Executive Summary
Summary | |
---|---|
Title | Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: September 2016 |
Informations | |||
---|---|---|---|
Name | cisco-sa-20160927-openssl | First vendor Publication | 2016-09-27 |
Vendor | Cisco | Last vendor Modification | 2016-09-27 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N) | |||
---|---|---|---|
Cvss Base Score | 5 | Attack Range | Network |
Cvss Impact Score | 2.9 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
On September 22, 2016, the OpenSSL Software Foundation released an advisory that describes 14 vulnerabilities. Of these 14 vulnerabilities, the OpenSSL Software Foundation classifies one as “Critical Severity,†one as “Moderate Severity,†and the other 12 as “Low Severity.†Subsequently, on September 26, the OpenSSL Software Foundation released an additional advisory that describes two new vulnerabilities. These vulnerabilities affect the OpenSSL versions that were released to address the vulnerabilities disclosed in the previous advisory. One of the new vulnerabilities was rated as “High Severity†and the other as “Moderate Severity.†Of the 16 released vulnerabilities: Fourteen track issues that could result in a denial of service (DoS) condition One (CVE-2016-2183, aka SWEET32) tracks an implementation of a Birthday attack against Transport Layer Security (TLS) block ciphers that use a 64-bit block size that could result in loss of confidentiality One (CVE-2016-2178) is a timing side-channel attack that, in specific circumstances, could allow an attacker to derive the private DSA key that belongs to another user or service running on the same system Five of the 16 vulnerabilities affect exclusively the recently released OpenSSL versions that belong to the 1.1.0 code train, which has not yet been integrated into any Cisco product. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160927-openssl BEGIN PGP SIGNATURE Version: GnuPG v1.4.5 (SunOS) iQIVAwUBV+r9R689gD3EAJB5AQIs2g//TXbk+qIT/kKxt/MJOUQLkID2tdWZr8Ls 2vcQm5EI8HKr+qSFih3/jyRl5A4LSZsZjQPIo6IxpGKtFLBleBH89l+4rh5D9Hit /hpQGgIXt57yUug6vHqZiU/zh65pifVCOqvu2E7Gy6pd530AqLhRjK5IKND4GFaW M2QPwrM2DYchWBuFIA7/r63HFQneaZqzHfR/wA1hhcvWUkDR9h9DaLbX15vG7CHI J1rAgywVeLOMN7VjDwadvtNfDECnLYeSP91380oL6dB4zyeO18YoHHHYuFTphRSb umz2zdU8Ku6QBXnUvJjAW3QtzvPX3scjXOgeJqHMLK+38tPkoHZvQeGRfGNmKDEQ 0fA1xFQLlRtetjKGC0L74IjdUXklvyTuGbn5P5CP+vBTLaWCcc/rqfY67NfNtIqp SKz+9UtprxAlLN3BKkCSzIiKS3BDokbOEORHCEYEmbYkwUNVp0KEXKgAgNlFO/BS yaL+CDxxiRdbnFixUcG8/xQj584xwOm/cp1u8otySYfSd70oTMqP11VXh+WB+6hT zHhSMOvLzpLeM++m121ojARIXbXTQLGziLHaRSi8WH+OuB6rceic0f0HwLlBCRlk LFxQunW2EawYlJGV5Czld4vdoHBSDGcP8bOg9M4LUtA+sKCGpgrTPombG98mhuut 7i2jUMZa7K8= =KS16 END PGP SIGNATURE |
Original Source
Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...) |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
33 % | CWE-203 | Information Exposure Through Discrepancy |
33 % | CWE-200 | Information Exposure |
33 % | CWE-190 | Integer Overflow or Wraparound (CWE/SANS Top 25) |
CPE : Common Platform Enumeration
Snort® IPS/IDS
Date | Description |
---|---|
2016-10-18 | SSH weak blowfish cipher suite use attempt RuleID : 40190 - Revision : 2 - Type : POLICY-OTHER |
2016-10-18 | SSH weak 3DES cipher suite use attempt RuleID : 40189 - Revision : 2 - Type : POLICY-OTHER |
2016-10-18 | SSL weak 3DES cipher suite use attempt RuleID : 40188 - Revision : 2 - Type : POLICY-OTHER |
2016-10-18 | SSL weak 3DES cipher suite use attempt RuleID : 40187 - Revision : 2 - Type : POLICY-OTHER |
2016-10-18 | SSL weak 3DES cipher suite use attempt RuleID : 40186 - Revision : 2 - Type : POLICY-OTHER |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2018-07-16 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2018-2123.nasl - Type : ACT_GATHER_INFO |
2018-02-28 | Name : The version of Arista Networks EOS running on the remote device is affected b... File : arista_eos_sa0024.nasl - Type : ACT_GATHER_INFO |
2018-02-28 | Name : The version of Arista Networks EOS running on the remote device is affected b... File : arista_eos_sa0024_4_17.nasl - Type : ACT_GATHER_INFO |
2017-11-20 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-3240.nasl - Type : ACT_GATHER_INFO |
2017-11-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-3113.nasl - Type : ACT_GATHER_INFO |
2017-09-20 | Name : The remote VMware ESXi 6.0 host is affected by multiple vulnerabilities. File : vmware_esxi_6_0_build_5485776_remote.nasl - Type : ACT_GATHER_INFO |
2017-09-15 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-2709.nasl - Type : ACT_GATHER_INFO |
2017-09-15 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-2710.nasl - Type : ACT_GATHER_INFO |
2017-09-13 | Name : The version of Java SDK installed on the remote AIX host is affected by multi... File : aix_java_jan2017_advisory.nasl - Type : ACT_GATHER_INFO |
2017-07-20 | Name : A web application installed on the remote host is affected by multiple vulner... File : oracle_e-business_cpu_jul_2017.nasl - Type : ACT_GATHER_INFO |
2017-07-20 | Name : The remote database server is affected by multiple vulnerabilities. File : oracle_rdbms_cpu_jul_2017.nasl - Type : ACT_GATHER_INFO |
2017-07-13 | Name : The remote Virtuozzo host is missing a security update. File : Virtuozzo_VZLSA-2017-0180.nasl - Type : ACT_GATHER_INFO |
2017-07-13 | Name : The remote Virtuozzo host is missing a security update. File : Virtuozzo_VZLSA-2017-0269.nasl - Type : ACT_GATHER_INFO |
2017-07-06 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201707-01.nasl - Type : ACT_GATHER_INFO |
2017-06-30 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-1658.nasl - Type : ACT_GATHER_INFO |
2017-06-26 | Name : The Tenable SecurityCenter application on the remote host contains an OpenSSL... File : securitycenter_openssl_1_0_1u.nasl - Type : ACT_GATHER_INFO |
2017-06-09 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL53084033.nasl - Type : ACT_GATHER_INFO |
2017-05-31 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-1444-1.nasl - Type : ACT_GATHER_INFO |
2017-05-24 | Name : A database server installed on the remote host is affected by multiple vulner... File : ibm_informix_server_swg22002897.nasl - Type : ACT_GATHER_INFO |
2017-05-10 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-1216.nasl - Type : ACT_GATHER_INFO |
2017-05-02 | Name : An application installed on the remote host is affected by multiple vulnerabi... File : oracle_secure_global_desktop_apr_2017_cpu.nasl - Type : ACT_GATHER_INFO |
2017-05-01 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2016-1047.nasl - Type : ACT_GATHER_INFO |
2017-05-01 | Name : The remote EulerOS host is missing a security update. File : EulerOS_SA-2016-1090.nasl - Type : ACT_GATHER_INFO |
2017-05-01 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2017-1015.nasl - Type : ACT_GATHER_INFO |
2017-05-01 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2017-1016.nasl - Type : ACT_GATHER_INFO |
2017-05-01 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2017-1027.nasl - Type : ACT_GATHER_INFO |
2017-05-01 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2017-1028.nasl - Type : ACT_GATHER_INFO |
2017-04-28 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-3270-1.nasl - Type : ACT_GATHER_INFO |
2017-04-21 | Name : An enterprise management application installed on the remote host is affected... File : oracle_enterprise_manager_apr_2017_cpu.nasl - Type : ACT_GATHER_INFO |
2017-03-30 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-0839-1.nasl - Type : ACT_GATHER_INFO |
2017-03-20 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-0716-1.nasl - Type : ACT_GATHER_INFO |
2017-03-20 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-0719-1.nasl - Type : ACT_GATHER_INFO |
2017-03-20 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-0720-1.nasl - Type : ACT_GATHER_INFO |
2017-03-09 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0462.nasl - Type : ACT_GATHER_INFO |
2017-03-02 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL13167034.nasl - Type : ACT_GATHER_INFO |
2017-03-01 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL23873366.nasl - Type : ACT_GATHER_INFO |
2017-03-01 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0336.nasl - Type : ACT_GATHER_INFO |
2017-03-01 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0337.nasl - Type : ACT_GATHER_INFO |
2017-03-01 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0338.nasl - Type : ACT_GATHER_INFO |
2017-02-21 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2017-278.nasl - Type : ACT_GATHER_INFO |
2017-02-21 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-0490-1.nasl - Type : ACT_GATHER_INFO |
2017-02-16 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-3198-1.nasl - Type : ACT_GATHER_INFO |
2017-02-15 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2017-797.nasl - Type : ACT_GATHER_INFO |
2017-02-15 | Name : An application running on the remote host is affected by multiple vulnerabili... File : nessus_tns_2016_16.nasl - Type : ACT_GATHER_INFO |
2017-02-15 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-0460-1.nasl - Type : ACT_GATHER_INFO |
2017-02-14 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2017-0269.nasl - Type : ACT_GATHER_INFO |
2017-02-14 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2017-0269.nasl - Type : ACT_GATHER_INFO |
2017-02-13 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0269.nasl - Type : ACT_GATHER_INFO |
2017-02-13 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20170213_java_1_7_0_openjdk_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2017-02-09 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-3194-1.nasl - Type : ACT_GATHER_INFO |
2017-02-06 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2017-201.nasl - Type : ACT_GATHER_INFO |
2017-02-01 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-0346-1.nasl - Type : ACT_GATHER_INFO |
2017-02-01 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-3181-1.nasl - Type : ACT_GATHER_INFO |
2017-01-30 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0194.nasl - Type : ACT_GATHER_INFO |
2017-01-27 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2017-791.nasl - Type : ACT_GATHER_INFO |
2017-01-27 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0193.nasl - Type : ACT_GATHER_INFO |
2017-01-26 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201701-65.nasl - Type : ACT_GATHER_INFO |
2017-01-26 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-3179-1.nasl - Type : ACT_GATHER_INFO |
2017-01-25 | Name : A web application running on the remote host is affected by multiple vulnerab... File : mysql_enterprise_monitor_3_1_5_7958.nasl - Type : ACT_GATHER_INFO |
2017-01-25 | Name : A web application running on the remote host is affected by multiple vulnerab... File : mysql_enterprise_monitor_3_2_5_1141.nasl - Type : ACT_GATHER_INFO |
2017-01-25 | Name : A web application running on the remote host is affected by multiple vulnerab... File : mysql_enterprise_monitor_3_3_1_1112.nasl - Type : ACT_GATHER_INFO |
2017-01-25 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20170120_java_1_8_0_openjdk_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2017-01-23 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2017-0180.nasl - Type : ACT_GATHER_INFO |
2017-01-23 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2017-0180.nasl - Type : ACT_GATHER_INFO |
2017-01-23 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0180.nasl - Type : ACT_GATHER_INFO |
2017-01-20 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0175.nasl - Type : ACT_GATHER_INFO |
2017-01-20 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0176.nasl - Type : ACT_GATHER_INFO |
2017-01-20 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0177.nasl - Type : ACT_GATHER_INFO |
2017-01-19 | Name : The remote Windows host contains a programming platform that is affected by m... File : oracle_java_cpu_jan_2017.nasl - Type : ACT_GATHER_INFO |
2017-01-19 | Name : The remote Unix host contains a programming platform that is affected by mult... File : oracle_java_cpu_jan_2017_unix.nasl - Type : ACT_GATHER_INFO |
2017-01-06 | Name : A vulnerability scanner installed on the remote host is affected by multiple ... File : pvs_5_2_0.nasl - Type : ACT_GATHER_INFO |
2017-01-05 | Name : The remote device is missing a vendor-supplied security patch. File : juniper_jsa10759.nasl - Type : ACT_GATHER_INFO |
2016-12-29 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2016-363-01.nasl - Type : ACT_GATHER_INFO |
2016-12-27 | Name : An application running on the remote web server is affected by multiple vulne... File : ibm_bigfix_remote_control_9_1_3.nasl - Type : ACT_GATHER_INFO |
2016-12-07 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201612-16.nasl - Type : ACT_GATHER_INFO |
2016-11-22 | Name : The remote AIX host has a version of OpenSSL installed that is affected by mu... File : aix_openssl_advisory21.nasl - Type : ACT_GATHER_INFO |
2016-11-15 | Name : The remote Fedora host is missing a security update. File : fedora_2016-64e0743e16.nasl - Type : ACT_GATHER_INFO |
2016-11-01 | Name : The remote service supports the use of 64-bit block ciphers. File : ssl_64bitblock_supported_ciphers.nasl - Type : ACT_GATHER_INFO |
2016-10-21 | Name : The remote database server is affected by multiple vulnerabilities. File : mysql_5_6_34_rpm.nasl - Type : ACT_GATHER_INFO |
2016-10-21 | Name : The remote database server is affected by multiple vulnerabilities. File : mysql_5_7_16_rpm.nasl - Type : ACT_GATHER_INFO |
2016-10-20 | Name : The remote database server is affected by multiple vulnerabilities. File : mysql_5_6_34.nasl - Type : ACT_GATHER_INFO |
2016-10-20 | Name : The remote database server is affected by multiple vulnerabilities. File : mysql_5_7_16.nasl - Type : ACT_GATHER_INFO |
2016-10-17 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-1189.nasl - Type : ACT_GATHER_INFO |
2016-10-17 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2016-3627.nasl - Type : ACT_GATHER_INFO |
2016-10-17 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2016-0141.nasl - Type : ACT_GATHER_INFO |
2016-10-13 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2016-755.nasl - Type : ACT_GATHER_INFO |
2016-10-12 | Name : The remote Fedora host is missing a security update. File : fedora_2016-97454404fe.nasl - Type : ACT_GATHER_INFO |
2016-10-12 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-1172.nasl - Type : ACT_GATHER_INFO |
2016-10-07 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-2468-1.nasl - Type : ACT_GATHER_INFO |
2016-10-06 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-2458-1.nasl - Type : ACT_GATHER_INFO |
2016-09-30 | Name : The remote service is affected by multiple vulnerabilities. File : openssl_1_0_1u.nasl - Type : ACT_GATHER_INFO |
2016-09-30 | Name : The remote service is affected by multiple vulnerabilities. File : openssl_1_0_2i.nasl - Type : ACT_GATHER_INFO |
2016-09-29 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20160927_openssl_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2016-09-28 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2016-1940.nasl - Type : ACT_GATHER_INFO |
2016-09-28 | Name : The remote Fedora host is missing a security update. File : fedora_2016-a555159613.nasl - Type : ACT_GATHER_INFO |
2016-09-28 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-1130.nasl - Type : ACT_GATHER_INFO |
2016-09-28 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-1134.nasl - Type : ACT_GATHER_INFO |
2016-09-28 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2016-1940.nasl - Type : ACT_GATHER_INFO |
2016-09-28 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2016-0135.nasl - Type : ACT_GATHER_INFO |
2016-09-28 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-1940.nasl - Type : ACT_GATHER_INFO |
2016-09-28 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-2394-1.nasl - Type : ACT_GATHER_INFO |
2016-09-27 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-2387-1.nasl - Type : ACT_GATHER_INFO |
2016-09-26 | Name : The remote Debian host is missing a security update. File : debian_DLA-637.nasl - Type : ACT_GATHER_INFO |
2016-09-26 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-3087-2.nasl - Type : ACT_GATHER_INFO |
2016-09-23 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2016-266-01.nasl - Type : ACT_GATHER_INFO |
2016-09-23 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3673.nasl - Type : ACT_GATHER_INFO |
2016-09-23 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_43eaa65680bc11e6bf52b499baebfeaf.nasl - Type : ACT_GATHER_INFO |
2016-09-23 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-3087-1.nasl - Type : ACT_GATHER_INFO |
2016-08-25 | Name : The service running on the remote host uses a weak encryption block cipher by... File : openssl_1_1_0.nasl - Type : ACT_GATHER_INFO |
2016-07-25 | Name : The remote web server is affected by multiple vulnerabilities. File : oracle_http_server_cpu_jul_2016.nasl - Type : ACT_GATHER_INFO |
2016-07-01 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_0ca246823f0311e6b3c814dae9d210b8.nasl - Type : ACT_GATHER_INFO |
2016-06-10 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_6f0529e22e8211e6b2ecb499baebfeaf.nasl - Type : ACT_GATHER_INFO |
2015-10-23 | Name : The remote web server is affected by multiple vulnerabilities. File : oracle_http_server_cpu_oct_2015.nasl - Type : ACT_GATHER_INFO |
2015-01-27 | Name : The remote web server is affected by multiple vulnerabilities. File : oracle_http_server_cpu_jan_2015.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2016-09-28 05:21:41 |
|