Vulnerabilities > CVE-2010-4180

OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier.

Vulnerable Configurations

Part	Description	Count
Application	Openssl Openssl Openssl 1.0.0 Openssl Openssl 1.0.0A Openssl Openssl 1.0.0B Openssl Openssl - Openssl Openssl 0.9.1C Openssl Openssl 0.9.2B Openssl Openssl 0.9.3 Openssl Openssl 0.9.3A Openssl Openssl 0.9.4 Openssl Openssl 0.9.5 Openssl Openssl 0.9.5A Openssl Openssl 0.9.6 Openssl Openssl 0.9.6A Openssl Openssl 0.9.6B Openssl Openssl 0.9.6C Openssl Openssl 0.9.6D Openssl Openssl 0.9.6E Openssl Openssl 0.9.6F Openssl Openssl 0.9.6G Openssl Openssl 0.9.6H Openssl Openssl 0.9.6I Openssl Openssl 0.9.6J Openssl Openssl 0.9.6K Openssl Openssl 0.9.6L Openssl Openssl 0.9.6M Openssl Openssl 0.9.7 Openssl Openssl 0.9.7A Openssl Openssl 0.9.7B Openssl Openssl 0.9.7C Openssl Openssl 0.9.7D Openssl Openssl 0.9.7E Openssl Openssl 0.9.7F Openssl Openssl 0.9.7G Openssl Openssl 0.9.7H Openssl Openssl 0.9.7I Openssl Openssl 0.9.7J Openssl Openssl 0.9.7K Openssl Openssl 0.9.7L Openssl Openssl 0.9.7M Openssl Openssl 0.9.8 Openssl Openssl 0.9.8A Openssl Openssl 0.9.8B Openssl Openssl 0.9.8C Openssl Openssl 0.9.8C-1 Openssl Openssl 0.9.8D Openssl Openssl 0.9.8E Openssl Openssl 0.9.8F Openssl Openssl 0.9.8G Openssl Openssl 0.9.8G-9 Openssl Openssl 0.9.8H Openssl Openssl 0.9.8I Openssl Openssl 0.9.8J Openssl Openssl 0.9.8K Openssl Openssl 0.9.8L Openssl Openssl 0.9.8M Openssl Openssl 0.9.8N Openssl Openssl 0.9.8O Openssl Openssl 0.9.8P	99
Application	F5 F5 Nginx 0.1.0 F5 Nginx 0.1.1 F5 Nginx 0.1.2 F5 Nginx 0.1.3 F5 Nginx 0.1.4 F5 Nginx 0.1.5 F5 Nginx 0.1.6 F5 Nginx 0.1.7 F5 Nginx 0.1.8 F5 Nginx 0.1.9 F5 Nginx 0.1.10 F5 Nginx 0.1.11 F5 Nginx 0.1.12 F5 Nginx 0.1.13 F5 Nginx 0.1.14 F5 Nginx 0.1.15 F5 Nginx 0.1.16 F5 Nginx 0.1.17 F5 Nginx 0.1.18 F5 Nginx 0.1.19 F5 Nginx 0.1.20 F5 Nginx 0.1.21 F5 Nginx 0.1.22 F5 Nginx 0.1.23 F5 Nginx 0.1.24 F5 Nginx 0.1.25 F5 Nginx 0.1.26 F5 Nginx 0.1.27 F5 Nginx 0.1.28 F5 Nginx 0.1.29 F5 Nginx 0.1.30 F5 Nginx 0.1.31 F5 Nginx 0.1.32 F5 Nginx 0.1.33 F5 Nginx 0.1.34 F5 Nginx 0.1.35 F5 Nginx 0.1.36 F5 Nginx 0.1.37 F5 Nginx 0.1.38 F5 Nginx 0.1.39 F5 Nginx 0.1.40 F5 Nginx 0.1.41 F5 Nginx 0.1.42 F5 Nginx 0.1.43 F5 Nginx 0.1.44 F5 Nginx 0.1.45 F5 Nginx 0.2.0 F5 Nginx 0.2.1 F5 Nginx 0.2.2 F5 Nginx 0.2.3 F5 Nginx 0.2.4 F5 Nginx 0.2.5 F5 Nginx 0.2.6 F5 Nginx 0.3.0 F5 Nginx 0.3.1 F5 Nginx 0.3.2 F5 Nginx 0.3.3 F5 Nginx 0.3.4 F5 Nginx 0.3.5 F5 Nginx 0.3.6 F5 Nginx 0.3.7 F5 Nginx 0.3.8 F5 Nginx 0.3.9 F5 Nginx 0.3.10 F5 Nginx 0.3.11 F5 Nginx 0.3.12 F5 Nginx 0.3.13 F5 Nginx 0.3.14 F5 Nginx 0.3.15 F5 Nginx 0.3.16 F5 Nginx 0.3.17 F5 Nginx 0.3.18 F5 Nginx 0.3.19 F5 Nginx 0.3.20 F5 Nginx 0.3.21 F5 Nginx 0.3.22 F5 Nginx 0.3.23 F5 Nginx 0.3.24 F5 Nginx 0.3.25 F5 Nginx 0.3.26 F5 Nginx 0.3.27 F5 Nginx 0.3.28 F5 Nginx 0.3.29 F5 Nginx 0.3.30 F5 Nginx 0.3.31 F5 Nginx 0.3.32 F5 Nginx 0.3.33 F5 Nginx 0.3.34 F5 Nginx 0.3.35 F5 Nginx 0.3.36 F5 Nginx 0.3.37 F5 Nginx 0.3.38 F5 Nginx 0.3.39 F5 Nginx 0.3.40 F5 Nginx 0.3.41 F5 Nginx 0.3.42 F5 Nginx 0.3.43 F5 Nginx 0.3.44 F5 Nginx 0.3.45 F5 Nginx 0.3.46 F5 Nginx 0.3.47 F5 Nginx 0.3.48 F5 Nginx 0.3.49 F5 Nginx 0.3.50 F5 Nginx 0.3.51 F5 Nginx 0.3.52 F5 Nginx 0.3.53 F5 Nginx 0.3.54 F5 Nginx 0.3.55 F5 Nginx 0.3.56 F5 Nginx 0.3.57 F5 Nginx 0.3.58 F5 Nginx 0.3.59 F5 Nginx 0.3.60 F5 Nginx 0.3.61 F5 Nginx 0.4.0 F5 Nginx 0.4.1 F5 Nginx 0.4.2 F5 Nginx 0.4.3 F5 Nginx 0.4.4 F5 Nginx 0.4.5 F5 Nginx 0.4.6 F5 Nginx 0.4.7 F5 Nginx 0.4.8 F5 Nginx 0.4.9 F5 Nginx 0.4.10 F5 Nginx 0.4.11 F5 Nginx 0.4.12 F5 Nginx 0.4.13 F5 Nginx 0.4.14 F5 Nginx 0.5.0 F5 Nginx 0.5.1 F5 Nginx 0.5.2 F5 Nginx 0.5.3 F5 Nginx 0.5.4 F5 Nginx 0.5.5 F5 Nginx 0.5.6 F5 Nginx 0.5.7 F5 Nginx 0.5.8 F5 Nginx 0.5.9 F5 Nginx 0.5.10 F5 Nginx 0.5.11 F5 Nginx 0.5.12 F5 Nginx 0.5.13 F5 Nginx 0.5.14 F5 Nginx 0.5.15 F5 Nginx 0.5.16 F5 Nginx 0.5.17 F5 Nginx 0.5.18 F5 Nginx 0.5.19 F5 Nginx 0.5.20 F5 Nginx 0.5.21 F5 Nginx 0.5.22 F5 Nginx 0.5.23 F5 Nginx 0.5.24 F5 Nginx 0.5.25 F5 Nginx 0.5.26 F5 Nginx 0.5.27 F5 Nginx 0.5.28 F5 Nginx 0.5.29 F5 Nginx 0.5.30 F5 Nginx 0.5.31 F5 Nginx 0.5.32 F5 Nginx 0.5.33 F5 Nginx 0.5.34 F5 Nginx 0.5.35 F5 Nginx 0.5.36 F5 Nginx 0.5.37 F5 Nginx 0.5.38 F5 Nginx 0.6.0 F5 Nginx 0.6.1 F5 Nginx 0.6.2 F5 Nginx 0.6.3 F5 Nginx 0.6.4 F5 Nginx 0.6.5 F5 Nginx 0.6.6 F5 Nginx 0.6.7 F5 Nginx 0.6.8 F5 Nginx 0.6.9 F5 Nginx 0.6.10 F5 Nginx 0.6.11 F5 Nginx 0.6.12 F5 Nginx 0.6.13 F5 Nginx 0.6.14 F5 Nginx 0.6.15 F5 Nginx 0.6.16 F5 Nginx 0.6.17 F5 Nginx 0.6.18 F5 Nginx 0.6.19 F5 Nginx 0.6.20 F5 Nginx 0.6.21 F5 Nginx 0.6.22 F5 Nginx 0.6.23 F5 Nginx 0.6.24 F5 Nginx 0.6.25 F5 Nginx 0.6.26 F5 Nginx 0.6.27 F5 Nginx 0.6.28 F5 Nginx 0.6.29 F5 Nginx 0.6.30 F5 Nginx 0.6.31 F5 Nginx 0.6.32 F5 Nginx 0.6.33 F5 Nginx 0.6.34 F5 Nginx 0.6.35 F5 Nginx 0.6.36 F5 Nginx 0.6.37 F5 Nginx 0.6.38 F5 Nginx 0.6.39 F5 Nginx 0.7.0 F5 Nginx 0.7.1 F5 Nginx 0.7.2 F5 Nginx 0.7.3 F5 Nginx 0.7.4 F5 Nginx 0.7.5 F5 Nginx 0.7.6 F5 Nginx 0.7.7 F5 Nginx 0.7.8 F5 Nginx 0.7.9 F5 Nginx 0.7.10 F5 Nginx 0.7.11 F5 Nginx 0.7.12 F5 Nginx 0.7.13 F5 Nginx 0.7.14 F5 Nginx 0.7.15 F5 Nginx 0.7.16 F5 Nginx 0.7.17 F5 Nginx 0.7.18 F5 Nginx 0.7.19 F5 Nginx 0.7.20 F5 Nginx 0.7.21 F5 Nginx 0.7.22 F5 Nginx 0.7.23 F5 Nginx 0.7.24 F5 Nginx 0.7.25 F5 Nginx 0.7.26 F5 Nginx 0.7.27 F5 Nginx 0.7.28 F5 Nginx 0.7.29 F5 Nginx 0.7.30 F5 Nginx 0.7.31 F5 Nginx 0.7.32 F5 Nginx 0.7.33 F5 Nginx 0.7.34 F5 Nginx 0.7.35 F5 Nginx 0.7.36 F5 Nginx 0.7.37 F5 Nginx 0.7.38 F5 Nginx 0.7.39 F5 Nginx 0.7.40 F5 Nginx 0.7.41 F5 Nginx 0.7.42 F5 Nginx 0.7.43 F5 Nginx 0.7.44 F5 Nginx 0.7.45 F5 Nginx 0.7.46 F5 Nginx 0.7.47 F5 Nginx 0.7.48 F5 Nginx 0.7.49 F5 Nginx 0.7.50 F5 Nginx 0.7.51 F5 Nginx 0.7.52 F5 Nginx 0.7.53 F5 Nginx 0.7.54 F5 Nginx 0.7.55 F5 Nginx 0.7.56 F5 Nginx 0.7.57 F5 Nginx 0.7.58 F5 Nginx 0.7.59 F5 Nginx 0.7.60 F5 Nginx 0.7.61 F5 Nginx 0.7.62 F5 Nginx 0.7.63 F5 Nginx 0.7.64 F5 Nginx 0.7.65 F5 Nginx 0.7.66 F5 Nginx 0.7.67 F5 Nginx 0.7.68 F5 Nginx 0.7.69 F5 Nginx 0.8.0 F5 Nginx 0.8.1 F5 Nginx 0.8.2 F5 Nginx 0.8.3 F5 Nginx 0.8.4 F5 Nginx 0.8.5 F5 Nginx 0.8.6 F5 Nginx 0.8.7 F5 Nginx 0.8.8 F5 Nginx 0.8.9 F5 Nginx 0.8.10 F5 Nginx 0.8.11 F5 Nginx 0.8.12 F5 Nginx 0.8.13 F5 Nginx 0.8.14 F5 Nginx 0.8.15 F5 Nginx 0.8.16 F5 Nginx 0.8.17 F5 Nginx 0.8.18 F5 Nginx 0.8.19 F5 Nginx 0.8.20 F5 Nginx 0.8.21 F5 Nginx 0.8.22 F5 Nginx 0.8.23 F5 Nginx 0.8.24 F5 Nginx 0.8.25 F5 Nginx 0.8.26 F5 Nginx 0.8.27 F5 Nginx 0.8.28 F5 Nginx 0.8.29 F5 Nginx 0.8.30 F5 Nginx 0.8.31 F5 Nginx 0.8.32 F5 Nginx 0.8.33 F5 Nginx 0.8.34 F5 Nginx 0.8.35 F5 Nginx 0.8.36 F5 Nginx 0.8.37 F5 Nginx 0.8.38 F5 Nginx 0.8.39 F5 Nginx 0.8.40 F5 Nginx 0.8.41 F5 Nginx 0.8.42 F5 Nginx 0.8.43 F5 Nginx 0.8.44 F5 Nginx 0.8.45 F5 Nginx 0.8.46 F5 Nginx 0.8.47 F5 Nginx 0.8.48 F5 Nginx 0.8.49 F5 Nginx 0.8.50 F5 Nginx 0.8.51 F5 Nginx 0.8.52 F5 Nginx 0.8.53 F5 Nginx 0.8.54 F5 Nginx 0.8.55 F5 Nginx 0.9.0 F5 Nginx 0.9.1	337
OS	Fedoraproject Fedoraproject Fedora 13 Fedoraproject Fedora 14	2
OS	Debian Debian Debian Linux 5.0	1
OS	Canonical Canonical Ubuntu Linux 10.10 Canonical Ubuntu Linux 9.04 Canonical Ubuntu Linux 8.04 Canonical Ubuntu Linux 10.04 Canonical Ubuntu Linux 6.06	5
OS	Suse Suse Linux Enterprise Desktop 11 Suse Linux Enterprise Desktop 10 Suse Linux Enterprise Server 9 Suse Linux Enterprise Server 10 Suse Linux Enterprise 11.0	7
OS	Opensuse Opensuse Opensuse 11.1 Opensuse Opensuse 11.4 Opensuse Opensuse 11.2 Opensuse Opensuse 11.3	4

Nessus

NASL family	VMware ESX Local Security Checks
NASL id	VMWARE_VMSA-2012-0013.NASL
description	a. vCenter and ESX update to JRE 1.6.0 Update 31 The Oracle (Sun) JRE is updated to version 1.6.0_31, which addresses multiple security issues. Oracle has documented the CVE identifiers that are addressed by this update in the Oracle Java SE Critical Patch Update Advisory of February 2012. b. vCenter Update Manager update to JRE 1.5.0 Update 36 The Oracle (Sun) JRE is updated to 1.5.0_36 to address multiple security issues. Oracle has documented the CVE identifiers that are addressed in JRE 1.5.0_36 in the Oracle Java SE Critical Patch Update Advisory for June 2012. c. Update to ESX/ESXi userworld OpenSSL library The ESX/ESXi userworld OpenSSL library is updated from version 0.9.8p to version 0.9.8t to resolve multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-4180, CVE-2010-4252, CVE-2011-0014, CVE-2011-4108, CVE-2011-4109, CVE-2011-4576, CVE-2011-4577, CVE-2011-4619, and CVE-2012-0050 to these issues. d. Update to ESX service console OpenSSL RPM The service console OpenSSL RPM is updated to version 0.9.8e-22.el5_8.3 to resolve a security issue. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2012-2110 to this issue. e. Update to ESX service console kernel The ESX service console kernel is updated to resolve multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2011-1833, CVE-2011-2484, CVE-2011-2496, CVE-2011-3188, CVE-2011-3209, CVE-2011-3363, CVE-2011-4110, CVE-2011-1020, CVE-2011-4132, CVE-2011-4324, CVE-2011-4325, CVE-2012-0207, CVE-2011-2699, and CVE-2012-1583 to these issues. f. Update to ESX service console Perl RPM The ESX service console Perl RPM is updated to perl-5.8.8.32.1.8999.vmw to resolve multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-2761, CVE-2010-4410, and CVE-2011-3597 to these issues. g. Update to ESX service console libxml2 RPMs The ESX service console libmxl2 RPMs are updated to libxml2-2.6.26-2.1.15.el5_8.2 and libxml2-python-2.6.26-2.1.15.el5_8.2 to resolve a security issue. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2012-0841 to this issue. h. Update to ESX service console glibc RPM The ESX service console glibc RPM is updated to version glibc-2.5-81.el5_8.1 to resolve multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2009-5029, CVE-2009-5064, CVE-2010-0830, CVE-2011-1089, CVE-2011-4609, and CVE-2012-0864 to these issue. i. Update to ESX service console GnuTLS RPM The ESX service console GnuTLS RPM is updated to version 1.4.1-7.el5_8.2 to resolve multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2011-4128, CVE-2012-1569, and CVE-2012-1573 to these issues. j. Update to ESX service console popt, rpm, rpm-libs, and rpm-python RPMS The ESX service console popt, rpm, rpm-libs, and rpm-python RPMS are updated to the following versions to resolve multiple security issues : - popt-1.10.2.3-28.el5_8 - rpm-4.4.2.3-28.el5_8 - rpm-libs-4.4.2.3-28.el5_8 - rpm-python-4.4.2.3-28.el5_8 The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2012-0060, CVE-2012-0061, and CVE-2012-0815 to these issues. k. Vulnerability in third-party Apache Struts component The version of Apache Struts in vCenter Operations has been updated to 2.3.4 which addresses an arbitrary file overwrite vulnerability. This vulnerability allows an attacker to create a denial of service by overwriting arbitrary files without authentication. The attacker would need to be on the same network as the system where vCOps is installed. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2012-0393 to this issue. Note: Apache struts 2.3.4 addresses the following issues as well : CVE-2011-5057, CVE-2012-0391, CVE-2012-0392, CVE-2012-0394. It was found that these do not affect vCOps. VMware would like to thank Alexander Minozhenko from ERPScan for reporting this issue to us.
last seen	2020-06-01
modified	2020-06-02
plugin id	61747
published	2012-08-31
reporter	This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/61747
title	VMSA-2012-0013 : VMware vSphere and vCOps updates to third-party libraries
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from VMware Security Advisory 2012-0013. # The text itself is copyright (C) VMware Inc. # include("compat.inc"); if (description) { script_id(61747); script_version("1.56"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/07/30"); script_cve_id("CVE-2009-5029", "CVE-2009-5064", "CVE-2010-0830", "CVE-2010-2761", "CVE-2010-4180", "CVE-2010-4252", "CVE-2010-4410", "CVE-2011-0014", "CVE-2011-1020", "CVE-2011-1089", "CVE-2011-1833", "CVE-2011-2484", "CVE-2011-2496", "CVE-2011-2699", "CVE-2011-3188", "CVE-2011-3209", "CVE-2011-3363", "CVE-2011-3597", "CVE-2011-4108", "CVE-2011-4109", "CVE-2011-4110", "CVE-2011-4128", "CVE-2011-4132", "CVE-2011-4324", "CVE-2011-4325", "CVE-2011-4576", "CVE-2011-4577", "CVE-2011-4609", "CVE-2011-4619", "CVE-2012-0050", "CVE-2012-0060", "CVE-2012-0061", "CVE-2012-0207", "CVE-2012-0393", "CVE-2012-0815", "CVE-2012-0841", "CVE-2012-0864", "CVE-2012-1569", "CVE-2012-1573", "CVE-2012-1583", "CVE-2012-2110"); script_bugtraq_id(40063, 44199, 45145, 45163, 45164, 46264, 46567, 46740, 47321, 48383, 48802, 49108, 49289, 49626, 49911, 50311, 50609, 50663, 50755, 50798, 50898, 51194, 51257, 51281, 51343, 51366, 51439, 51467, 51563, 52009, 52010, 52011, 52012, 52013, 52014, 52015, 52016, 52017, 52018, 52019, 52020, 52107, 52161, 52201, 52667, 52668, 52865, 53136, 53139, 53158, 53946, 53947, 53948, 53949, 53950, 53951, 53952, 53953, 53954, 53956, 53958, 53959, 53960); script_xref(name:"VMSA", value:"2012-0013"); script_name(english:"VMSA-2012-0013 : VMware vSphere and vCOps updates to third-party libraries"); script_summary(english:"Checks esxupdate output for the patches"); script_set_attribute( attribute:"synopsis", value: "The remote VMware ESXi / ESX host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "a. vCenter and ESX update to JRE 1.6.0 Update 31 The Oracle (Sun) JRE is updated to version 1.6.0_31, which addresses multiple security issues. Oracle has documented the CVE identifiers that are addressed by this update in the Oracle Java SE Critical Patch Update Advisory of February 2012. b. vCenter Update Manager update to JRE 1.5.0 Update 36 The Oracle (Sun) JRE is updated to 1.5.0_36 to address multiple security issues. Oracle has documented the CVE identifiers that are addressed in JRE 1.5.0_36 in the Oracle Java SE Critical Patch Update Advisory for June 2012. c. Update to ESX/ESXi userworld OpenSSL library The ESX/ESXi userworld OpenSSL library is updated from version 0.9.8p to version 0.9.8t to resolve multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-4180, CVE-2010-4252, CVE-2011-0014, CVE-2011-4108, CVE-2011-4109, CVE-2011-4576, CVE-2011-4577, CVE-2011-4619, and CVE-2012-0050 to these issues. d. Update to ESX service console OpenSSL RPM The service console OpenSSL RPM is updated to version 0.9.8e-22.el5_8.3 to resolve a security issue. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2012-2110 to this issue. e. Update to ESX service console kernel The ESX service console kernel is updated to resolve multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2011-1833, CVE-2011-2484, CVE-2011-2496, CVE-2011-3188, CVE-2011-3209, CVE-2011-3363, CVE-2011-4110, CVE-2011-1020, CVE-2011-4132, CVE-2011-4324, CVE-2011-4325, CVE-2012-0207, CVE-2011-2699, and CVE-2012-1583 to these issues. f. Update to ESX service console Perl RPM The ESX service console Perl RPM is updated to perl-5.8.8.32.1.8999.vmw to resolve multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-2761, CVE-2010-4410, and CVE-2011-3597 to these issues. g. Update to ESX service console libxml2 RPMs The ESX service console libmxl2 RPMs are updated to libxml2-2.6.26-2.1.15.el5_8.2 and libxml2-python-2.6.26-2.1.15.el5_8.2 to resolve a security issue. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2012-0841 to this issue. h. Update to ESX service console glibc RPM The ESX service console glibc RPM is updated to version glibc-2.5-81.el5_8.1 to resolve multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2009-5029, CVE-2009-5064, CVE-2010-0830, CVE-2011-1089, CVE-2011-4609, and CVE-2012-0864 to these issue. i. Update to ESX service console GnuTLS RPM The ESX service console GnuTLS RPM is updated to version 1.4.1-7.el5_8.2 to resolve multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2011-4128, CVE-2012-1569, and CVE-2012-1573 to these issues. j. Update to ESX service console popt, rpm, rpm-libs, and rpm-python RPMS The ESX service console popt, rpm, rpm-libs, and rpm-python RPMS are updated to the following versions to resolve multiple security issues : - popt-1.10.2.3-28.el5_8 - rpm-4.4.2.3-28.el5_8 - rpm-libs-4.4.2.3-28.el5_8 - rpm-python-4.4.2.3-28.el5_8 The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2012-0060, CVE-2012-0061, and CVE-2012-0815 to these issues. k. Vulnerability in third-party Apache Struts component The version of Apache Struts in vCenter Operations has been updated to 2.3.4 which addresses an arbitrary file overwrite vulnerability. This vulnerability allows an attacker to create a denial of service by overwriting arbitrary files without authentication. The attacker would need to be on the same network as the system where vCOps is installed. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2012-0393 to this issue. Note: Apache struts 2.3.4 addresses the following issues as well : CVE-2011-5057, CVE-2012-0391, CVE-2012-0392, CVE-2012-0394. It was found that these do not affect vCOps. VMware would like to thank Alexander Minozhenko from ERPScan for reporting this issue to us." ); script_set_attribute( attribute:"see_also", value:"http://lists.vmware.com/pipermail/security-announce/2012/000197.html" ); script_set_attribute(attribute:"solution", value:"Apply the missing patches."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'Java Applet Field Bytecode Verifier Cache Remote Code Execution'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:esx:4.0"); script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:esx:4.1"); script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:esxi:4.1"); script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:esxi:5.0"); script_set_attribute(attribute:"vuln_publication_date", value:"2010/06/01"); script_set_attribute(attribute:"patch_publication_date", value:"2012/08/30"); script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/31"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"VMware ESX Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/VMware/release", "Host/VMware/version"); script_require_ports("Host/VMware/esxupdate", "Host/VMware/esxcli_software_vibs"); exit(0); } include("audit.inc"); include("vmware_esx_packages.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/VMware/release")) audit(AUDIT_OS_NOT, "VMware ESX / ESXi"); if ( !get_kb_item("Host/VMware/esxcli_software_vibs") && !get_kb_item("Host/VMware/esxupdate") ) audit(AUDIT_PACKAGE_LIST_MISSING); init_esx_check(date:"2012-08-30"); flag = 0; if ( esx_check( ver : "ESX 4.0", patch : "ESX400-201209401-SG", patch_updates : make_list("ESX400-201302401-SG", "ESX400-201305401-SG", "ESX400-201310401-SG", "ESX400-201404401-SG") ) ) flag++; if ( esx_check( ver : "ESX 4.0", patch : "ESX400-201209402-SG", patch_updates : make_list("ESX400-201305404-SG", "ESX400-201310402-SG") ) ) flag++; if (esx_check(ver:"ESX 4.0", patch:"ESX400-201209404-SG")) flag++; if ( esx_check( ver : "ESX 4.1", patch : "ESX410-201208101-SG", patch_updates : make_list("ESX410-201211401-SG", "ESX410-201301401-SG", "ESX410-201304401-SG", "ESX410-201307401-SG", "ESX410-201312401-SG", "ESX410-201404401-SG", "ESX410-Update03") ) ) flag++; if ( esx_check( ver : "ESX 4.1", patch : "ESX410-201208102-SG", patch_updates : make_list("ESX410-201301405-SG", "ESX410-201304402-SG", "ESX410-201307405-SG", "ESX410-Update03") ) ) flag++; if ( esx_check( ver : "ESX 4.1", patch : "ESX410-201208103-SG", patch_updates : make_list("ESX410-201307403-SG", "ESX410-Update03") ) ) flag++; if ( esx_check( ver : "ESX 4.1", patch : "ESX410-201208104-SG", patch_updates : make_list("ESX410-Update03") ) ) flag++; if ( esx_check( ver : "ESX 4.1", patch : "ESX410-201208105-SG", patch_updates : make_list("ESX410-Update03") ) ) flag++; if ( esx_check( ver : "ESX 4.1", patch : "ESX410-201208106-SG", patch_updates : make_list("ESX410-201307404-SG", "ESX410-Update03") ) ) flag++; if ( esx_check( ver : "ESX 4.1", patch : "ESX410-201208107-SG", patch_updates : make_list("ESX410-Update03") ) ) flag++; if ( esx_check( ver : "ESXi 4.1", patch : "ESXi410-201208101-SG", patch_updates : make_list("ESXi410-201211401-SG", "ESXi410-201301401-SG", "ESXi410-201304401-SG", "ESXi410-201307401-SG", "ESXi410-201312401-SG", "ESXi410-201404401-SG", "ESXi410-Update03") ) ) flag++; if (esx_check(ver:"ESXi 5.0", vib:"VMware:esx-base:5.0.0-1.25.912577")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:esx_report_get()); else security_hole(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");

NASL family	SuSE Local Security Checks
NASL id	SUSE_LIBCURL4-8618.NASL
description	This update of curl fixes several security issues : - libcurl URL decode buffer boundary flaw. (bnc#824517 / CVE-2013-2174) - cookie domain tailmatch. (bnc#814655 / CVE-2013-1944) - curl sets SSL_OP_ALL. (bnc#742306 / CVE-2011-3389) - When SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier. (CVE-2010-4180)
last seen	2020-06-05
modified	2013-07-10
plugin id	67223
published	2013-07-10
reporter	This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/67223
title	SuSE 10 Security Update : libcurl4 (ZYPP Patch Number 8618) (BEAST)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The text description of this plugin is (C) Novell, Inc. # if (NASL_LEVEL < 3000) exit(0); include("compat.inc"); if (description) { script_id(67223); script_version("1.4"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2010-4180", "CVE-2011-3389", "CVE-2013-1944", "CVE-2013-2174"); script_name(english:"SuSE 10 Security Update : libcurl4 (ZYPP Patch Number 8618) (BEAST)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote SuSE 10 host is missing a security-related patch." ); script_set_attribute( attribute:"description", value: "This update of curl fixes several security issues : - libcurl URL decode buffer boundary flaw. (bnc#824517 / CVE-2013-2174) - cookie domain tailmatch. (bnc#814655 / CVE-2013-1944) - curl sets SSL_OP_ALL. (bnc#742306 / CVE-2011-3389) - When SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier. (CVE-2010-4180)" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2010-4180.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2011-3389.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-1944.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2174.html" ); script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 8618."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux"); script_set_attribute(attribute:"vuln_publication_date", value:"2010/12/06"); script_set_attribute(attribute:"patch_publication_date", value:"2013/06/17"); script_set_attribute(attribute:"plugin_publication_date", value:"2013/07/10"); script_set_attribute(attribute:"in_the_news", value:"true"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled."); if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE."); if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages."); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) exit(1, "Failed to determine the architecture type."); if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented."); flag = 0; if (rpm_check(release:"SLED10", sp:4, cpu:"i586", reference:"libcurl4-7.19.0-11.6.1")) flag++; if (rpm_check(release:"SLED10", sp:4, cpu:"x86_64", reference:"libcurl4-32bit-7.19.0-11.6.1")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else exit(0, "The host is not affected.");

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_4_COMPAT-OPENSSL097G-110721.NASL
description	This update adds openssl patches since 2007 for : - CVE-2008-5077 - CVE-2009-0590 - CVE-2009-0789 - CVE-2009-3555 - CVE-2010-4180
last seen	2020-06-01
modified	2020-06-02
plugin id	75802
published	2014-06-13
reporter	This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/75802
title	openSUSE Security Update : compat-openssl097g (openSUSE-SU-2011:0845-1)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update compat-openssl097g-4909. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(75802); script_version("1.5"); script_cvs_date("Date: 2019/10/25 13:36:42"); script_cve_id("CVE-2008-5077", "CVE-2009-0590", "CVE-2009-0789", "CVE-2009-3555", "CVE-2010-4180"); script_name(english:"openSUSE Security Update : compat-openssl097g (openSUSE-SU-2011:0845-1)"); script_summary(english:"Check for the compat-openssl097g-4909 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "This update adds openssl patches since 2007 for : - CVE-2008-5077 - CVE-2009-0590 - CVE-2009-0789 - CVE-2009-3555 - CVE-2010-4180" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=707069" ); script_set_attribute( attribute:"see_also", value:"https://lists.opensuse.org/opensuse-updates/2011-07/msg00037.html" ); script_set_attribute( attribute:"solution", value:"Update the affected compat-openssl097g packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P"); script_cwe_id(20, 119, 189, 310); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:compat-openssl097g"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:compat-openssl097g-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:compat-openssl097g-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:compat-openssl097g-debuginfo-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:compat-openssl097g-debugsource"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.4"); script_set_attribute(attribute:"patch_publication_date", value:"2011/07/21"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release =~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE11\.4)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.4", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586\|i686\|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE11.4", reference:"compat-openssl097g-0.9.7g-158.159.1") ) flag++; if ( rpm_check(release:"SUSE11.4", reference:"compat-openssl097g-debuginfo-0.9.7g-158.159.1") ) flag++; if ( rpm_check(release:"SUSE11.4", reference:"compat-openssl097g-debugsource-0.9.7g-158.159.1") ) flag++; if ( rpm_check(release:"SUSE11.4", cpu:"x86_64", reference:"compat-openssl097g-32bit-0.9.7g-158.159.1") ) flag++; if ( rpm_check(release:"SUSE11.4", cpu:"x86_64", reference:"compat-openssl097g-debuginfo-32bit-0.9.7g-158.159.1") ) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "compat-openssl097g"); }

NASL family	Solaris Local Security Checks
NASL id	SOLARIS10_X86_146859-01.NASL
description	SunOS 5.10_x86: ssl patch. Date this patch was last updated by Sun : Mar/23/11
last seen	2020-06-01
modified	2020-06-02
plugin id	108092
published	2018-03-12
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/108092
title	Solaris 10 (x86) : 146859-01
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text in this plugin was # extracted from the Oracle SunOS Patch Updates. # include("compat.inc"); if (description) { script_id(108092); script_version("1.5"); script_cvs_date("Date: 2019/10/25 13:36:27"); script_cve_id("CVE-2010-4180"); script_name(english:"Solaris 10 (x86) : 146859-01"); script_summary(english:"Check for patch 146859-01"); script_set_attribute( attribute:"synopsis", value:"The remote host is missing Sun Security Patch number 146859-01" ); script_set_attribute( attribute:"description", value: "SunOS 5.10_x86: ssl patch. Date this patch was last updated by Sun : Mar/23/11" ); script_set_attribute( attribute:"see_also", value:"https://getupdates.oracle.com/readme/146859-01" ); script_set_attribute(attribute:"solution", value:"Install patch 146859-01"); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:solaris:10:146859"); script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:solaris:10"); script_set_attribute(attribute:"patch_publication_date", value:"2011/03/23"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/03/12"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Solaris Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Solaris/showrev"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("solaris.inc"); showrev = get_kb_item("Host/Solaris/showrev"); if (empty_or_null(showrev)) audit(AUDIT_OS_NOT, "Solaris"); os_ver = pregmatch(pattern:"Release: (\d+.(\d+))", string:showrev); if (empty_or_null(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Solaris"); full_ver = os_ver[1]; os_level = os_ver[2]; if (full_ver != "5.10") audit(AUDIT_OS_NOT, "Solaris 10", "Solaris " + os_level); package_arch = pregmatch(pattern:"Application architecture: (\w+)", string:showrev); if (empty_or_null(package_arch)) audit(AUDIT_UNKNOWN_ARCH); package_arch = package_arch[1]; if (package_arch != "i386") audit(AUDIT_ARCH_NOT, "i386", package_arch); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (solaris_check_patch(release:"5.10_x86", arch:"i386", patch:"146859-01", obsoleted_by:"146672-02 148072-10 ", package:"SUNWcry", version:"11.10.0,REV=2005.01.21.16.34") < 0) flag++; if (solaris_check_patch(release:"5.10_x86", arch:"i386", patch:"146859-01", obsoleted_by:"146672-02 148072-10 ", package:"SUNWopenssl-include", version:"11.10.0,REV=2005.01.21.16.34") < 0) flag++; if (solaris_check_patch(release:"5.10_x86", arch:"i386", patch:"146859-01", obsoleted_by:"146672-02 148072-10 ", package:"SUNWopenssl-libraries", version:"11.10.0,REV=2005.01.21.16.34") < 0) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : solaris_get_report() ); } else { patch_fix = solaris_patch_fix_get(); if (!empty_or_null(patch_fix)) audit(AUDIT_PATCH_INSTALLED, patch_fix, "Solaris 10"); tested = solaris_pkg_tests_get(); if (!empty_or_null(tested)) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); audit(AUDIT_PACKAGE_NOT_INSTALLED, "SUNWcry / SUNWopenssl-include / SUNWopenssl-libraries"); }

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_4_CURL-120124.NASL
description	The following vulnerabilities have been fixed in curl : - IMAP, POP3 and SMTP URL sanitization vulnerability (CVE-2012-0036) - disable SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS (CVE-2011-3389) - disable SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option for older openssl versions (CVE-2010-4180)
last seen	2020-06-05
modified	2014-06-13
plugin id	75806
published	2014-06-13
reporter	This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/75806
title	openSUSE Security Update : curl (openSUSE-SU-2012:0229-1) (BEAST)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update curl-5702. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(75806); script_version("1.7"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2010-4180", "CVE-2011-3389", "CVE-2012-0036"); script_name(english:"openSUSE Security Update : curl (openSUSE-SU-2012:0229-1) (BEAST)"); script_summary(english:"Check for the curl-5702 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "The following vulnerabilities have been fixed in curl : - IMAP, POP3 and SMTP URL sanitization vulnerability (CVE-2012-0036) - disable SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS (CVE-2011-3389) - disable SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option for older openssl versions (CVE-2010-4180)" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=740452" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=742306" ); script_set_attribute( attribute:"see_also", value:"https://lists.opensuse.org/opensuse-updates/2012-02/msg00032.html" ); script_set_attribute(attribute:"solution", value:"Update the affected curl packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:curl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:curl-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libcurl-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libcurl4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libcurl4-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libcurl4-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libcurl4-debuginfo-32bit"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.4"); script_set_attribute(attribute:"patch_publication_date", value:"2012/01/24"); script_set_attribute(attribute:"in_the_news", value:"true"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release =~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE11\.4)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.4", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586\|i686\|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE11.4", reference:"curl-7.21.2-10.11.1") ) flag++; if ( rpm_check(release:"SUSE11.4", reference:"curl-debuginfo-7.21.2-10.11.1") ) flag++; if ( rpm_check(release:"SUSE11.4", reference:"libcurl-devel-7.21.2-10.11.1") ) flag++; if ( rpm_check(release:"SUSE11.4", reference:"libcurl4-7.21.2-10.11.1") ) flag++; if ( rpm_check(release:"SUSE11.4", reference:"libcurl4-debuginfo-7.21.2-10.11.1") ) flag++; if ( rpm_check(release:"SUSE11.4", cpu:"x86_64", reference:"libcurl4-32bit-7.21.2-10.11.1") ) flag++; if ( rpm_check(release:"SUSE11.4", cpu:"x86_64", reference:"libcurl4-debuginfo-32bit-7.21.2-10.11.1") ) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "curl / libcurl-devel / libcurl4 / libcurl4-32bit / curl-debuginfo / etc"); }

NASL family	VMware ESX Local Security Checks
NASL id	VMWARE_VMSA-2011-0013.NASL
description	a. ESX third-party update for Service Console openssl RPM The Service Console openssl RPM is updated to openssl-0.9.8e.12.el5_5.7 resolving two security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2008-7270 and CVE-2010-4180 to these issues. b. ESX third-party update for Service Console libuser RPM The Service Console libuser RPM is updated to version 0.54.7-2.1.el5_5.2 to resolve a security issue. The Common Vulnerabilities and Exposures Project (cve.mitre.org) has assigned the name CVE-2011-0002 to this issue. c. ESX third-party update for Service Console nss and nspr RPMs The Service Console Network Security Services (NSS) and Netscape Portable Runtime (NSPR) libraries are updated to nspr-4.8.6-1 and nss-3.12.8-4 resolving multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-3170 and CVE-2010-3173 to these issues. d. vCenter Server and ESX, Oracle (Sun) JRE update 1.6.0_24 Oracle (Sun) JRE is updated to version 1.6.0_24, which addresses multiple security issues that existed in earlier releases of Oracle (Sun) JRE. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in JRE 1.6.0_24: CVE-2010-4422, CVE-2010-4447, CVE-2010-4448, CVE-2010-4450, CVE-2010-4451, CVE-2010-4452, CVE-2010-4454, CVE-2010-4462, CVE-2010-4463, CVE-2010-4465, CVE-2010-4466, CVE-2010-4467, CVE-2010-4468, CVE-2010-4469, CVE-2010-4470, CVE-2010-4471, CVE-2010-4472, CVE-2010-4473, CVE-2010-4474, CVE-2010-4475 and CVE-2010-4476. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in JRE 1.6.0_22: CVE-2010-1321, CVE-2010-3541, CVE-2010-3548, CVE-2010-3549, CVE-2010-3550, CVE-2010-3551, CVE-2010-3552, CVE-2010-3553, CVE-2010-3554, CVE-2010-3555, CVE-2010-3556, CVE-2010-3557, CVE-2010-3558, CVE-2010-3559, CVE-2010-3560, CVE-2010-3561, CVE-2010-3562, CVE-2010-3563, CVE-2010-3565, CVE-2010-3566, CVE-2010-3567, CVE-2010-3568, CVE-2010-3569, CVE-2010-3570, CVE-2010-3571, CVE-2010-3572, CVE-2010-3573 and CVE-2010-3574. e. vCenter Update Manager Oracle (Sun) JRE update 1.5.0_30 Oracle (Sun) JRE is updated to version 1.5.0_30, which addresses multiple security issues that existed in earlier releases of Oracle (Sun) JRE. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in Oracle (Sun) JRE 1.5.0_30: CVE-2011-0862, CVE-2011-0873, CVE-2011-0815, CVE-2011-0864, CVE-2011-0802, CVE-2011-0814, CVE-2011-0871, CVE-2011-0867 and CVE-2011-0865. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in Oracle (Sun) JRE 1.5.0_28: CVE-2010-4447, CVE-2010-4448, CVE-2010-4450, CVE-2010-4454, CVE-2010-4462, CVE-2010-4465, CVE-2010-4466, CVE-2010-4468, CVE-2010-4469, CVE-2010-4473, CVE-2010-4475, CVE-2010-4476. f. Integer overflow in VMware third-party component sfcb This release resolves an integer overflow issue present in the third-party library SFCB when the httpMaxContentLength has been changed from its default value to 0 in in /etc/sfcb/sfcb.cfg. The integer overflow could allow remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code via a large integer in the Content-Length HTTP header. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-2054 to this issue.
last seen	2020-06-01
modified	2020-06-02
plugin id	56665
published	2011-10-28
reporter	This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/56665
title	VMSA-2011-0013 : VMware third-party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX

NASL family	SuSE Local Security Checks
NASL id	SUSE_OPENSSL-7463.NASL
description	Malicious clients could have downgraded a connection to a low strength cipher suite on session resumption if the server offers such ciphers (CVE-2010-4180). This has been fixed.
last seen	2020-06-01
modified	2020-06-02
plugin id	53640
published	2011-05-04
reporter	This script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/53640
title	SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 7463)

NASL family	Slackware Local Security Checks
NASL id	SLACKWARE_SSA_2010-340-01.NASL
description	New openssl packages are available for Slackware 11.0, 12.0, 12.1, 12.2, 13.0, 13.1, and -current to fix security issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	51063
published	2010-12-08
reporter	This script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/51063
title	Slackware 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / current : openssl (SSA:2010-340-01)

NASL family	SuSE Local Security Checks
NASL id	SUSE_COMPAT-OPENSSL097G-7645.NASL
description	This update adds openssl patches since 2007 for : - CVE-2009-0590 - CVE-2008-5077 - CVE-2009-0789 - CVE-2009-3555 - CVE-2010-4180
last seen	2020-06-01
modified	2020-06-02
plugin id	57170
published	2011-12-13
reporter	This script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/57170
title	SuSE 10 Security Update : compat-openssl097g (ZYPP Patch Number 7645)

NASL family	SuSE Local Security Checks
NASL id	SUSE9_12701.NASL
description	Malicious clients could have downgraded a connection to a low strength cipher suite on session resumption if the server offers such ciphers (CVE-2010-4180). This has been fixed.
last seen	2020-06-01
modified	2020-06-02
plugin id	53637
published	2011-05-04
reporter	This script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/53637
title	SuSE9 Security Update : OpenSSL (YOU Patch Number 12701)

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_3_LIBOPENSSL-DEVEL-101207.NASL
description	Malicious clients could downgrade a connection to a low strength cipher suite on session resumption if the server offers such ciphers (CVE-2010-4180).
last seen	2020-06-01
modified	2020-06-02
plugin id	75594
published	2014-06-13
reporter	This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/75594
title	openSUSE Security Update : libopenssl-devel (openSUSE-SU-2011:0014-1)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2010-0977.NASL
description	From Red Hat Security Advisory 2010:0977 : Updated openssl packages that fix three security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library. A ciphersuite downgrade flaw was found in the OpenSSL SSL/TLS server code. A remote attacker could possibly use this flaw to change the ciphersuite associated with a cached session stored on the server, if the server enabled the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option, possibly forcing the client to use a weaker ciphersuite after resuming the session. (CVE-2010-4180, CVE-2008-7270) Note: With this update, setting the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option has no effect and this bug workaround can no longer be enabled. It was discovered that OpenSSL did not always check the return value of the bn_wexpand() function. An attacker able to trigger a memory allocation failure in that function could possibly crash an application using the OpenSSL library and its UBSEC hardware engine support. (CVE-2009-3245) All OpenSSL users should upgrade to these updated packages, which contain backported patches to resolve these issues. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.
last seen	2020-06-01
modified	2020-06-02
plugin id	68163
published	2013-07-12
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/68163
title	Oracle Linux 4 : openssl (ELSA-2010-0977)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2010-18765.NASL
description	New upstream release that fixes a few minor bugs and also a security issue with moderate impact. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	51129
published	2010-12-12
reporter	This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/51129
title	Fedora 14 : openssl-1.0.0c-1.fc14 (2010-18765)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2010-0978.NASL
description	Updated openssl packages that fix two security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library. A ciphersuite downgrade flaw was found in the OpenSSL SSL/TLS server code. A remote attacker could possibly use this flaw to change the ciphersuite associated with a cached session stored on the server, if the server enabled the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option, possibly forcing the client to use a weaker ciphersuite after resuming the session. (CVE-2010-4180, CVE-2008-7270) Note: With this update, setting the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option has no effect and this bug workaround can no longer be enabled. All OpenSSL users should upgrade to these updated packages, which contain a backported patch to resolve these issues. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.
last seen	2020-06-01
modified	2020-06-02
plugin id	51146
published	2010-12-14
reporter	This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/51146
title	CentOS 5 : openssl (CESA-2010:0978)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2010-0978.NASL
description	Updated openssl packages that fix two security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library. A ciphersuite downgrade flaw was found in the OpenSSL SSL/TLS server code. A remote attacker could possibly use this flaw to change the ciphersuite associated with a cached session stored on the server, if the server enabled the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option, possibly forcing the client to use a weaker ciphersuite after resuming the session. (CVE-2010-4180, CVE-2008-7270) Note: With this update, setting the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option has no effect and this bug workaround can no longer be enabled. All OpenSSL users should upgrade to these updated packages, which contain a backported patch to resolve these issues. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.
last seen	2020-06-01
modified	2020-06-02
plugin id	51156
published	2010-12-14
reporter	This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/51156
title	RHEL 5 : openssl (RHSA-2010:0978)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2012-76.NASL
description	- Fix IMAP, POP3 and SMTP URL sanitization (bnc#740452, CVE-2012-0036) - Disable SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option when built against an older OpenSSL version (CVE-2010-4180). - Don
last seen	2020-06-05
modified	2014-06-13
plugin id	74807
published	2014-06-13
reporter	This script is Copyright (C) 2014-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/74807
title	openSUSE Security Update : curl (openSUSE-2012-76) (BEAST)

NASL family	Misc.
NASL id	VMWARE_VMSA-2011-0013_REMOTE.NASL
description	The remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries : - Java Runtime Environment (JRE) - libuser - Netscape Portable Runtime (NSPR) - Network Security Services (NSS) - OpenSSL
last seen	2020-06-01
modified	2020-06-02
plugin id	89681
published	2016-03-04
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/89681
title	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0013) (remote check)

NASL family	Mandriva Local Security Checks
NASL id	MANDRIVA_MDVSA-2010-248.NASL
description	A vulnerability was discovered and corrected in openssl : OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the use of an unintended cipher via vectors involving sniffing network traffic to discover a session identifier (CVE-2010-4180). Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more: http://store.mandriva.com/product_info.php?cPath=149&products_id=4 90 The updated packages have been patched to correct this issue.
last seen	2020-06-01
modified	2020-06-02
plugin id	51070
published	2010-12-08
reporter	This script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/51070
title	Mandriva Linux Security Advisory : openssl (MDVSA-2010:248)

NASL family	Solaris Local Security Checks
NASL id	SOLARIS10_146857-01.NASL
description	SunOS 5.10: ssl patch for wanboot. Date this patch was last updated by Sun : Mar/23/11
last seen	2020-06-01
modified	2020-06-02
plugin id	107599
published	2018-03-12
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/107599
title	Solaris 10 (sparc) : 146857-01

NASL family	Misc.
NASL id	VMWARE_ESXI_5_0_BUILD_912577_REMOTE.NASL
description	The remote VMware ESXi 5.0 host is affected by Multiple Vulnerabilities : - An integer overflow condition exists in the __tzfile_read() function in the glibc library. An unauthenticated, remote attacker can exploit this, via a crafted timezone (TZ) file, to cause a denial of service or the execution of arbitrary code. (CVE-2009-5029) - ldd in the glibc library is affected by a privilege escalation vulnerability due to the omission of certain LD_TRACE_LOADED_OBJECTS checks in a crafted executable file. Note that this vulnerability is disputed by the library vendor. (CVE-2009-5064) - A remote code execution vulnerability exists in the glibc library due to an integer signedness error in the elf_get_dynamic_info() function when the
last seen	2020-06-01
modified	2020-06-02
plugin id	70885
published	2013-11-13
reporter	This script is (C) 2013-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/70885
title	ESXi 5.0 < Build 912577 Multiple Vulnerabilities (remote check)

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_COMPAT-OPENSSL097G-110721.NASL
description	This update adds openssl patches since 2007 for : - CVE-2009-0590 - CVE-2008-5077 - CVE-2009-0789 - CVE-2009-3555 - CVE-2010-4180
last seen	2020-06-01
modified	2020-06-02
plugin id	55711
published	2011-07-28
reporter	This script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/55711
title	SuSE 11.1 Security Update : compat-openssl097g (SAT Patch Number 4913)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2010-0979.NASL
description	Updated openssl packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library. A ciphersuite downgrade flaw was found in the OpenSSL SSL/TLS server code. A remote attacker could possibly use this flaw to change the ciphersuite associated with a cached session stored on the server, if the server enabled the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option, possibly forcing the client to use a weaker ciphersuite after resuming the session. (CVE-2010-4180) Note: With this update, setting the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option has no effect and this bug workaround can no longer be enabled. All OpenSSL users should upgrade to these updated packages, which contain a backported patch to resolve this issue. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.
last seen	2020-06-01
modified	2020-06-02
plugin id	51157
published	2010-12-14
reporter	This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/51157
title	RHEL 6 : openssl (RHSA-2010:0979)

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20101213_OPENSSL_ON_SL6_X.NASL
description	A ciphersuite downgrade flaw was found in the OpenSSL SSL/TLS server code. A remote attacker could possibly use this flaw to change the ciphersuite associated with a cached session stored on the server, if the server enabled the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option, possibly forcing the client to use a weaker ciphersuite after resuming the session. (CVE-2010-4180) Note: With this update, setting the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option has no effect and this bug workaround can no longer be enabled. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.
last seen	2020-06-01
modified	2020-06-02
plugin id	60922
published	2012-08-01
reporter	This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/60922
title	Scientific Linux Security Update : openssl on SL6.x i386/x86_64

NASL family	OracleVM Local Security Checks
NASL id	ORACLEVM_OVMSA-2014-0008.NASL
description	The remote OracleVM system is missing necessary patches to address critical security updates : - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability - replace expired GlobalSign Root CA certificate in ca-bundle.crt - fix for CVE-2013-0169 - SSL/TLS CBC timing attack (#907589) - fix for CVE-2013-0166 - DoS in OCSP signatures checking (#908052) - enable compression only if explicitly asked for or OPENSSL_DEFAULT_ZLIB environment variable is set (fixes CVE-2012-4929 #857051) - use __secure_getenv everywhere instead of getenv (#839735) - fix for CVE-2012-2333 - improper checking for record length in DTLS (#820686) - fix for CVE-2012-2110 - memory corruption in asn1_d2i_read_bio (#814185) - fix problem with the SGC restart patch that might terminate handshake incorrectly - fix for CVE-2012-0884 - MMA weakness in CMS and PKCS#7 code (#802725) - fix for CVE-2012-1165 - NULL read dereference on bad MIME headers (#802489) - fix for CVE-2011-4108 & CVE-2012-0050 - DTLS plaintext recovery vulnerability and additional DTLS fixes (#771770) - fix for CVE-2011-4109 - double free in policy checks (#771771) - fix for CVE-2011-4576 - uninitialized SSL 3.0 padding (#771775) - fix for CVE-2011-4619 - SGC restart DoS attack (#771780) - add known answer test for SHA2 algorithms (#740866) - make default private key length in certificate Makefile 2048 bits (can be changed with PRIVATE_KEY_BITS setting) (#745410) - fix incorrect return value in parse_yesno (#726593) - added DigiCert CA certificates to ca-bundle (#735819) - added a new section about error states to README.FIPS (#628976) - add missing DH_check_pub_key call when DH key is computed (#698175) - presort list of ciphers available in SSL (#688901) - accept connection in s_server even if getaddrinfo fails (#561260) - point to openssl dgst for list of supported digests (#608639) - fix handling of future TLS versions (#599112) - added VeriSign Class 3 Public Primary Certification Authority - G5 and StartCom Certification Authority certs to ca-bundle (#675671, #617856) - upstream fixes for the CHIL engine (#622003, #671484) - add SHA-2 hashes in SSL_library_init (#676384) - fix CVE-2010-4180 - completely disable code for SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (#659462) - fix CVE-2009-3245 - add missing bn_wexpand return checks (#570924) - fix CVE-2010-0433 - do not pass NULL princ to krb5_kt_get_entry which in the RHEL-5 and newer versions will crash in such case (#569774) - fix CVE-2009-3555 - support the safe renegotiation extension and do not allow legacy renegotiation on the server by default (#533125) - fix CVE-2009-2409 - drop MD2 algorithm from EVP tables (#510197) - fix CVE-2009-4355 - do not leak memory when CRYPTO_cleanup_all_ex_data is called prematurely by application (#546707)
last seen	2020-06-01
modified	2020-06-02
plugin id	79532
published	2014-11-26
reporter	This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/79532
title	OracleVM 3.2 : onpenssl (OVMSA-2014-0008)

NASL family	Misc.
NASL id	VMWARE_VMSA-2012-0013_REMOTE.NASL
description	The remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party libraries : - Apache Struts - glibc - GnuTLS - JRE - kernel - libxml2 - OpenSSL - Perl - popt and rpm
last seen	2020-06-01
modified	2020-06-02
plugin id	89038
published	2016-02-29
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/89038
title	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2012-0013) (remote check)

NASL family	SuSE Local Security Checks
NASL id	SUSE_COMPAT-OPENSSL097G-7644.NASL
description	This update adds openssl patches since 2007 for : - CVE-2009-0590 - CVE-2008-5077 - CVE-2009-0789 - CVE-2009-3555 - CVE-2010-4180
last seen	2020-06-01
modified	2020-06-02
plugin id	55715
published	2011-07-28
reporter	This script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/55715
title	SuSE 10 Security Update : compat-openssl097g (ZYPP Patch Number 7644)

NASL family	Web Servers
NASL id	OPENSSL_1_0_0C.NASL
description	According to its banner, the remote web server is running a version of OpenSSL older than 0.9.8q or 1.0.0c. Such versions are potentially affected by multiple vulnerabilities : - It may be possible to downgrade the ciphersuite to a weaker version by modifying the stored session cache ciphersuite. - An error exists in the J-PAKE implementation that could lead to successful validation by someone with no knowledge of the shared secret.
last seen	2020-06-01
modified	2020-06-02
plugin id	51058
published	2010-12-07
reporter	This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/51058
title	OpenSSL < 0.9.8q / 1.0.0c Multiple Vulnerabilities

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1547.NASL
description	According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A NULL pointer dereference flaw was found in OpenSSL
last seen	2020-06-01
modified	2020-06-02
plugin id	125000
published	2019-05-14
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/125000
title	EulerOS Virtualization 3.0.1.0 : openssl (EulerOS-SA-2019-1547)

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_LIBOPENSSL-DEVEL-101207.NASL
description	Malicious clients could downgrade a connection to a low strength cipher suite on session resumption if the server offers such ciphers. (CVE-2010-4180)
last seen	2020-06-01
modified	2020-06-02
plugin id	51620
published	2011-01-21
reporter	This script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/51620
title	SuSE 11.1 Security Update : libopenssl (SAT Patch Number 3661)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2010-0979.NASL
description	From Red Hat Security Advisory 2010:0979 : Updated openssl packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library. A ciphersuite downgrade flaw was found in the OpenSSL SSL/TLS server code. A remote attacker could possibly use this flaw to change the ciphersuite associated with a cached session stored on the server, if the server enabled the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option, possibly forcing the client to use a weaker ciphersuite after resuming the session. (CVE-2010-4180) Note: With this update, setting the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option has no effect and this bug workaround can no longer be enabled. All OpenSSL users should upgrade to these updated packages, which contain a backported patch to resolve this issue. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.
last seen	2020-06-01
modified	2020-06-02
plugin id	68165
published	2013-07-12
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/68165
title	Oracle Linux 6 : openssl (ELSA-2010-0979)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2010-0977.NASL
description	Updated openssl packages that fix three security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library. A ciphersuite downgrade flaw was found in the OpenSSL SSL/TLS server code. A remote attacker could possibly use this flaw to change the ciphersuite associated with a cached session stored on the server, if the server enabled the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option, possibly forcing the client to use a weaker ciphersuite after resuming the session. (CVE-2010-4180, CVE-2008-7270) Note: With this update, setting the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option has no effect and this bug workaround can no longer be enabled. It was discovered that OpenSSL did not always check the return value of the bn_wexpand() function. An attacker able to trigger a memory allocation failure in that function could possibly crash an application using the OpenSSL library and its UBSEC hardware engine support. (CVE-2009-3245) All OpenSSL users should upgrade to these updated packages, which contain backported patches to resolve these issues. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.
last seen	2020-06-01
modified	2020-06-02
plugin id	51781
published	2011-01-28
reporter	This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/51781
title	CentOS 4 : openssl (CESA-2010:0977)

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-1029-1.NASL
description	It was discovered that an old bug workaround in the SSL/TLS server code allowed an attacker to modify the stored session cache ciphersuite. This could possibly allow an attacker to downgrade the ciphersuite to a weaker one on subsequent connections. (CVE-2010-4180) It was discovered that an old bug workaround in the SSL/TLS server code allowed an attacker to modify the stored session cache ciphersuite. An attacker could possibly take advantage of this to force the use of a disabled cipher. This vulnerability only affects the versions of OpenSSL in Ubuntu 6.06 LTS, Ubuntu 8.04 LTS, and Ubuntu 9.10. (CVE-2008-7270). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	51076
published	2010-12-08
reporter	Ubuntu Security Notice (C) 2010-2019 Canonical, Inc. / NASL script (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/51076
title	Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : openssl vulnerabilities (USN-1029-1)

NASL family	OracleVM Local Security Checks
NASL id	ORACLEVM_OVMSA-2014-0007.NASL
description	The remote OracleVM system is missing necessary patches to address critical security updates : - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability - replace expired GlobalSign Root CA certificate in ca-bundle.crt - fix for CVE-2013-0169 - SSL/TLS CBC timing attack (#907589) - fix for CVE-2013-0166 - DoS in OCSP signatures checking (#908052) - enable compression only if explicitly asked for or OPENSSL_DEFAULT_ZLIB environment variable is set (fixes CVE-2012-4929 #857051) - use __secure_getenv everywhere instead of getenv (#839735) - fix for CVE-2012-2333 - improper checking for record length in DTLS (#820686) - fix for CVE-2012-2110 - memory corruption in asn1_d2i_read_bio (#814185) - fix problem with the SGC restart patch that might terminate handshake incorrectly - fix for CVE-2012-0884 - MMA weakness in CMS and PKCS#7 code (#802725) - fix for CVE-2012-1165 - NULL read dereference on bad MIME headers (#802489) - fix for CVE-2011-4108 & CVE-2012-0050 - DTLS plaintext recovery vulnerability and additional DTLS fixes (#771770) - fix for CVE-2011-4109 - double free in policy checks (#771771) - fix for CVE-2011-4576 - uninitialized SSL 3.0 padding (#771775) - fix for CVE-2011-4619 - SGC restart DoS attack (#771780) - add known answer test for SHA2 algorithms (#740866) - make default private key length in certificate Makefile 2048 bits (can be changed with PRIVATE_KEY_BITS setting) (#745410) - fix incorrect return value in parse_yesno (#726593) - added DigiCert CA certificates to ca-bundle (#735819) - added a new section about error states to README.FIPS (#628976) - add missing DH_check_pub_key call when DH key is computed (#698175) - presort list of ciphers available in SSL (#688901) - accept connection in s_server even if getaddrinfo fails (#561260) - point to openssl dgst for list of supported digests (#608639) - fix handling of future TLS versions (#599112) - added VeriSign Class 3 Public Primary Certification Authority - G5 and StartCom Certification Authority certs to ca-bundle (#675671, #617856) - upstream fixes for the CHIL engine (#622003, #671484) - add SHA-2 hashes in SSL_library_init (#676384) - fix CVE-2010-4180 - completely disable code for SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (#659462) - fix CVE-2009-3245 - add missing bn_wexpand return checks (#570924) - fix CVE-2010-0433 - do not pass NULL princ to krb5_kt_get_entry which in the RHEL-5 and newer versions will crash in such case (#569774) - fix CVE-2009-3555 - support the safe renegotiation extension and do not allow legacy renegotiation on the server by default (#533125) - fix CVE-2009-2409 - drop MD2 algorithm from EVP tables (#510197) - fix CVE-2009-4355 - do not leak memory when CRYPTO_cleanup_all_ex_data is called prematurely by application (#546707)
last seen	2020-06-01
modified	2020-06-02
plugin id	79531
published	2014-11-26
reporter	This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/79531
title	OracleVM 2.2 : openssl (OVMSA-2014-0007)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2010-0978.NASL
description	From Red Hat Security Advisory 2010:0978 : Updated openssl packages that fix two security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library. A ciphersuite downgrade flaw was found in the OpenSSL SSL/TLS server code. A remote attacker could possibly use this flaw to change the ciphersuite associated with a cached session stored on the server, if the server enabled the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option, possibly forcing the client to use a weaker ciphersuite after resuming the session. (CVE-2010-4180, CVE-2008-7270) Note: With this update, setting the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option has no effect and this bug workaround can no longer be enabled. All OpenSSL users should upgrade to these updated packages, which contain a backported patch to resolve these issues. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.
last seen	2020-06-01
modified	2020-06-02
plugin id	68164
published	2013-07-12
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/68164
title	Oracle Linux 5 : openssl (ELSA-2010-0978)

NASL family	SuSE Local Security Checks
NASL id	SUSE_OPENSSL-7462.NASL
description	Malicious clients could have downgraded a connection to a low strength cipher suite on session resumption if the server offers such ciphers (CVE-2010-4180). This has been fixed.
last seen	2020-06-01
modified	2020-06-02
plugin id	57233
published	2011-12-13
reporter	This script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/57233
title	SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 7462)

NASL family	NewStart CGSL Local Security Checks
NASL id	NEWSTART_CGSL_NS-SA-2019-0033_OPENSSL.NASL
description	The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has openssl packages installed that are affected by multiple vulnerabilities: - OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an error state mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it does not work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is subsequently called by the application for the same SSL object then it will succeed and the data is passed without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued after having already received a fatal error. OpenSSL version 1.0.2b-1.0.2m are affected. Fixed in OpenSSL 1.0.2n. OpenSSL 1.1.0 is not affected. (CVE-2017-3737) - There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation). Note: The impact from this issue is similar to CVE-2017-3736, CVE-2017-3732 and CVE-2015-3193. OpenSSL version 1.0.2-1.0.2m and 1.1.0-1.1.0g are affected. Fixed in OpenSSL 1.0.2n. Due to the low severity of this issue we are not issuing a new release of OpenSSL 1.1.0 at this time. The fix will be included in OpenSSL 1.1.0h when it becomes available. The fix is also available in commit e502cc86d in the OpenSSL git repository. (CVE-2017-3738) - There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen. (CVE-2017-3736) - OpenSSL 0.9.7 before 0.9.7l and 0.9.8 before 0.9.8d allows remote attackers to cause a denial of service (infinite loop and memory consumption) via malformed ASN.1 structures that trigger an improperly handled error condition. (CVE-2006-2937) - OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial of service (CPU consumption) via parasitic public keys with large (1) public exponent or (2) public modulus values in X.509 certificates that require extra time to process when using RSA signature verification. (CVE-2006-2940) - Buffer overflow in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions has unspecified impact and remote attack vectors involving a long list of ciphers. (CVE-2006-3738) - OpenSSL before 0.9.7, 0.9.7 before 0.9.7k, and 0.9.8 before 0.9.8c, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents OpenSSL from correctly verifying X.509 and other certificates that use PKCS #1. (CVE-2006-4339) - The get_server_hello function in the SSLv2 client code in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows remote servers to cause a denial of service (client crash) via unknown vectors that trigger a null pointer dereference. (CVE-2006-4343) - The BN_from_montgomery function in crypto/bn/bn_mont.c in OpenSSL 0.9.8e and earlier does not properly perform Montgomery multiplication, which might allow local users to conduct a side-channel attack and retrieve RSA private keys. (CVE-2007-3108) - Off-by-one error in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8f allows remote attackers to execute arbitrary code via unspecified vectors. (CVE-2007-4995) - Off-by-one error in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 up to 0.9.7l, and 0.9.8 up to 0.9.8f, might allow remote attackers to execute arbitrary code via a crafted packet that triggers a one-byte buffer underflow. NOTE: this issue was introduced as a result of a fix for CVE-2006-3738. As of 20071012, it is unknown whether code execution is possible. (CVE-2007-5135) - Double free vulnerability in OpenSSL 0.9.8f and 0.9.8g, when the TLS server name extensions are enabled, allows remote attackers to cause a denial of service (crash) via a malformed Client Hello packet. NOTE: some of these details are obtained from third party information. (CVE-2008-0891) - OpenSSL 0.9.8f and 0.9.8g allows remote attackers to cause a denial of service (crash) via a TLS handshake that omits the Server Key Exchange message and uses particular cipher suites, which triggers a NULL pointer dereference. (CVE-2008-1672) - The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service (memory consumption) via a large series of future epoch DTLS records that are buffered in a queue, aka DTLS record buffer limitation bug. (CVE-2009-1377) - Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka DTLS fragment handling memory leak. (CVE-2009-1378) - Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service (openssl s_client crash) and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server that uses a crafted server certificate. (CVE-2009-1379) - The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post- renegotiation context, related to a plaintext injection attack, aka the Project Mogul issue. (CVE-2009-3555) - Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678. (CVE-2009-4355) - The Cryptographic Message Syntax (CMS) implementation in crypto/cms/cms_asn1.c in OpenSSL before 0.9.8o and 1.x before 1.0.0a does not properly handle structures that contain OriginatorInfo, which allows context-dependent attackers to modify invalid memory locations or conduct double-free attacks, and possibly execute arbitrary code, via unspecified vectors. (CVE-2010-0742) - RSA verification recovery in the EVP_PKEY_verify_recover function in OpenSSL 1.x before 1.0.0a, as used by pkeyutl and possibly other applications, returns uninitialized memory upon failure, which might allow context-dependent attackers to bypass intended key requirements or obtain sensitive information via unspecified vectors. NOTE: some of these details are obtained from third party information. (CVE-2010-1633) - Multiple race conditions in ssl/t1_lib.c in OpenSSL 0.9.8f through 0.9.8o, 1.0.0, and 1.0.0a, when multi- threading and internal caching are enabled on a TLS server, might allow remote attackers to execute arbitrary code via client data that triggers a heap- based buffer overflow, related to (1) the TLS server name extension and (2) elliptic curve cryptography. (CVE-2010-3864) - OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier. (CVE-2010-4180) - ssl/t1_lib.c in OpenSSL 0.9.8h through 0.9.8q and 1.0.0 through 1.0.0c allows remote attackers to cause a denial of service (crash), and possibly obtain sensitive information in applications that use OpenSSL, via a malformed ClientHello handshake message that triggers an out-of-bounds memory access, aka OCSP stapling vulnerability. (CVE-2011-0014) - crypto/x509/x509_vfy.c in OpenSSL 1.0.x before 1.0.0e does not initialize certain structure members, which makes it easier for remote attackers to bypass CRL validation by using a nextUpdate value corresponding to a time in the past. (CVE-2011-3207) - OpenSSL 0.9.8s and 1.0.0f does not properly support DTLS applications, which allows remote attackers to cause a denial of service (crash) via unspecified vectors related to an out-of-bounds read. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4108. (CVE-2012-0050) - The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key. (CVE-2012-2110) - The ssl3_take_mac function in ssl/s3_both.c in OpenSSL 1.0.1 before 1.0.1f allows remote TLS servers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Next Protocol Negotiation record in a TLS handshake. (CVE-2013-4353) - The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorrect data structure, which allows remote attackers to cause a denial of service (daemon crash) via crafted traffic from a TLS 1.2 client. (CVE-2013-6449) - The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service (application crash) by interfering with packet delivery, related to ssl/d1_both.c and ssl/t1_enc.c. (CVE-2013-6450) - An information disclosure flaw was found in the way OpenSSL handled TLS and DTLS Heartbeat Extension packets. A malicious TLS or DTLS client or server could send a specially crafted TLS or DTLS Heartbeat packet to disclose a limited portion of memory per request from a connected client or server. Note that the disclosed portions of memory could potentially include sensitive information such as private keys. (CVE-2014-0160) - A flaw was found in the way SSL 3.0 handled padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode. This flaw allows a man-in-the-middle (MITM) attacker to decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a victim application to repeatedly send the same data over newly created SSL 3.0 connections. (CVE-2014-3566) - A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based ciphersuite. (CVE-2016-2183) Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	127201
published	2019-08-12
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/127201
title	NewStart CGSL CORE 5.04 / MAIN 5.04 : openssl Multiple Vulnerabilities (NS-SA-2019-0033)

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_3_COMPAT-OPENSSL097G-110721.NASL
description	This update adds openssl patches since 2007 for : - CVE-2008-5077 - CVE-2009-0590 - CVE-2009-0789 - CVE-2009-3555 - CVE-2010-4180
last seen	2020-06-01
modified	2020-06-02
plugin id	75453
published	2014-06-13
reporter	This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/75453
title	openSUSE Security Update : compat-openssl097g (openSUSE-SU-2011:0845-1)

NASL family	Gentoo Local Security Checks
NASL id	GENTOO_GLSA-201110-01.NASL
description	The remote host is affected by the vulnerability described in GLSA-201110-01 (OpenSSL: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in OpenSSL. Please review the CVE identifiers referenced below for details. Impact : A context-dependent attacker could cause a Denial of Service, possibly execute arbitrary code, bypass intended key requirements, force the downgrade to unintended ciphers, bypass the need for knowledge of shared secrets and successfully authenticate, bypass CRL validation, or obtain sensitive information in applications that use OpenSSL. Workaround : There is no known workaround at this time.
last seen	2020-06-01
modified	2020-06-02
plugin id	56425
published	2011-10-10
reporter	This script is Copyright (C) 2011-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/56425
title	GLSA-201110-01 : OpenSSL: Multiple vulnerabilities

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20101213_OPENSSL_ON_SL4_X.NASL
description	A ciphersuite downgrade flaw was found in the OpenSSL SSL/TLS server code. A remote attacker could possibly use this flaw to change the ciphersuite associated with a cached session stored on the server, if the server enabled the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option, possibly forcing the client to use a weaker ciphersuite after resuming the session. (CVE-2010-4180, CVE-2008-7270) Note: With this update, setting the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option has no effect and this bug workaround can no longer be enabled. It was discovered that OpenSSL did not always check the return value of the bn_wexpand() function. An attacker able to trigger a memory allocation failure in that function could possibly crash an application using the OpenSSL library and its UBSEC hardware engine support. (CVE-2009-3245 - SL4 Only) For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.
last seen	2020-06-01
modified	2020-06-02
plugin id	60921
published	2012-08-01
reporter	This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/60921
title	Scientific Linux Security Update : openssl on SL4.x, SL5.x i386/x86_64

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_1_LIBOPENSSL-DEVEL-101207.NASL
description	Malicious clients could downgrade a connection to a low strength cipher suite on session resumption if the server offers such ciphers (CVE-2010-4180).
last seen	2020-06-01
modified	2020-06-02
plugin id	53676
published	2011-05-05
reporter	This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/53676
title	openSUSE Security Update : libopenssl-devel (openSUSE-SU-2011:0014-1)

NASL family	AIX Local Security Checks
NASL id	AIX_OPENSSL_ADVISORY2.NASL
description	The version of OpenSSL running on the remote host is affected by the following vulnerabilities : - ssl/t1_lib.c in OpenSSL 0.9.8h through 0.9.8q and 1.0.0 through 1.0.0c allows remote attackers to cause a denial of service (crash), and possibly obtain sensitive information in applications that use OpenSSL, via a malformed ClientHello handshake message that triggers an out-of-bounds memory access, aka
last seen	2020-06-01
modified	2020-06-02
plugin id	73560
published	2014-04-16
reporter	This script is Copyright (C) 2014-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/73560
title	AIX OpenSSL Advisory : openssl_advisory2.asc

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2010-0977.NASL
description	Updated openssl packages that fix three security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library. A ciphersuite downgrade flaw was found in the OpenSSL SSL/TLS server code. A remote attacker could possibly use this flaw to change the ciphersuite associated with a cached session stored on the server, if the server enabled the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option, possibly forcing the client to use a weaker ciphersuite after resuming the session. (CVE-2010-4180, CVE-2008-7270) Note: With this update, setting the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option has no effect and this bug workaround can no longer be enabled. It was discovered that OpenSSL did not always check the return value of the bn_wexpand() function. An attacker able to trigger a memory allocation failure in that function could possibly crash an application using the OpenSSL library and its UBSEC hardware engine support. (CVE-2009-3245) All OpenSSL users should upgrade to these updated packages, which contain backported patches to resolve these issues. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.
last seen	2020-06-01
modified	2020-06-02
plugin id	51155
published	2010-12-14
reporter	This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/51155
title	RHEL 4 : openssl (RHSA-2010:0977)

NASL family	MacOS X Local Security Checks
NASL id	MACOSX_10_6_8.NASL
description	The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.8. This update contains security-related fixes for the following components : - App Store - ATS - Certificate Trust Policy - CoreFoundation - CoreGraphics - FTP Server - ImageIO - International Components for Unicode - Kernel - Libsystem - libxslt - MobileMe - MySQL - OpenSSL - patch - QuickLook - QuickTime - Samba - servermgrd - subversion
last seen	2020-06-01
modified	2020-06-02
plugin id	55416
published	2011-06-24
reporter	This script is Copyright (C) 2011-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/55416
title	Mac OS X 10.6.x < 10.6.8 Multiple Vulnerabilities

NASL family	General
NASL id	OPENSSL_RESUME_DIFFERENT_CIPHER.NASL
description	The version of OpenSSL on the remote host has been shown to allow resuming session with a weaker cipher than was used when the session was initiated. This means that an attacker that sees (i.e., by sniffing) the start of an SSL connection can manipulate the OpenSSL session cache to cause subsequent resumptions of that session to use a weaker cipher chosen by the attacker. Note that other SSL implementations may also be affected by this vulnerability.
last seen	2020-06-01
modified	2020-06-02
plugin id	51892
published	2011-02-07
reporter	This script is Copyright (C) 2011-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/51892
title	OpenSSL SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG Session Resume Ciphersuite Downgrade Issue

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2010-18736.NASL
description	New upstream release that fixes a few minor bugs and also a security issue with moderate impact. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	51347
published	2010-12-20
reporter	This script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/51347
title	Fedora 13 : openssl-1.0.0c-1.fc13 (2010-18736)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-2141.NASL
description	DSA-2141 consists of three individual parts, which can be viewed in the mailing list archive: DSA 2141-1 (openssl), DSA 2141-2 (nss), DSA 2141-3 (apache2), and DSA 2141-4 (lighttpd). This page only covers the first part, openssl. - CVE-2009-3555 Marsh Ray, Steve Dispensa, and Martin Rex discovered a flaw in the TLS and SSLv3 protocols. If an attacker could perform a man in the middle attack at the start of a TLS connection, the attacker could inject arbitrary content at the beginning of the user
last seen	2020-03-17
modified	2011-01-10
plugin id	51440
published	2011-01-10
reporter	This script is Copyright (C) 2011-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/51440
title	Debian DSA-2141-1 : openssl - SSL/TLS insecure renegotiation protocol design flaw

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_2_LIBOPENSSL-DEVEL-101207.NASL
description	Malicious clients could downgrade a connection to a low strength cipher suite on session resumption if the server offers such ciphers (CVE-2010-4180).
last seen	2020-06-01
modified	2020-06-02
plugin id	53751
published	2011-05-05
reporter	This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/53751
title	openSUSE Security Update : libopenssl-devel (openSUSE-SU-2011:0014-1)

Oval

accepted

2015-05-04T04:00:12.141-04:00

class

vulnerability

contributors

name Sergey Artykhov
organization ALTX-SOFT
name Maria Mikhno
organization ALTX-SOFT

definition_extensions

comment	VisualSVN Server is installed
oval	oval:org.mitre.oval:def:18636

description

family

windows

oval:org.mitre.oval:def:18910

status

accepted

submitted

2013-10-02T13:00:00

title

OpenSSL vulnerability before 0.9.8q, and 1.0.x before 1.0.0c in VisualSVN Server (CVE-2010-4180)

version

Redhat

advisories

bugzilla

id	660650
title	CVE-2008-7270 openssl: NETSCAPE_REUSE_CIPHER_CHANGE_BUG downgrade-to-disabled ciphersuite attack

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 4 is installed
oval oval:com.redhat.rhba:tst:20070304025

AND
comment openssl-perl is earlier than 0:0.9.7a-43.17.el4_8.6
oval oval:com.redhat.rhsa:tst:20100977001
comment openssl-perl is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060661008
AND
comment openssl is earlier than 0:0.9.7a-43.17.el4_8.6
oval oval:com.redhat.rhsa:tst:20100977003
comment openssl is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060661004
AND
comment openssl-devel is earlier than 0:0.9.7a-43.17.el4_8.6
oval oval:com.redhat.rhsa:tst:20100977005
comment openssl-devel is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060661006

rhsa

id	RHSA-2010:0977
released	2010-12-13
severity	Moderate
title	RHSA-2010:0977: openssl security update (Moderate)

bugzilla

id	660650
title	CVE-2008-7270 openssl: NETSCAPE_REUSE_CIPHER_CHANGE_BUG downgrade-to-disabled ciphersuite attack

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 5 is installed
oval oval:com.redhat.rhba:tst:20070331005

AND
comment openssl-perl is earlier than 0:0.9.8e-12.el5_5.7
oval oval:com.redhat.rhsa:tst:20100978001
comment openssl-perl is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070964006
AND
comment openssl-devel is earlier than 0:0.9.8e-12.el5_5.7
oval oval:com.redhat.rhsa:tst:20100978003
comment openssl-devel is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070964002
AND
comment openssl is earlier than 0:0.9.8e-12.el5_5.7
oval oval:com.redhat.rhsa:tst:20100978005
comment openssl is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070964004

rhsa

id	RHSA-2010:0978
released	2010-12-13
severity	Moderate
title	RHSA-2010:0978: openssl security update (Moderate)

bugzilla

id	659462
title	CVE-2010-4180 openssl: NETSCAPE_REUSE_CIPHER_CHANGE_BUG ciphersuite downgrade attack

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 6 is installed
oval oval:com.redhat.rhba:tst:20111656003

AND

comment openssl-static is earlier than 0:1.0.0-4.el6_0.2
oval oval:com.redhat.rhsa:tst:20100979001
comment openssl-static is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhba:tst:20171929006

AND
comment openssl-perl is earlier than 0:1.0.0-4.el6_0.2
oval oval:com.redhat.rhsa:tst:20100979003
comment openssl-perl is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhba:tst:20171929004
AND
comment openssl-devel is earlier than 0:1.0.0-4.el6_0.2
oval oval:com.redhat.rhsa:tst:20100979005
comment openssl-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhba:tst:20171929002
AND
comment openssl is earlier than 0:1.0.0-4.el6_0.2
oval oval:com.redhat.rhsa:tst:20100979007
comment openssl is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhba:tst:20171929008

rhsa

id	RHSA-2010:0979
released	2010-12-13
severity	Moderate
title	RHSA-2010:0979: openssl security update (Moderate)

rhsa
id RHSA-2011:0896

rpms

openssl-0:0.9.7a-43.17.el4_8.6
openssl-debuginfo-0:0.9.7a-43.17.el4_8.6
openssl-devel-0:0.9.7a-43.17.el4_8.6
openssl-perl-0:0.9.7a-43.17.el4_8.6
openssl-0:0.9.8e-12.el5_5.7
openssl-debuginfo-0:0.9.8e-12.el5_5.7
openssl-devel-0:0.9.8e-12.el5_5.7
openssl-perl-0:0.9.8e-12.el5_5.7
openssl-0:1.0.0-4.el6_0.2
openssl-debuginfo-0:1.0.0-4.el6_0.2
openssl-devel-0:1.0.0-4.el6_0.2
openssl-perl-0:1.0.0-4.el6_0.2
openssl-static-0:1.0.0-4.el6_0.2

Vulnerabilities > CVE-2010-4180 {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Vulnerabilities","item":"https://cyber.vumetric.com/vulns/"},{"@type":"ListItem","position":2,"name":"CVE-2010-4180"}]}

Summary

Vulnerable Configurations

Nessus

Oval

Redhat

References

Vulnerabilities > CVE-2010-4180