasl - Type : ACT_GATHER_INFO
2016-03-07Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-0631-1.nasl - Type : ACT_GATHER_INFO
2016-03-04Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-294.nasl - Type : ACT_GATHER_INFO
2016-03-04Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-0624-1.nasl - Type : ACT_GATHER_INFO
2016-03-04Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-0641-1.nasl - Type : ACT_GATHER_INFO
2016-03-03Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-289.nasl - Type : ACT_GATHER_INFO
2016-03-03Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-292.nasl - Type : ACT_GATHER_INFO
2016-03-02Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2016-0303.nasl - Type : ACT_GATHER_INFO
2016-03-02Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2016-0304.nasl - Type : ACT_GATHER_INFO
2016-03-02Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-0617-1.nasl - Type : ACT_GATHER_INFO
2016-03-02Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-0620-1.nasl - Type : ACT_GATHER_INFO
2016-02-26Name : The remote device is missing a vendor-supplied security patch.
File : cisco-sa-20140605-openssl-nxos.nasl - Type : ACT_GATHER_INFO
2016-01-28Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL16302.nasl - Type : ACT_GATHER_INFO
2015-12-30Name : A web application on the remote host is affected by multiple vulnerabilities.
File : puppet_enterprise_380.nasl - Type : ACT_GATHER_INFO
2015-12-21Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2015-2303-1.nasl - Type : ACT_GATHER_INFO
2015-12-17Name : The remote openSUSE host is missing a security update.
File : openSUSE-2015-889.nasl - Type : ACT_GATHER_INFO
2015-10-22Name : A web application running on the remote host is affected by multiple vulnerab...
File : mysql_enterprise_monitor_3_0_23.nasl - Type : ACT_GATHER_INFO
2015-10-06Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL16321.nasl - Type : ACT_GATHER_INFO
2015-10-06Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL16323.nasl - Type : ACT_GATHER_INFO
2015-10-05Name : The remote host is missing a Mac OS X update that fixes multiple security vul...
File : macosx_10_11.nasl - Type : ACT_GATHER_INFO
2015-08-21Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2015-1410-1.nasl - Type : ACT_GATHER_INFO
2015-07-27Name : The remote openSUSE host is missing a security update.
File : openSUSE-2015-507.nasl - Type : ACT_GATHER_INFO
2015-07-22Name : The remote web server is affected by multiple vulnerabilities.
File : hpsmh_7_5.nasl - Type : ACT_GATHER_INFO
2015-07-16Name : The application installed on the remote host is affected by multiple vulnerab...
File : oracle_secure_global_desktop_jul_2015_cpu.nasl - Type : ACT_GATHER_INFO
2015-07-01Name : The remote host is missing a Mac OS X update that fixes multiple security vul...
File : macosx_10_10_4.nasl - Type : ACT_GATHER_INFO
2015-07-01Name : The remote host is missing a Mac OS X update that fixes multiple security vul...
File : macosx_SecUpd2015-005.nasl - Type : ACT_GATHER_INFO
2015-06-25Name : The remote device is affected by multiple vulnerabilities.
File : bluecoat_proxy_sg_6_5_7_5.nasl - Type : ACT_GATHER_INFO
2015-06-16Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2015-0070.nasl - Type : ACT_GATHER_INFO
2015-06-04Name : The remote web server is running an application that is affected by multiple ...
File : splunk_618.nasl - Type : ACT_GATHER_INFO
2015-05-20Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2015-0541-1.nasl - Type : ACT_GATHER_INFO
2015-05-19Name : The remote Apache Tomcat server is affected by multiple vulnerabilities.
File : tomcat_7_0_60.nasl - Type : ACT_GATHER_INFO
2015-05-19Name : The remote Apache Tomcat server is affected by multiple vulnerabilities.
File : tomcat_8_0_21.nasl - Type : ACT_GATHER_INFO
2015-05-15Name : The remote Apache Tomcat server is affected by multiple vulnerabilities.
File : tomcat_6_0_44.nasl - Type : ACT_GATHER_INFO
2015-05-05Name : The remote Fedora host is missing a security update.
File : fedora_2015-6855.nasl - Type : ACT_GATHER_INFO
2015-05-04Name : The remote Fedora host is missing a security update.
File : fedora_2015-6951.nasl - Type : ACT_GATHER_INFO
2015-04-22Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2015-111-09.nasl - Type : ACT_GATHER_INFO
2015-04-20Name : The remote AIX host has a version of OpenSSL installed that is affected by mu...
File : aix_openssl_advisory13.nasl - Type : ACT_GATHER_INFO
2015-04-15Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2015-0800.nasl - Type : ACT_GATHER_INFO
2015-04-14Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2015-0800.nasl - Type : ACT_GATHER_INFO
2015-04-14Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2015-0800.nasl - Type : ACT_GATHER_INFO
2015-04-14Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20150413_openssl_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2015-04-06Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL16317.nasl - Type : ACT_GATHER_INFO
2015-04-01Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2015-0752.nasl - Type : ACT_GATHER_INFO
2015-03-30Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2015-062.nasl - Type : ACT_GATHER_INFO
2015-03-30Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2015-063.nasl - Type : ACT_GATHER_INFO
2015-03-26Name : The remote Debian host is missing a security update.
File : debian_DLA-177.nasl - Type : ACT_GATHER_INFO
2015-03-26Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20150324_openssl_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2015-03-26Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20150324_openssl_on_SL7_x.nasl - Type : ACT_GATHER_INFO
2015-03-25Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2015-498.nasl - Type : ACT_GATHER_INFO
2015-03-25Name : The remote Fedora host is missing a security update.
File : fedora_2015-4300.nasl - Type : ACT_GATHER_INFO
2015-03-25Name : The remote Fedora host is missing a security update.
File : fedora_2015-4303.nasl - Type : ACT_GATHER_INFO
2015-03-25Name : The remote Fedora host is missing a security update.
File : fedora_2015-4320.nasl - Type : ACT_GATHER_INFO
2015-03-25Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2015-0039.nasl - Type : ACT_GATHER_INFO
2015-03-25Name : The remote Windows host contains a program that is affected by multiple vulne...
File : stunnel_5_12.nasl - Type : ACT_GATHER_INFO
2015-03-24Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2015-0715.nasl - Type : ACT_GATHER_INFO
2015-03-24Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2015-0716.nasl - Type : ACT_GATHER_INFO
2015-03-24Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201503-11.nasl - Type : ACT_GATHER_INFO
2015-03-24Name : The remote service is affected by multiple vulnerabilities.
File : openssl_0_9_8zf.nasl - Type : ACT_GATHER_INFO
2015-03-24Name : The remote service is affected by multiple vulnerabilities.
File : openssl_1_0_0r.nasl - Type : ACT_GATHER_INFO
2015-03-24Name : The remote service is affected by multiple vulnerabilities.
File : openssl_1_0_1m.nasl - Type : ACT_GATHER_INFO
2015-03-24Name : The remote service is affected by multiple vulnerabilities.
File : openssl_1_0_2a.nasl - Type : ACT_GATHER_INFO
2015-03-24Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2015-0715.nasl - Type : ACT_GATHER_INFO
2015-03-24Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2015-0716.nasl - Type : ACT_GATHER_INFO
2015-03-24Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2015-0715.nasl - Type : ACT_GATHER_INFO
2015-03-24Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2015-0716.nasl - Type : ACT_GATHER_INFO
2015-03-23Name : The remote openSUSE host is missing a security update.
File : openSUSE-2015-247.nasl - Type : ACT_GATHER_INFO
2015-03-23Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_libopenssl-devel-150317.nasl - Type : ACT_GATHER_INFO
2015-03-20Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3197.nasl - Type : ACT_GATHER_INFO
2015-03-20Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_9d15355bce7c11e49db0d050992ecde8.nasl - Type : ACT_GATHER_INFO
2015-03-20Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_compat-openssl097g-150317.nasl - Type : ACT_GATHER_INFO
2015-03-20Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-2537-1.nasl - Type : ACT_GATHER_INFO
2014-10-12Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2014-349.nasl - Type : ACT_GATHER_INFO
2014-06-06Name : The remote service is affected by multiple vulnerabilities.
File : openssl_1_0_1h.nasl - Type : ACT_GATHER_INFO
2014-04-08Name : The remote service is affected by multiple vulnerabilities.
File : openssl_1_0_0m.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
DateInformations
2016-01-22 09:26:33
  • Multiple Updates
2015-12-05 13:27:53
  • Multiple Updates
2015-03-25 13:28:51
  • Multiple Updates
2015-03-24 05:26:54
  • First insertion