Executive Summary

Summary
Title New openssl packages deprecate MD2 hash signatures
Informations
Name DSA-1888 First vendor Publication 2009-09-15
Vendor Debian Last vendor Modification 2009-09-15
Severity (Vendor) N/A Revision 1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Cvss Base Score 5.1 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity High
Cvss Expoit Score 4.9 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Certificates with MD2 hash signatures are no longer accepted by OpenSSL, since they're no longer considered cryptographically secure.

For the stable distribution (lenny), this problem has been fixed in version 0.9.8g-15+lenny5.

For the old stable distribution (etch), this problem has been fixed in version 0.9.8c-4etch9 for openssl and version 0.9.7k-3.1etch5 for openssl097. The OpenSSL 0.9.8 update for oldstable (etch) also provides updated packages for multiple denial of service vulnerabilities in the Datagram Transport Layer Security implementation. These fixes were already provided for Debian stable (Lenny) in a previous point update. The OpenSSL 0.9.7 package from oldstable (Etch) is not affected. (CVE-2009-1377, CVE-2009-1378, CVE-2009-1379, CVE-2009-1386 and CVE-2009-1387)

For the unstable distribution (sid), this problem has been fixed in version 0.9.8k-5.

We recommend that you upgrade your openssl packages.

Original Source

Url : http://www.debian.org/security/2009/dsa-1888

CWE : Common Weakness Enumeration

% Id Name
33 % CWE-476 NULL Pointer Dereference
17 % CWE-401 Failure to Release Memory Before Removing Last Reference ('Memory Leak')
17 % CWE-399 Resource Management Errors
17 % CWE-310 Cryptographic Issues
17 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10740
 
Oval ID: oval:org.mitre.oval:def:10740
Title: The dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL before 1.0.0 Beta 2 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence DTLS handshake message, related to a "fragment bug."
Description: The dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL before 1.0.0 Beta 2 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence DTLS handshake message, related to a "fragment bug."
Family: unix Class: vulnerability
Reference(s): CVE-2009-1387
Version: 5
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:10763
 
Oval ID: oval:org.mitre.oval:def:10763
Title: The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.
Description: The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.
Family: unix Class: vulnerability
Reference(s): CVE-2009-2409
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11179
 
Oval ID: oval:org.mitre.oval:def:11179
Title: ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello.
Description: ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello.
Family: unix Class: vulnerability
Reference(s): CVE-2009-1386
Version: 5
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11309
 
Oval ID: oval:org.mitre.oval:def:11309
Title: Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."
Description: Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."
Family: unix Class: vulnerability
Reference(s): CVE-2009-1378
Version: 5
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13409
 
Oval ID: oval:org.mitre.oval:def:13409
Title: USN-830-1 -- openssl vulnerability
Description: Dan Kaminsky discovered OpenSSL would still accept certificates with MD2 hash signatures. As a result, an attacker could potentially create a malicious trusted certificate to impersonate another site. This update handles this issue by completely disabling MD2 for certificate validation.
Family: unix Class: patch
Reference(s): USN-830-1
CVE-2009-2409
Version: 5
Platform(s): Ubuntu 8.04
Ubuntu 9.04
Ubuntu 6.06
Ubuntu 8.10
Product(s): openssl
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13721
 
Oval ID: oval:org.mitre.oval:def:13721
Title: DSA-1888-1 openssl, openssl097 -- cryptographic weakness
Description: Certificates with MD2 hash signatures are no longer accepted by OpenSSL, since they’re no longer considered cryptographically secure. For the stable distribution, this problem has been fixed in version 0.9.8g-15+lenny5. For the old stable distribution, this problem has been fixed in version 0.9.8c-4etch9 for openssl and version 0.9.7k-3.1etch5 for openssl097. The OpenSSL 0.9.8 update for oldstable also provides updated packages for multiple denial of service vulnerabilities in the Datagram Transport Layer Security implementation. These fixes were already provided for Debian stable in a previous point update. The OpenSSL 0.9.7 package from oldstable is not affected. For the unstable distribution, this problem has been fixed in version 0.9.8k-5. We recommend that you upgrade your openssl packages.
Family: unix Class: patch
Reference(s): DSA-1888-1
CVE-2009-2409
CVE-2009-1377
CVE-2009-1378
CVE-2009-1379
CVE-2009-1386
CVE-2009-1387
Version: 5
Platform(s): Debian GNU/Linux 5.0
Debian GNU/Linux 4.0
Product(s): openssl
openssl097
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13737
 
Oval ID: oval:org.mitre.oval:def:13737
Title: DSA-1874-1 nss -- several
Description: Several vulnerabilities have been discovered in the Network Security Service libraries. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-2404 Moxie Marlinspike discovered that a buffer overflow in the regular expression parser could lead to the execution of arbitrary code. CVE-2009-2408 Dan Kaminsky discovered that NULL characters in certificate names could lead to man-in-the-middle attacks by tricking the user into accepting a rogue certificate. CVE-2009-2409 Certificates with MD2 hash signatures are no longer accepted since they’re no longer considered cryptographically secure. The old stable distribution doesn’t contain nss. For the stable distribution, these problems have been fixed in version 3.12.3.1-0lenny1. For the unstable distribution, these problems have been fixed in version 3.12.3.1-1. We recommend that you upgrade your nss packages.
Family: unix Class: patch
Reference(s): DSA-1874-1
CVE-2009-2404
CVE-2009-2408
CVE-2009-2409
Version: 5
Platform(s): Debian GNU/Linux 5.0
Product(s): nss
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13780
 
Oval ID: oval:org.mitre.oval:def:13780
Title: USN-810-2 -- nspr update
Description: USN-810-1 fixed vulnerabilities in NSS. This update provides the NSPR needed to use the new NSS. Original advisory details: Moxie Marlinspike discovered that NSS did not properly handle regular expressions in certificate names. A remote attacker could create a specially crafted certificate to cause a denial of service or execute arbitrary code as the user invoking the program. Moxie Marlinspike and Dan Kaminsky independently discovered that NSS did not properly handle certificates with NULL characters in the certificate name. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. Dan Kaminsky discovered NSS would still accept certificates with MD2 hash signatures. As a result, an attacker could potentially create a malicious trusted certificate to impersonate another site
Family: unix Class: patch
Reference(s): USN-810-2
CVE-2009-2404
CVE-2009-2408
CVE-2009-2409
Version: 5
Platform(s): Ubuntu 8.10
Ubuntu 8.04
Ubuntu 9.04
Product(s): nspr
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13850
 
Oval ID: oval:org.mitre.oval:def:13850
Title: USN-810-1 -- nss vulnerabilities
Description: Moxie Marlinspike discovered that NSS did not properly handle regular expressions in certificate names. A remote attacker could create a specially crafted certificate to cause a denial of service or execute arbitrary code as the user invoking the program. Moxie Marlinspike and Dan Kaminsky independently discovered that NSS did not properly handle certificates with NULL characters in the certificate name. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. Dan Kaminsky discovered NSS would still accept certificates with MD2 hash signatures. As a result, an attacker could potentially create a malicious trusted certificate to impersonate another site
Family: unix Class: patch
Reference(s): USN-810-1
CVE-2009-2404
CVE-2009-2408
CVE-2009-2409
Version: 5
Platform(s): Ubuntu 8.10
Ubuntu 8.04
Ubuntu 9.04
Product(s): nss
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13891
 
Oval ID: oval:org.mitre.oval:def:13891
Title: USN-792-1 -- openssl vulnerabilities
Description: It was discovered that OpenSSL did not limit the number of DTLS records it would buffer when they arrived with a future epoch. A remote attacker could cause a denial of service via memory resource consumption by sending a large number of crafted requests. It was discovered that OpenSSL did not properly free memory when processing DTLS fragments. A remote attacker could cause a denial of service via memory resource consumption by sending a large number of crafted requests. It was discovered that OpenSSL did not properly handle certain server certificates when processing DTLS packets. A remote DTLS server could cause a denial of service by sending a message containing a specially crafted server certificate. It was discovered that OpenSSL did not properly handle a DTLS ChangeCipherSpec packet when it occured before ClientHello. A remote attacker could cause a denial of service by sending a specially crafted request. It was discovered that OpenSSL did not properly handle out of sequence DTLS handshake messages. A remote attacker could cause a denial of service by sending a specially crafted request
Family: unix Class: patch
Reference(s): USN-792-1
CVE-2009-1377
CVE-2009-1378
CVE-2009-1379
CVE-2009-1386
CVE-2009-1387
Version: 5
Platform(s): Ubuntu 8.04
Ubuntu 9.04
Ubuntu 6.06
Ubuntu 8.10
Product(s): openssl
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22412
 
Oval ID: oval:org.mitre.oval:def:22412
Title: ELSA-2009:1186: nspr and nss security, bug fix, and enhancement update (Critical)
Description: The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.
Family: unix Class: patch
Reference(s): ELSA-2009:1186-01
CVE-2009-2404
CVE-2009-2408
CVE-2009-2409
Version: 17
Platform(s): Oracle Linux 5
Product(s): nspr
nss
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22755
 
Oval ID: oval:org.mitre.oval:def:22755
Title: ELSA-2009:1335: openssl security, bug fix, and enhancement update (Moderate)
Description: The dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL before 1.0.0 Beta 2 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence DTLS handshake message, related to a "fragment bug."
Family: unix Class: patch
Reference(s): ELSA-2009:1335-02
CVE-2006-7250
CVE-2009-0590
CVE-2009-1377
CVE-2009-1378
CVE-2009-1379
CVE-2009-1386
CVE-2009-1387
Version: 33
Platform(s): Oracle Linux 5
Product(s): openssl
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24227
 
Oval ID: oval:org.mitre.oval:def:24227
Title: Vulnerability in OpenSSL 0.9.8k and earlier 0.9.8 versions, allows remote attackers to cause a denial of service (memory consumption)
Description: The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service (memory consumption) via a large series of "future epoch" DTLS records that are buffered in a queue, aka "DTLS record buffer limitation bug."
Family: windows Class: vulnerability
Reference(s): CVE-2009-1377
Version: 3
Platform(s): Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows 8
Microsoft Windows 8.1
Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2
Product(s): OpenSSL
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24700
 
Oval ID: oval:org.mitre.oval:def:24700
Title: Vulnerability in OpenSSL before 1.0.0 Beta 2, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash)
Description: The dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL before 1.0.0 Beta 2 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence DTLS handshake message, related to a "fragment bug."
Family: windows Class: vulnerability
Reference(s): CVE-2009-1387
Version: 3
Platform(s): Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows 8
Microsoft Windows 8.1
Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2
Product(s): OpenSSL
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25108
 
Oval ID: oval:org.mitre.oval:def:25108
Title: Vulnerability in OpenSSL before 0.9.8i, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash)
Description: ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello.
Family: windows Class: vulnerability
Reference(s): CVE-2009-1386
Version: 3
Platform(s): Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows 8
Microsoft Windows 8.1
Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2
Product(s): OpenSSL
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25119
 
Oval ID: oval:org.mitre.oval:def:25119
Title: Vulnerability in OpenSSL 1.0.0 Beta 2, allows remote attackers to cause a denial of service (openssl s_client crash)
Description: Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service (openssl s_client crash) and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server that uses a crafted server certificate.
Family: windows Class: vulnerability
Reference(s): CVE-2009-1379
Version: 3
Platform(s): Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows 8
Microsoft Windows 8.1
Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2
Product(s): OpenSSL
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25180
 
Oval ID: oval:org.mitre.oval:def:25180
Title: Vulnerability in OpenSSL 0.9.8 through 0.9.8k, might allow remote attackers to spoof certificates
Description: The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.
Family: windows Class: vulnerability
Reference(s): CVE-2009-2409
Version: 4
Platform(s): Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows 8
Microsoft Windows 8.1
Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2
Product(s): OpenSSL
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28253
 
Oval ID: oval:org.mitre.oval:def:28253
Title: DEPRECATED: ELSA-2010-0054 -- openssl security update (moderate)
Description: [0.9.8e-12.1] - fix CVE-2009-2409 - drop MD2 algorithm from EVP tables (#510197) - fix CVE-2009-4355 - do not leak memory when CRYPTO_cleanup_all_ex_data() is called prematurely by application (#546707)
Family: unix Class: patch
Reference(s): ELSA-2010-0054
CVE-2009-4355
CVE-2009-2409
Version: 4
Platform(s): Oracle Linux 5
Product(s): openssl
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28749
 
Oval ID: oval:org.mitre.oval:def:28749
Title: RHSA-2009:1335 -- openssl security, bug fix, and enhancement update (Moderate)
Description: Updated openssl packages that fix several security issues, various bugs, and add enhancements are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength general purpose cryptography library. Datagram TLS (DTLS) is a protocol based on TLS that is capable of securing datagram transport (for example, UDP).
Family: unix Class: patch
Reference(s): RHSA-2009:1335
CESA-2009:1335-CentOS 5
CVE-2006-7250
CVE-2009-0590
CVE-2009-1377
CVE-2009-1378
CVE-2009-1379
CVE-2009-1386
CVE-2009-1387
Version: 3
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Product(s): openssl
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:29071
 
Oval ID: oval:org.mitre.oval:def:29071
Title: USN-810-3 -- NSS regression
Description: USN-810-1 fixed vulnerabilities in NSS. Jozsef Kadlecsik noticed that the new libraries on amd64 did not correctly set stack memory flags, and caused applications using NSS (e.g. Firefox) to have an executable stack. This reduced the effectiveness of some defensive security protections. This update fixes the problem.
Family: unix Class: patch
Reference(s): USN-810-3
CVE-2009-2404
CVE-2009-2408
CVE-2009-2409
Version: 3
Platform(s): Ubuntu 9.04
Ubuntu 8.10
Ubuntu 8.04
Product(s): nss
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:29169
 
Oval ID: oval:org.mitre.oval:def:29169
Title: RHSA-2009:1186 -- nspr and nss security, bug fix, and enhancement update (Critical)
Description: Updated nspr and nss packages that fix security issues, bugs, and add an enhancement are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team.
Family: unix Class: patch
Reference(s): RHSA-2009:1186
CVE-2009-2404
CVE-2009-2408
CVE-2009-2409
Version: 3
Platform(s): Red Hat Enterprise Linux 5
Product(s): nspr
nss
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:6631
 
Oval ID: oval:org.mitre.oval:def:6631
Title: Network Security Services Library Supports Certificates With Weak MD2 Hash Signatures
Description: The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.
Family: unix Class: vulnerability
Reference(s): CVE-2009-2409
Version: 5
Platform(s): VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:6683
 
Oval ID: oval:org.mitre.oval:def:6683
Title: OpenSSL DTLS Packets Multiple Denial of Service Vulnerabilities
Description: The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service (memory consumption) via a large series of "future epoch" DTLS records that are buffered in a queue, aka "DTLS record buffer limitation bug."
Family: unix Class: vulnerability
Reference(s): CVE-2009-1377
Version: 5
Platform(s): VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:6848
 
Oval ID: oval:org.mitre.oval:def:6848
Title: OpenSSL 'dtls1_retrieve_buffered_fragment()' DTLS Packet Denial of Service Vulnerability
Description: Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service (openssl s_client crash) and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server that uses a crafted server certificate.
Family: unix Class: vulnerability
Reference(s): CVE-2009-1379
Version: 5
Platform(s): VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7155
 
Oval ID: oval:org.mitre.oval:def:7155
Title: VMware ESX, Service Console update for OpenSSL, GnuTLS, NSS and NSPR.
Description: The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.
Family: unix Class: vulnerability
Reference(s): CVE-2009-2409
Version: 5
Platform(s): VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7229
 
Oval ID: oval:org.mitre.oval:def:7229
Title: OpenSSL DTLS Packets Multiple Denial of Service Vulnerabilities
Description: Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."
Family: unix Class: vulnerability
Reference(s): CVE-2009-1378
Version: 5
Platform(s): VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7469
 
Oval ID: oval:org.mitre.oval:def:7469
Title: OpenSSL 'ChangeCipherSpec' DTLS Packet Denial of Service Vulnerability
Description: ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello.
Family: unix Class: vulnerability
Reference(s): CVE-2009-1386
Version: 5
Platform(s): VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7592
 
Oval ID: oval:org.mitre.oval:def:7592
Title: OpenSSL 'dtls1_retrieve_buffered_fragment()' DTLS Remote Denial of Service Vulnerability
Description: The dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL before 1.0.0 Beta 2 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence DTLS handshake message, related to a "fragment bug."
Family: unix Class: vulnerability
Reference(s): CVE-2009-1387
Version: 5
Platform(s): VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:8111
 
Oval ID: oval:org.mitre.oval:def:8111
Title: DSA-1874 nss -- several vulnerabilities
Description: Several vulnerabilities have been discovered in the Network Security Service libraries. The Common Vulnerabilities and Exposures project identifies the following problems: Moxie Marlinspike discovered that a buffer overflow in the regular expression parser could lead to the execution of arbitrary code. Dan Kaminsky discovered that NULL characters in certificate names could lead to man-in-the-middle attacks by tricking the user into accepting a rogue certificate. Certificates with MD2 hash signatures are no longer accepted since they're no longer considered cryptographically secure. The old stable distribution (etch) doesn't contain nss.
Family: unix Class: patch
Reference(s): DSA-1874
CVE-2009-2404
CVE-2009-2408
CVE-2009-2409
Version: 3
Platform(s): Debian GNU/Linux 5.0
Product(s): nss
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:8594
 
Oval ID: oval:org.mitre.oval:def:8594
Title: VMware Network Security Services (NSS) certificate spoofing vulnerability by using MD2 design flaw
Description: The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.
Family: unix Class: vulnerability
Reference(s): CVE-2009-2409
Version: 4
Platform(s): VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9663
 
Oval ID: oval:org.mitre.oval:def:9663
Title: The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service (memory consumption) via a large series of "future epoch" DTLS records that are buffered in a queue, aka "DTLS record buffer limitation bug."
Description: The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service (memory consumption) via a large series of "future epoch" DTLS records that are buffered in a queue, aka "DTLS record buffer limitation bug."
Family: unix Class: vulnerability
Reference(s): CVE-2009-1377
Version: 5
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9744
 
Oval ID: oval:org.mitre.oval:def:9744
Title: Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service (openssl s_client crash) and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server that uses a crafted server certificate.
Description: Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service (openssl s_client crash) and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server that uses a crafted server certificate.
Family: unix Class: vulnerability
Reference(s): CVE-2009-1379
Version: 5
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Application 31
Application 211
Application 3
Os 4

ExploitDB Exploits

id Description
2009-06-04 OpenSSL < 0.9.8i DTLS ChangeCipherSpec Remote DoS Exploit
2009-05-18 OpenSSL <= 0.9.8k, 1.0.0-beta2 DTLS Remote Memory Exhaustion DoS

OpenVAS Exploits

Date Description
2012-04-16 Name : VMSA-2010-0009: ESXi utilities and ESX Service Console third party updates
File : nvt/gb_VMSA-2010-0009.nasl
2011-08-09 Name : CentOS Update for gnutls CESA-2010:0166 centos5 i386
File : nvt/gb_CESA-2010_0166_gnutls_centos5_i386.nasl
2011-08-09 Name : CentOS Update for openssl CESA-2010:0054 centos5 i386
File : nvt/gb_CESA-2010_0054_openssl_centos5_i386.nasl
2011-08-09 Name : CentOS Update for java CESA-2009:1584 centos5 i386
File : nvt/gb_CESA-2009_1584_java_centos5_i386.nasl
2011-08-09 Name : CentOS Update for seamonkey CESA-2009:1432 centos3 i386
File : nvt/gb_CESA-2009_1432_seamonkey_centos3_i386.nasl
2011-08-09 Name : CentOS Update for openssl CESA-2009:1335 centos5 i386
File : nvt/gb_CESA-2009_1335_openssl_centos5_i386.nasl
2010-06-25 Name : Fedora Update for openssl FEDORA-2010-9421
File : nvt/gb_fedora_2010_9421_openssl_fc11.nasl
2010-05-12 Name : Mac OS X 10.6.2 Update / Mac OS X Security Update 2009-006
File : nvt/macosx_upd_10_6_2_secupd_2009-006.nasl
2010-04-30 Name : Mandriva Update for java-1.6.0-openjdk MDVSA-2010:084 (java-1.6.0-openjdk)
File : nvt/gb_mandriva_MDVSA_2010_084.nasl
2010-04-19 Name : Fedora Update for openssl FEDORA-2010-5357
File : nvt/gb_fedora_2010_5357_openssl_fc11.nasl
2010-03-31 Name : RedHat Update for gnutls RHSA-2010:0166-01
File : nvt/gb_RHSA-2010_0166-01_gnutls.nasl
2010-03-31 Name : RedHat Update for openssl RHSA-2010:0163-01
File : nvt/gb_RHSA-2010_0163-01_openssl.nasl
2010-03-31 Name : CentOS Update for openssl CESA-2010:0163 centos4 i386
File : nvt/gb_CESA-2010_0163_openssl_centos4_i386.nasl
2010-03-31 Name : CentOS Update for openssl CESA-2010:0163 centos3 i386
File : nvt/gb_CESA-2010_0163_openssl_centos3_i386.nasl
2010-03-02 Name : Mandriva Update for x11-driver-video-ati MDVA-2010:084 (x11-driver-video-ati)
File : nvt/gb_mandriva_MDVA_2010_084.nasl
2010-01-20 Name : RedHat Update for openssl RHSA-2010:0054-01
File : nvt/gb_RHSA-2010_0054-01_openssl.nasl
2009-12-14 Name : Gentoo Security Advisory GLSA 200912-01 (openssl)
File : nvt/glsa_200912_01.nasl
2009-12-10 Name : Mandriva Security Advisory MDVSA-2009:310 (openssl)
File : nvt/mdksa_2009_310.nasl
2009-12-10 Name : Mandriva Security Advisory MDVSA-2009:197-3 (nss)
File : nvt/mdksa_2009_197_3.nasl
2009-11-23 Name : Debian Security Advisory DSA 1935-1 (gnutls13 gnutls26)
File : nvt/deb_1935_1.nasl
2009-11-23 Name : CentOS Security Advisory CESA-2009:1584 (java-1.6.0-openjdk)
File : nvt/ovcesa2009_1584.nasl
2009-11-17 Name : Fedora Core 10 FEDORA-2009-11490 (java-1.6.0-openjdk)
File : nvt/fcore_2009_11490.nasl
2009-11-17 Name : Fedora Core 12 FEDORA-2009-11489 (java-1.6.0-openjdk)
File : nvt/fcore_2009_11489.nasl
2009-11-17 Name : Fedora Core 11 FEDORA-2009-11486 (java-1.6.0-openjdk)
File : nvt/fcore_2009_11486.nasl
2009-11-17 Name : RedHat Security Advisory RHSA-2009:1584
File : nvt/RHSA_2009_1584.nasl
2009-11-17 Name : RedHat Security Advisory RHSA-2009:1571
File : nvt/RHSA_2009_1571.nasl
2009-11-11 Name : RedHat Security Advisory RHSA-2009:1560
File : nvt/RHSA_2009_1560.nasl
2009-10-13 Name : SLES10: Security update for OpenSSL
File : nvt/sles10_openssl2.nasl
2009-10-13 Name : SLES10: Security update for OpenSSL
File : nvt/sles10_openssl0.nasl
2009-10-13 Name : Mandrake Security Advisory MDVSA-2009:258 (openssl)
File : nvt/mdksa_2009_258.nasl
2009-10-11 Name : SLES11: Security update for OpenSSL
File : nvt/sles11_libopenssl0_9_80.nasl
2009-10-11 Name : SLES11: Security update for OpenSSL
File : nvt/sles11_libopenssl0_9_81.nasl
2009-09-28 Name : Mandrake Security Advisory MDVSA-2009:239 (openssl)
File : nvt/mdksa_2009_239.nasl
2009-09-28 Name : Mandrake Security Advisory MDVSA-2009:237 (openssl)
File : nvt/mdksa_2009_237.nasl
2009-09-28 Name : Mandrake Security Advisory MDVSA-2009:238 (openssl)
File : nvt/mdksa_2009_238.nasl
2009-09-21 Name : CentOS Security Advisory CESA-2009:1335 (openssl)
File : nvt/ovcesa2009_1335.nasl
2009-09-21 Name : Debian Security Advisory DSA 1888-1 (openssl, openssl097)
File : nvt/deb_1888_1.nasl
2009-09-15 Name : CentOS Security Advisory CESA-2009:1432 (seamonkey)
File : nvt/ovcesa2009_1432.nasl
2009-09-15 Name : RedHat Security Advisory RHSA-2009:1432
File : nvt/RHSA_2009_1432.nasl
2009-09-15 Name : Mandrake Security Advisory MDVSA-2009:197-2 (nss)
File : nvt/mdksa_2009_197_2.nasl
2009-09-15 Name : Ubuntu USN-830-1 (openssl)
File : nvt/ubuntu_830_1.nasl
2009-09-09 Name : RedHat Security Advisory RHSA-2009:1335
File : nvt/RHSA_2009_1335.nasl
2009-09-02 Name : Ubuntu USN-809-1 (gnutls26)
File : nvt/ubuntu_809_1.nasl
2009-09-02 Name : Debian Security Advisory DSA 1874-1 (nss)
File : nvt/deb_1874_1.nasl
2009-09-02 Name : Mandrake Security Advisory MDVSA-2009:216 (mozilla-thunderbird)
File : nvt/mdksa_2009_216.nasl
2009-08-17 Name : Ubuntu USN-810-1 (nss)
File : nvt/ubuntu_810_1.nasl
2009-08-17 Name : Ubuntu USN-810-2 (fixed)
File : nvt/ubuntu_810_2.nasl
2009-08-17 Name : RedHat Security Advisory RHSA-2009:1186
File : nvt/RHSA_2009_1186.nasl
2009-08-17 Name : RedHat Security Advisory RHSA-2009:1184
File : nvt/RHSA_2009_1184.nasl
2009-08-17 Name : RedHat Security Advisory RHSA-2009:1190
File : nvt/RHSA_2009_1190.nasl
2009-08-17 Name : RedHat Security Advisory RHSA-2009:1207
File : nvt/RHSA_2009_1207.nasl
2009-08-17 Name : Mandrake Security Advisory MDVSA-2009:197 (nss)
File : nvt/mdksa_2009_197.nasl
2009-08-05 Name : OpenSSL/GnuTLS SSL Server Spoofing Vulnerability (Win)
File : nvt/gb_openssl_n_gnutls_ssl_spoof_vuln_win.nasl
2009-08-05 Name : Firefox SSL Server Spoofing Vulnerability (Win)
File : nvt/gb_firefox_ssl_spoof_vuln_win.nasl
2009-07-06 Name : SuSE Security Summary SUSE-SR:2009:012
File : nvt/suse_sr_2009_012.nasl
2009-06-30 Name : Ubuntu USN-792-1 (openssl)
File : nvt/ubuntu_792_1.nasl
2009-06-23 Name : Fedora Core 9 FEDORA-2009-5423 (openssl)
File : nvt/fcore_2009_5423.nasl
2009-06-23 Name : Fedora Core 10 FEDORA-2009-5412 (openssl)
File : nvt/fcore_2009_5412.nasl
2009-06-23 Name : Fedora Core 11 FEDORA-2009-5452 (openssl)
File : nvt/fcore_2009_5452.nasl
2009-06-15 Name : SuSE Security Summary SUSE-SR:2009:011
File : nvt/suse_sr_2009_011.nasl
2009-06-12 Name : Denial Of Service Vulnerability in OpenSSL June-09 (Linux)
File : nvt/gb_openssl_dos_vuln_lin_jun09.nasl
2009-06-05 Name : FreeBSD Ports: opensll
File : nvt/freebsd_opensll.nasl
2009-06-05 Name : Mandrake Security Advisory MDVSA-2009:120 (openssl)
File : nvt/mdksa_2009_120.nasl
2009-05-28 Name : OpenSSL DTLS Packets Multiple DOS Vulnerabilities (win)
File : nvt/secpod_openssl_mult_dos_vuln_win.nasl
2009-05-28 Name : OpenSSL DTLS Packets Multiple Denial of Service Vulnerabilities (Linux)
File : nvt/secpod_openssl_mult_dos_vuln_lin.nasl
0000-00-00 Name : Slackware Advisory SSA:2010-060-02 openssl
File : nvt/esoft_slk_ssa_2010_060_02.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
56752 Network Security Services (NSS) Library X.509 Certificate MD2 Hash Collision ...

55073 OpenSSL ssl/s3_pkt.c DTLS ChangeCipherSpec Packet Handling Remote DoS

55072 OpenSSL ssl/d1_both.cdtls1_retrieve_buffered_fragment Function DTLS Handshake...

54614 OpenSSL ssl/d1_both.c dtls1_retrieve_buffered_fragment Function DTLS Packet H...

54613 OpenSSL ssl/d1_both.c dtls1_process_out_of_seq_message Function DTLS Record H...

54612 OpenSSL ssl/d1_pkt.c dtls1_buffer_record Function Buffered DTLS Record Handli...

Nessus® Vulnerability Scanner

Date Description
2016-03-08 Name : The remote VMware ESX host is missing a security-related patch.
File : vmware_VMSA-2010-0019_remote.nasl - Type : ACT_GATHER_INFO
2016-03-08 Name : The remote VMware ESX host is missing a security-related patch.
File : vmware_VMSA-2010-0015_remote.nasl - Type : ACT_GATHER_INFO
2016-03-08 Name : The remote VMware ESX host is missing a security-related patch.
File : vmware_VMSA-2010-0001_remote.nasl - Type : ACT_GATHER_INFO
2016-03-08 Name : The remote VMware ESX host is missing a security-related patch.
File : vmware_VMSA-2010-0004_remote.nasl - Type : ACT_GATHER_INFO
2016-03-08 Name : The remote VMware ESX / ESXi host is missing a security-related patch.
File : vmware_VMSA-2010-0009_remote.nasl - Type : ACT_GATHER_INFO
2014-11-26 Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2014-0007.nasl - Type : ACT_GATHER_INFO
2014-11-26 Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2014-0008.nasl - Type : ACT_GATHER_INFO
2014-10-10 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL15348.nasl - Type : ACT_GATHER_INFO
2014-10-10 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL15663.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0054.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0166.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0163.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2009-1584.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2009-1432.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2009-1431.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2009-1184.nasl - Type : ACT_GATHER_INFO
2013-06-29 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2009-1584.nasl - Type : ACT_GATHER_INFO
2013-03-09 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-810-3.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1335.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1190.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1207.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20090731_nspr_and_nss_for_SL_5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20090731_nspr_and_nss_for_SL_4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20091109_java__jdk_1_6_0__on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20090909_seamonkey_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20090902_openssl_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100325_openssl_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100325_gnutls_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100119_openssl_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-01-04 Name : The remote server is affected by a denial of service vulnerability.
File : openssl_0_9_8i.nasl - Type : ACT_GATHER_INFO
2012-01-04 Name : The remote server is affected by multiple vulnerabilities.
File : openssl_0_9_8l.nasl - Type : ACT_GATHER_INFO
2012-01-04 Name : The remote server is affected by a denial of service vulnerability.
File : openssl_1_0_0.nasl - Type : ACT_GATHER_INFO
2011-04-23 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1662.nasl - Type : ACT_GATHER_INFO
2010-12-08 Name : The remote VMware ESX host is missing one or more security-related patches.
File : vmware_VMSA-2010-0019.nasl - Type : ACT_GATHER_INFO
2010-10-04 Name : The remote VMware ESX host is missing one or more security-related patches.
File : vmware_VMSA-2010-0015.nasl - Type : ACT_GATHER_INFO
2010-07-30 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-239.nasl - Type : ACT_GATHER_INFO
2010-06-01 Name : The remote VMware ESXi / ESX host is missing one or more security-related pat...
File : vmware_VMSA-2010-0009.nasl - Type : ACT_GATHER_INFO
2010-05-11 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0166.nasl - Type : ACT_GATHER_INFO
2010-05-11 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0163.nasl - Type : ACT_GATHER_INFO
2010-04-29 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2010-084.nasl - Type : ACT_GATHER_INFO
2010-04-27 Name : The remote web server has multiple vulnerabilities.
File : hpsmh_6_0_0_95.nasl - Type : ACT_GATHER_INFO
2010-03-29 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0166.nasl - Type : ACT_GATHER_INFO
2010-03-26 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0163.nasl - Type : ACT_GATHER_INFO
2010-03-05 Name : The remote VMware ESX host is missing one or more security-related patches.
File : vmware_VMSA-2010-0004.nasl - Type : ACT_GATHER_INFO
2010-03-02 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2010-060-02.nasl - Type : ACT_GATHER_INFO
2010-02-24 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1935.nasl - Type : ACT_GATHER_INFO
2010-02-24 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1888.nasl - Type : ACT_GATHER_INFO
2010-02-24 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1874.nasl - Type : ACT_GATHER_INFO
2010-01-21 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0054.nasl - Type : ACT_GATHER_INFO
2010-01-20 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0054.nasl - Type : ACT_GATHER_INFO
2010-01-08 Name : The remote VMware ESX host is missing a security-related patch.
File : vmware_VMSA-2010-0001.nasl - Type : ACT_GATHER_INFO
2010-01-06 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2009-1335.nasl - Type : ACT_GATHER_INFO
2009-12-04 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-310.nasl - Type : ACT_GATHER_INFO
2009-12-02 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200912-01.nasl - Type : ACT_GATHER_INFO
2009-11-30 Name : The remote openSUSE host is missing a security update.
File : suse_11_2_java-1_6_0-openjdk-091127.nasl - Type : ACT_GATHER_INFO
2009-11-30 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_java-1_6_0-openjdk-091125.nasl - Type : ACT_GATHER_INFO
2009-11-30 Name : The remote openSUSE host is missing a security update.
File : suse_11_1_java-1_6_0-openjdk-091125.nasl - Type : ACT_GATHER_INFO
2009-11-18 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200911-02.nasl - Type : ACT_GATHER_INFO
2009-11-17 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1584.nasl - Type : ACT_GATHER_INFO
2009-11-16 Name : The remote Fedora host is missing a security update.
File : fedora_2009-11486.nasl - Type : ACT_GATHER_INFO
2009-11-16 Name : The remote Fedora host is missing a security update.
File : fedora_2009-11489.nasl - Type : ACT_GATHER_INFO
2009-11-16 Name : The remote Fedora host is missing a security update.
File : fedora_2009-11490.nasl - Type : ACT_GATHER_INFO
2009-11-16 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-859-1.nasl - Type : ACT_GATHER_INFO
2009-11-11 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1571.nasl - Type : ACT_GATHER_INFO
2009-11-10 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1560.nasl - Type : ACT_GATHER_INFO
2009-11-09 Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_SecUpd2009-006.nasl - Type : ACT_GATHER_INFO
2009-11-09 Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_10_6_2.nasl - Type : ACT_GATHER_INFO
2009-10-08 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-258.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_openssl-6296.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_openssl-6267.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_libopenssl-devel-090522.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_openssl-090610.nasl - Type : ACT_GATHER_INFO
2009-09-22 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-238.nasl - Type : ACT_GATHER_INFO
2009-09-15 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-830-1.nasl - Type : ACT_GATHER_INFO
2009-09-11 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2009-1431.nasl - Type : ACT_GATHER_INFO
2009-09-11 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2009-1432.nasl - Type : ACT_GATHER_INFO
2009-09-10 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1432.nasl - Type : ACT_GATHER_INFO
2009-09-10 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1431.nasl - Type : ACT_GATHER_INFO
2009-08-20 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-809-1.nasl - Type : ACT_GATHER_INFO
2009-08-10 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-197.nasl - Type : ACT_GATHER_INFO
2009-08-05 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-810-1.nasl - Type : ACT_GATHER_INFO
2009-08-05 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-810-2.nasl - Type : ACT_GATHER_INFO
2009-07-31 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1186.nasl - Type : ACT_GATHER_INFO
2009-07-31 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1184.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_libopenssl-devel-090609.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_libopenssl-devel-090522.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_1_libopenssl-devel-090522.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_1_libopenssl-devel-090609.nasl - Type : ACT_GATHER_INFO
2009-06-26 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-792-1.nasl - Type : ACT_GATHER_INFO
2009-06-21 Name : The remote Fedora host is missing a security update.
File : fedora_2009-5452.nasl - Type : ACT_GATHER_INFO
2009-06-21 Name : The remote Fedora host is missing a security update.
File : fedora_2009-5423.nasl - Type : ACT_GATHER_INFO
2009-06-21 Name : The remote Fedora host is missing a security update.
File : fedora_2009-5412.nasl - Type : ACT_GATHER_INFO
2009-06-18 Name : The remote openSUSE host is missing a security update.
File : suse_libopenssl-devel-6291.nasl - Type : ACT_GATHER_INFO
2009-06-01 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_82b55df84d5a11de88110030843d3802.nasl - Type : ACT_GATHER_INFO
2009-05-27 Name : The remote openSUSE host is missing a security update.
File : suse_libopenssl-devel-6268.nasl - Type : ACT_GATHER_INFO
2009-05-22 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-120.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:28:50
  • Multiple Updates