Vulnerabilities > CVE-2016-6303 - Out-of-bounds Write vulnerability in multiple products

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

nodejs

openssl

CWE-787

critical

nessus

NVD

Published: 2016-09-16

Updated: 2024-11-21

Summary

Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.

Vulnerable Configurations

Part	Description	Count
Application	Nodejs Nodejs Node.Js - Nodejs Node.Js 0.0.1 Nodejs Node.Js 0.0.2 Nodejs Node.Js 0.0.3 Nodejs Node.Js 0.0.4 Nodejs Node.Js 0.0.5 Nodejs Node.Js 0.0.6 Nodejs Node.Js 0.1.0 Nodejs Node.Js 0.1.1 Nodejs Node.Js 0.1.2 Nodejs Node.Js 0.1.3 Nodejs Node.Js 0.1.4 Nodejs Node.Js 0.1.5 Nodejs Node.Js 0.1.6 Nodejs Node.Js 0.1.7 Nodejs Node.Js 0.1.8 Nodejs Node.Js 0.1.9 Nodejs Node.Js 0.1.10 Nodejs Node.Js 0.1.11 Nodejs Node.Js 0.1.12 Nodejs Node.Js 0.1.13 Nodejs Node.Js 0.1.14 Nodejs Node.Js 0.1.15 Nodejs Node.Js 0.1.16 Nodejs Node.Js 0.1.17 Nodejs Node.Js 0.1.18 Nodejs Node.Js 0.1.19 Nodejs Node.Js 0.1.20 Nodejs Node.Js 0.1.21 Nodejs Node.Js 0.1.22 Nodejs Node.Js 0.1.23 Nodejs Node.Js 0.1.24 Nodejs Node.Js 0.1.25 Nodejs Node.Js 0.1.26 Nodejs Node.Js 0.1.27 Nodejs Node.Js 0.1.28 Nodejs Node.Js 0.1.29 Nodejs Node.Js 0.1.30 Nodejs Node.Js 0.1.31 Nodejs Node.Js 0.1.32 Nodejs Node.Js 0.1.33 Nodejs Node.Js 0.1.90 Nodejs Node.Js 0.1.91 Nodejs Node.Js 0.1.92 Nodejs Node.Js 0.1.93 Nodejs Node.Js 0.1.94 Nodejs Node.Js 0.1.95 Nodejs Node.Js 0.1.96 Nodejs Node.Js 0.1.97 Nodejs Node.Js 0.1.98 Nodejs Node.Js 0.1.99 Nodejs Node.Js 0.1.100 Nodejs Node.Js 0.1.101 Nodejs Node.Js 0.1.102 Nodejs Node.Js 0.1.103 Nodejs Node.Js 0.1.104 Nodejs Node.Js 0.2.0 Nodejs Node.Js 0.2.1 Nodejs Node.Js 0.2.2 Nodejs Node.Js 0.2.3 Nodejs Node.Js 0.2.4 Nodejs Node.Js 0.2.5 Nodejs Node.Js 0.2.6 Nodejs Node.Js 0.3.0 Nodejs Node.Js 0.3.1 Nodejs Node.Js 0.3.2 Nodejs Node.Js 0.3.3 Nodejs Node.Js 0.3.4 Nodejs Node.Js 0.3.5 Nodejs Node.Js 0.3.6 Nodejs Node.Js 0.3.7 Nodejs Node.Js 0.3.8 Nodejs Node.Js 0.4.0 Nodejs Node.Js 0.4.1 Nodejs Node.Js 0.4.2 Nodejs Node.Js 0.4.3 Nodejs Node.Js 0.4.4 Nodejs Node.Js 0.4.5 Nodejs Node.Js 0.4.6 Nodejs Node.Js 0.4.7 Nodejs Node.Js 0.4.8 Nodejs Node.Js 0.4.9 Nodejs Node.Js 0.4.10 Nodejs Node.Js 0.4.11 Nodejs Node.Js 0.4.12 Nodejs Node.Js 0.5.0 Nodejs Node.Js 0.5.1 Nodejs Node.Js 0.5.2 Nodejs Node.Js 0.5.3 Nodejs Node.Js 0.5.4 Nodejs Node.Js 0.5.5 Nodejs Node.Js 0.5.6 Nodejs Node.Js 0.5.7 Nodejs Node.Js 0.5.8 Nodejs Node.Js 0.5.9 Nodejs Node.Js 0.5.10 Nodejs Node.Js 0.6.0 Nodejs Node.Js 0.6.1 Nodejs Node.Js 0.6.2 Nodejs Node.Js 0.6.3 Nodejs Node.Js 0.6.4 Nodejs Node.Js 0.6.5 Nodejs Node.Js 0.6.6 Nodejs Node.Js 0.6.7 Nodejs Node.Js 0.6.8 Nodejs Node.Js 0.6.9 Nodejs Node.Js 0.6.10 Nodejs Node.Js 0.6.11 Nodejs Node.Js 0.6.12 Nodejs Node.Js 0.6.13 Nodejs Node.Js 0.6.14 Nodejs Node.Js 0.6.15 Nodejs Node.Js 0.6.16 Nodejs Node.Js 0.6.17 Nodejs Node.Js 0.6.18 Nodejs Node.Js 0.6.19 Nodejs Node.Js 0.6.20 Nodejs Node.Js 0.6.21 Nodejs Node.Js 0.7.0 Nodejs Node.Js 0.7.1 Nodejs Node.Js 0.7.2 Nodejs Node.Js 0.7.3 Nodejs Node.Js 0.7.4 Nodejs Node.Js 0.7.5 Nodejs Node.Js 0.7.6 Nodejs Node.Js 0.7.7 Nodejs Node.Js 0.7.8 Nodejs Node.Js 0.7.9 Nodejs Node.Js 0.7.10 Nodejs Node.Js 0.7.11 Nodejs Node.Js 0.7.12 Nodejs Node.Js 0.8.0 Nodejs Node.Js 0.8.1 Nodejs Node.Js 0.8.2 Nodejs Node.Js 0.8.3 Nodejs Node.Js 0.8.4 Nodejs Node.Js 0.8.5 Nodejs Node.Js 0.8.6 Nodejs Node.Js 0.8.7 Nodejs Node.Js 0.8.8 Nodejs Node.Js 0.8.9 Nodejs Node.Js 0.8.10 Nodejs Node.Js 0.8.11 Nodejs Node.Js 0.8.12 Nodejs Node.Js 0.8.13 Nodejs Node.Js 0.8.14 Nodejs Node.Js 0.8.15 Nodejs Node.Js 0.8.16 Nodejs Node.Js 0.8.17 Nodejs Node.Js 0.8.18 Nodejs Node.Js 0.8.19 Nodejs Node.Js 0.8.20 Nodejs Node.Js 0.8.21 Nodejs Node.Js 0.8.22 Nodejs Node.Js 0.8.23 Nodejs Node.Js 0.8.24 Nodejs Node.Js 0.8.25 Nodejs Node.Js 0.8.26 Nodejs Node.Js 0.8.27 Nodejs Node.Js 0.8.28 Nodejs Node.Js 0.9.0 Nodejs Node.Js 0.9.1 Nodejs Node.Js 0.9.2 Nodejs Node.Js 0.9.3 Nodejs Node.Js 0.9.4 Nodejs Node.Js 0.9.5 Nodejs Node.Js 0.9.6 Nodejs Node.Js 0.9.7 Nodejs Node.Js 0.9.8 Nodejs Node.Js 0.9.9 Nodejs Node.Js 0.9.10 Nodejs Node.Js 0.9.11 Nodejs Node.Js 0.9.12 Nodejs Node.Js 0.10.0 Nodejs Node.Js 0.10.1 Nodejs Node.Js 0.10.2 Nodejs Node.Js 0.10.3 Nodejs Node.Js 0.10.4 Nodejs Node.Js 0.10.5 Nodejs Node.Js 0.10.6 Nodejs Node.Js 0.10.7 Nodejs Node.Js 0.10.8 Nodejs Node.Js 0.10.9 Nodejs Node.Js 0.10.10 Nodejs Node.Js 0.10.11 Nodejs Node.Js 0.10.12 Nodejs Node.Js 0.10.13 Nodejs Node.Js 0.10.14 Nodejs Node.Js 0.10.15 Nodejs Node.Js 0.10.16 Nodejs Node.Js 0.10.16-Isaacs-Manual Nodejs Node.Js 0.10.17 Nodejs Node.Js 0.10.18 Nodejs Node.Js 0.10.19 Nodejs Node.Js 0.10.20 Nodejs Node.Js 0.10.21 Nodejs Node.Js 0.10.22 Nodejs Node.Js 0.10.23 Nodejs Node.Js 0.10.24 Nodejs Node.Js 0.10.25 Nodejs Node.Js 0.10.26 Nodejs Node.Js 0.10.27 Nodejs Node.Js 0.10.28 Nodejs Node.Js 0.10.29 Nodejs Node.Js 0.10.30 Nodejs Node.Js 0.10.31 Nodejs Node.Js 0.10.32 Nodejs Node.Js 0.10.33 Nodejs Node.Js 0.10.34 Nodejs Node.Js 0.10.35 Nodejs Node.Js 0.10.36 Nodejs Node.Js 0.10.37 Nodejs Node.Js 0.10.38 Nodejs Node.Js 0.10.39 Nodejs Node.Js 0.10.40 Nodejs Node.Js 0.10.41 Nodejs Node.Js 0.10.42 Nodejs Node.Js 0.10.43 Nodejs Node.Js 0.10.44 Nodejs Node.Js 0.10.45 Nodejs Node.Js 0.10.46 Nodejs Node.Js 0.10.47 Nodejs Node.Js 0.10.48 Nodejs Node.Js 0.11.0 Nodejs Node.Js 0.11.1 Nodejs Node.Js 0.11.2 Nodejs Node.Js 0.11.3 Nodejs Node.Js 0.11.4 Nodejs Node.Js 0.11.5 Nodejs Node.Js 0.11.6 Nodejs Node.Js 0.11.7 Nodejs Node.Js 0.11.8 Nodejs Node.Js 0.11.9 Nodejs Node.Js 0.11.10 Nodejs Node.Js 0.11.11 Nodejs Node.Js 0.11.12 Nodejs Node.Js 0.11.13 Nodejs Node.Js 0.11.14 Nodejs Node.Js 0.11.15 Nodejs Node.Js 0.11.16 Nodejs Node.Js 0.12.0 Nodejs Node.Js 0.12.1 Nodejs Node.Js 0.12.2 Nodejs Node.Js 0.12.3 Nodejs Node.Js 0.12.4 Nodejs Node.Js 0.12.5 Nodejs Node.Js 0.12.6 Nodejs Node.Js 0.12.7 Nodejs Node.Js 0.12.8 Nodejs Node.Js 0.12.9 Nodejs Node.Js 0.12.10 Nodejs Node.Js 0.12.11 Nodejs Node.Js 0.12.12 Nodejs Node.Js 0.12.13 Nodejs Node.Js 0.12.14 Nodejs Node.Js 0.12.15 Nodejs Node.Js 4.0.0 Nodejs Node.Js 4.1.0 Nodejs Node.Js 4.1.1 Nodejs Node.Js 4.1.2 Nodejs Node.Js 4.2.0 Nodejs Node.Js 4.2.1 Nodejs Node.Js 4.2.2 Nodejs Node.Js 4.2.3 Nodejs Node.Js 4.2.4 Nodejs Node.Js 4.2.5 Nodejs Node.Js 4.2.6 Nodejs Node.Js 4.3.0 Nodejs Node.Js 4.3.1 Nodejs Node.Js 4.3.2 Nodejs Node.Js 4.4.0 Nodejs Node.Js 4.4.1 Nodejs Node.Js 4.4.2 Nodejs Node.Js 4.4.3 Nodejs Node.Js 4.4.4 Nodejs Node.Js 4.4.5 Nodejs Node.Js 4.4.6 Nodejs Node.Js 4.4.7 Nodejs Node.Js 4.5.0 Nodejs Node.Js 6.0.0 Nodejs Node.Js 6.1.0 Nodejs Node.Js 6.2.0 Nodejs Node.Js 6.2.1 Nodejs Node.Js 6.2.2 Nodejs Node.Js 6.3.0 Nodejs Node.Js 6.3.1 Nodejs Node.Js 6.4.0 Nodejs Node.Js 6.5.0	646
Application	Openssl Openssl Openssl 1.0.1M Openssl Openssl 1.0.2A Openssl Openssl 1.0.1J Openssl Openssl 1.0.1H Openssl Openssl 1.0.2E Openssl Openssl 1.0.1R Openssl Openssl 1.0.2B Openssl Openssl 1.0.1C Openssl Openssl 1.0.1G Openssl Openssl 1.0.2G Openssl Openssl 1.0.1A Openssl Openssl 1.0.2H Openssl Openssl 1.0.1D Openssl Openssl 1.0.1T Openssl Openssl 1.0.2C Openssl Openssl 1.0.1P Openssl Openssl 1.0.1K Openssl Openssl 1.0.1B Openssl Openssl 1.0.1N Openssl Openssl 1.0.1Q Openssl Openssl 1.0.1E Openssl Openssl 1.0.1L Openssl Openssl 1.0.1F Openssl Openssl 1.0.1S Openssl Openssl 1.0.1O Openssl Openssl 1.0.2 Openssl Openssl 1.0.2F Openssl Openssl 1.0.1I Openssl Openssl 1.0.1 Openssl Openssl 1.0.2D	30

Common Weakness Enumeration (CWE)

CWE-787 - Out-of-bounds Write

Nessus

NASL family	CGI abuses
NASL id	MYSQL_ENTERPRISE_MONITOR_3_1_5_7958.NASL
description	According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 3.1.x prior to 3.1.5.7958. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the bundled version of Apache Tomcat in the Manager and Host Manager web applications due to a flaw in the index page when issuing redirects in response to unauthenticated requests for the root directory of the application. An authenticated, remote attacker can exploit this to gain access to the XSRF token information stored in the index page. (CVE-2015-5351) - A remote code execution vulnerability exists in the Framework subcomponent that allows an authenticated, remote attacker to execute arbitrary code. (CVE-2016-0635) - An information disclosure vulnerability exists in the bundled version of Apache Tomcat that allows a specially crafted web application to load the StatusManagerServlet. An authenticated, remote attacker can exploit this to gain unauthorized access to a list of all deployed applications and a list of the HTTP request lines for all requests currently being processed. (CVE-2016-0706) - A remote code execution vulnerability exists in the bundled version of Apache Tomcat due to a flaw in the StandardManager, PersistentManager, and cluster implementations that is triggered when handling persistent sessions. An authenticated, remote attacker can exploit this, via a crafted object in a session, to bypass the security manager and execute arbitrary code. (CVE-2016-0714) - A security bypass vulnerability exists in the bundled version of Apache Tomcat due to a failure to consider whether ResourceLinkFactory.setGlobalContext callers are authorized. An authenticated, remote attacker can exploit this, via a web application that sets a crafted global context, to bypass intended SecurityManager restrictions and read or write to arbitrary application data or cause a denial of service condition. (CVE-2016-0763) - Multiple integer overflow conditions exist in the bundled version of OpenSSL in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the bundled version of OpenSSL in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the bundled version of OpenSSL in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the bundled version of OpenSSL in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	96767
published	2017-01-25
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/96767
title	MySQL Enterprise Monitor 3.1.x < 3.1.5.7958 Multiple Vulnerabilities (SWEET32) (January 2017 CPU)

NASL family	Misc.
NASL id	ORACLE_SECURE_GLOBAL_DESKTOP_APR_2017_CPU.NASL
description	The version of Oracle Secure Global Desktop installed on the remote host is 4.71, 5.2, or 5.3 and is missing a security patch from the April 2017 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities : - An integer overflow condition exists in the Window System (X11) subcomponent in multiple functions in X.Org libExt due to improper validation of user-supplied input when calculating the amount of memory required to handle return data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. Note that this issue only affects version 4.71. (CVE-2013-1982) - An integer overflow condition exists in X.Org libXfixes in the XFixesGetCursorImage() function when handling large cursor dimensions or name lengths due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-1983) - An integer overflow condition exists within multiple functions in X.Org libXi due to improper validation of user-supplied input when calculating the amount of memory needed to handle return data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-1984) - An integer overflow condition exists in X.Org libXinerama in the XineramaQueryScreens() function due to improper validation of user-supplied input when calculating the amount of memory needed to handle return data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-1985) - An integer overflow condition exists in multiple functions in X.Org libXrandr due to improper validation of user-supplied input when calculating the amount of memory needed to handle return data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-1986) - An integer overflow condition exists in multiple functions in X.Org libXrender due to improper validation of user-supplied input when calculating the amount of memory needed to handle return data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-1987) - An overflow condition exists in X.Org libXi in the XListInputDevices() function, related to an unexpected sign extension, due to improper checking of the amount of memory needed to handle returned data when converting smaller integer types to larger ones. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-1995) - An overflow condition exists within multiple functions in X.Org LibXi due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted length or index, to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-1998) - An overflow condition exists in X.Org LibXt in the _XtResourceConfigurationEH() function due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted length or index, to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-2002) - An integer overflow condition exists in X.Org libXcursor in the _XcursorFileHeaderCreate() function due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-2003) - An uninitialized pointer flaw exists within multiple functions in X.Org LibXt due to a failure to check for proper initialization of pointers. An unauthenticated, remote attacker can exploit this to corrupt memory, resulting in a denial of service condition or the possible execution of arbitrary code. (CVE-2013-2005) - A flaw exists in the Application Server subcomponent (Apache Tomcat) due to a failure to process passwords when they are paired with non-existent usernames. An authenticated, remote attacker can exploit this, via a timing attack, to enumerate user account names. (CVE-2016-0762) - Multiple integer overflow conditions exist in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit these to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	99930
published	2017-05-02
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/99930
title	Oracle Secure Global Desktop Multiple Vulnerabilities (April 2017 CPU) (SWEET32)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2016-1130.NASL
description	This update for openssl fixes the following issues : OpenSSL Security Advisory [22 Sep 2016] (boo#999665) Severity: High - OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (boo#999666) Severity: Low - Pointer arithmetic undefined behaviour (CVE-2016-2177) (boo#982575) - Constant time flag not preserved in DSA signing (CVE-2016-2178) (boo#983249) - DTLS buffered message DoS (CVE-2016-2179) (boo#994844) - OOB read in TS_OBJ_print_bio() (CVE-2016-2180) (boo#990419) - DTLS replay protection DoS (CVE-2016-2181) (boo#994749) - OOB write in BN_bn2dec() (CVE-2016-2182) (boo#993819) - Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (boo#995359) - Malformed SHA512 ticket DoS (CVE-2016-6302) (boo#995324) - OOB write in MDC2_Update() (CVE-2016-6303) (boo#995377) - Certificate message OOB reads (CVE-2016-6306) (boo#999668) More information can be found on https://www.openssl.org/news/secadv/20160922.txt - update expired S/MIME certs (boo#979475) - allow >= 64GB AESGCM transfers (boo#988591) - fix crash in print_notice (boo#998190) - resume reading from /dev/urandom when interrupted by a signal (boo#995075)
last seen	2020-06-05
modified	2016-09-28
plugin id	93756
published	2016-09-28
reporter	This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/93756
title	openSUSE Security Update : openssl (openSUSE-2016-1130)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2016-2458-1.NASL
description	This update for openssl fixes the following issues: OpenSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High - OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low - Pointer arithmetic undefined behavior (CVE-2016-2177) (bsc#982575) - Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) - DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) - DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) - OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) - Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) - Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) - OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) - Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Bugs fixed : - Update expired S/MIME certs (bsc#979475) - Fix crash in print_notice (bsc#998190) - Resume reading from /dev/urandom when interrupted by a signal (bsc#995075) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	93893
published	2016-10-06
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93893
title	SUSE SLES11 Security Update : openssl (SUSE-SU-2016:2458-1)

NASL family	Misc.
NASL id	ORACLE_ACCESS_MANAGER_CPU_JAN_2018.NASL
description	The version of Oracle Access Manager installed on the remote host is 10.1.4.3.x prior to 10.1.4.3.13 or 11.1.2.3.x prior to 11.1.2.3.180116. It is, therefore, affected by multiple vulnerabilities as noted in the October 2018 Critical Patch Update advisory: - A Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin (OpenSSL)). The affected version is 10.1.4.3.0. This is a difficult to exploit vulnerability that allows unauthenticated attacker with network access via HTTPS to compromise Oracle Access Manager. A successful attack of this vulnerability may result in unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. (CVE-2017-3732) - A vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). The affected version is 11.1.2.3.0. This is a difficult to exploit vulnerability that allows an unauthenticated attacker with network access via HTTPS to compromise Oracle Access Manager. A successful attack of this vulnerability may result in unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. (CVE-2017-10262) Note that Nessus has not tested for these issues but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	124059
published	2019-04-15
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124059
title	Oracle Access Manager Multiple Vulnerabilities (Jan 2018 CPU)

NASL family	Web Servers
NASL id	OPENSSL_1_0_1U.NASL
description	According to its banner, the remote host is running a version of OpenSSL 1.0.1 prior to 1.0.1u. It is, therefore, affected by the following vulnerabilities : - Multiple integer overflow conditions exist in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	93814
published	2016-09-30
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93814
title	OpenSSL 1.0.1 < 1.0.1u Multiple Vulnerabilities (SWEET32)

NASL family	CGI abuses
NASL id	MYSQL_ENTERPRISE_MONITOR_3_2_5_1141.NASL
description	According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 3.2.x prior to 3.2.5.1141. It is, therefore, affected by multiple vulnerabilities : - Multiple integer overflow conditions exist in the bundled version of OpenSSL in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the bundled version of OpenSSL in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the bundled version of OpenSSL in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the bundled version of OpenSSL in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	96770
published	2017-01-25
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/96770
title	MySQL Enterprise Monitor 3.2.x < 3.2.5.1141 Multiple Vulnerabilities (SWEET32) (January 2017 CPU)

NASL family	CGI abuses
NASL id	MYSQL_ENTERPRISE_MONITOR_3_3_1_1112.NASL
description	According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 3.3.x prior to 3.3.1.1112. It is, therefore, affected by multiple vulnerabilities in the bundled version of OpenSSL : - Multiple integer overflow conditions exist in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	96771
published	2017-01-25
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/96771
title	MySQL Enterprise Monitor 3.3.x < 3.3.1.1112 Multiple Vulnerabilities (SWEET32) (January 2017 CPU)

NASL family	Misc.
NASL id	ORACLE_E-BUSINESS_CPU_JUL_2017.NASL
description	The version of Oracle E-Business installed on the remote host is missing the July 2017 Oracle Critical Patch Update (CPU). It is, therefore, affected by the following vulnerabilities : - Multiple integer overflow conditions exist in the OpenSSL component in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the OpenSSL component in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the OpennSSL component in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the OpenSSL component in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	101845
published	2017-07-20
reporter	This script is Copyright (C) 2017-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/101845
title	Oracle E-Business Multiple Vulnerabilities (July 2017 CPU) (SWEET32)

NASL family	FreeBSD Local Security Checks
NASL id	FREEBSD_PKG_43EAA65680BC11E6BF52B499BAEBFEAF.NASL
description	OpenSSL reports : High: OCSP Status Request extension unbounded memory growth SSL_peek() hang on empty record SWEET32 Mitigation OOB write in MDC2_Update() Malformed SHA512 ticket DoS OOB write in BN_bn2dec() OOB read in TS_OBJ_print_bio() Pointer arithmetic undefined behaviour Constant time flag not preserved in DSA signing DTLS buffered message DoS DTLS replay protection DoS Certificate message OOB reads Excessive allocation of memory in tls_get_message_header() Excessive allocation of memory in dtls1_preprocess_fragment() NB: LibreSSL is only affected by CVE-2016-6304
last seen	2020-06-01
modified	2020-06-02
plugin id	93674
published	2016-09-23
reporter	This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93674
title	FreeBSD : OpenSSL -- multiple vulnerabilities (43eaa656-80bc-11e6-bf52-b499baebfeaf)

NASL family	Web Servers
NASL id	OPENSSL_1_0_2I.NASL
description	According to its banner, the remote host is running a version of OpenSSL 1.0.2 prior to 1.0.2i. It is, therefore, affected by the following vulnerabilities : - Multiple integer overflow conditions exist in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	93815
published	2016-09-30
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93815
title	OpenSSL 1.0.2 < 1.0.2i Multiple Vulnerabilities (SWEET32)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2018-168.NASL
description	This update for openssl-steam fixes the following issues : - Merged changes from upstream openssl (Factory rev 137) into this fork for Steam. Updated to openssl 1.0.2k : - CVE-2016-7055: Montgomery multiplication may produce incorrect results (boo#1009528) - CVE-2016-7056: ECSDA P-256 timing attack key recovery (boo#1019334) - CVE-2017-3731: Truncated packet could crash via OOB read (boo#1022085) - CVE-2017-3732: BN_mod_exp may produce incorrect results on x86_64 (boo#1022086) Update to openssl-1.0.2j : - CVE-2016-7052: Missing CRL sanity check (boo#1001148) OpenSSL Security Advisory [22 Sep 2016] (boo#999665) - Severity: High - CVE-2016-6304: OCSP Status Request extension unbounded memory growth (boo#999666) - Severity: Low - CVE-2016-2177: Pointer arithmetic undefined behaviour (boo#982575) - CVE-2016-2178: Constant time flag not preserved in DSA signing (boo#983249) - CVE-2016-2179: DTLS buffered message DoS (boo#994844) - CVE-2016-2180: OOB read in TS_OBJ_print_bio() (boo#990419) - CVE-2016-2181: DTLS replay protection DoS (boo#994749) - CVE-2016-2182: OOB write in BN_bn2dec() (boo#993819) - CVE-2016-2183: Birthday attack against 64-bit block ciphers (SWEET32) (boo#995359) - CVE-2016-6302: Malformed SHA512 ticket DoS (boo#995324) - CVE-2016-6303: OOB write in MDC2_Update() (boo#995377) - CVE-2016-6306: Certificate message OOB reads (boo#999668) ALso fixed : - fixed a crash in print_notice (boo#998190) - fix X509_CERT_FILE path (boo#1022271) and rename - resume reading from /dev/urandom when interrupted by a signal (boo#995075) - fix problems with locking in FIPS mode (boo#992120) - duplicates: boo#991877, boo#991193, boo#990392, boo#990428 and boo#990207 - drop openssl-fips_RSA_compute_d_with_lcm.patch (upstream) (boo#984323) - don
last seen	2020-06-05
modified	2018-02-16
plugin id	106863
published	2018-02-16
reporter	This script is Copyright (C) 2018-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/106863
title	openSUSE Security Update : openssl-steam (openSUSE-2018-168)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-3673.NASL
description	Several vulnerabilities were discovered in OpenSSL : - CVE-2016-2177 Guido Vranken discovered that OpenSSL uses undefined pointer arithmetic. Additional information can be found at https://www.openssl.org/blog/blog/2016/06/27/undefined-p ointer-arithmetic/ - CVE-2016-2178 Cesar Pereida, Billy Brumley and Yuval Yarom discovered a timing leak in the DSA code. - CVE-2016-2179 / CVE-2016-2181 Quan Luo and the OCAP audit team discovered denial of service vulnerabilities in DTLS. - CVE-2016-2180 / CVE-2016-2182 / CVE-2016-6303 Shi Lei discovered an out-of-bounds memory read in TS_OBJ_print_bio() and an out-of-bounds write in BN_bn2dec() and MDC2_Update(). - CVE-2016-2183 DES-based cipher suites are demoted from the HIGH group to MEDIUM as a mitigation for the SWEET32 attack. - CVE-2016-6302 Shi Lei discovered that the use of SHA512 in TLS session tickets is susceptible to denial of service. - CVE-2016-6304 Shi Lei discovered that excessively large OCSP status request may result in denial of service via memory exhaustion. - CVE-2016-6306 Shi Lei discovered that missing message length validation when parsing certificates may potentially result in denial of service.
last seen	2020-06-01
modified	2020-06-02
plugin id	93668
published	2016-09-23
reporter	This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93668
title	Debian DSA-3673-1 : openssl - security update

NASL family	Misc.
NASL id	ORACLE_ENTERPRISE_MANAGER_APR_2017_CPU.NASL
description	The version of Oracle Enterprise Manager Grid Control installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities : - Multiple integer overflow conditions exist in the OpenSSL component in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-2177) - An information disclosure vulnerability exists in the OpenSSL component in dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the OpenSSL component in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the OpenSSL component in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	99594
published	2017-04-21
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/99594
title	Oracle Enterprise Manager Grid Control Multiple Vulnerabilities (April 2017 CPU) (SWEET32)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2016-1134.NASL
description	This update for openssl fixes the following issues : OpenSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High - OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low - Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575) - Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) - DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) - OOB read in TS_OBJ_print_bio() (CVE-2016-2180) (bsc#990419) - DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) - OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) - Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) - Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) - OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) - Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Also following bugs were fixed : - update expired S/MIME certs (bsc#979475) - improve s390x performance (bsc#982745) - allow >= 64GB AESGCM transfers (bsc#988591) - fix crash in print_notice (bsc#998190) - resume reading from /dev/urandom when interrupted by a signal (bsc#995075) This update was imported from the SUSE:SLE-12-SP1:Update update project.
last seen	2020-06-05
modified	2016-09-28
plugin id	93783
published	2016-09-28
reporter	This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/93783
title	openSUSE Security Update : openssl (openSUSE-2016-1134)

NASL family	Databases
NASL id	MYSQL_5_7_16_RPM.NASL
description	The version of MySQL running on the remote host is 5.7.x prior to 5.7.16. It is, therefore, affected by multiple vulnerabilities : - Multiple integer overflow conditions exist in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-04
modified	2016-10-21
plugin id	94198
published	2016-10-21
reporter	This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/94198
title	MySQL 5.7.x < 5.7.16 Multiple Vulnerabilities (October 2016 CPU) (SWEET32)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DLA-637.NASL
description	Several vulnerabilities were discovered in OpenSSL : CVE-2016-2177 Guido Vranken discovered that OpenSSL uses undefined pointer arithmetic. Additional information can be found at https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithme tic/ CVE-2016-2178 Cesar Pereida, Billy Brumley and Yuval Yarom discovered a timing leak in the DSA code. CVE-2016-2179 / CVE-2016-2181 Quan Luo and the OCAP audit team discovered denial of service vulnerabilities in DTLS. CVE-2016-2180 / CVE-2016-2182 / CVE-2016-6303 Shi Lei discovered an out-of-bounds memory read in TS_OBJ_print_bio() and an out-of-bounds write in BN_bn2dec() and MDC2_Update(). CVE-2016-2183 DES-based cipher suites are demoted from the HIGH group to MEDIUM as a mitigation for the SWEET32 attack. CVE-2016-6302 Shi Lei discovered that the use of SHA512 in TLS session tickets is susceptible to denial of service. CVE-2016-6304 Shi Lei discovered that excessively large OCSP status request may result in denial of service via memory exhaustion. CVE-2016-6306 Shi Lei discovered that missing message length validation when parsing certificates may potentially result in denial of service. For Debian 7
last seen	2020-03-17
modified	2016-09-26
plugin id	93690
published	2016-09-26
reporter	This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/93690
title	Debian DLA-637-1 : openssl security update

NASL family	MacOS X Local Security Checks
NASL id	MACOS_10_12_2.NASL
description	The remote host is running a version of macOS that is 10.12.x prior to 10.12.2. It is, therefore, affected by multiple vulnerabilities in the following components : - apache_mod_php - AppleGraphicsPowerManagement - Assets - Audio - Bluetooth - CoreCapture - CoreFoundation - CoreGraphics - CoreMedia External Displays - CoreMedia Playback - CoreStorage - CoreText - curl - Directory Services - Disk Images - FontParser - Foundation - Grapher - ICU - ImageIO - Intel Graphics Driver - IOFireWireFamily - IOAcceleratorFamily - IOHIDFamily - IOKit - IOSurface - Kernel - kext tools - libarchive - LibreSSL - OpenLDAP - OpenPAM - OpenSSL - Power Management - Security - syslog - WiFi - xar Note that successful exploitation of the most serious issues can result in arbitrary code execution. Furthermore, CVE-2016-6304, CVE-2016-7596, and CVE-2016-7604 also affect Mac OS X versions 10.10.5 and 10.11.6. However, this plugin does not check those versions.
last seen	2020-06-01
modified	2020-06-02
plugin id	95917
published	2016-12-16
reporter	This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/95917
title	macOS 10.12.x < 10.12.2 Multiple Vulnerabilities

NASL family	Junos Local Security Checks
NASL id	JUNIPER_JSA10759.NASL
description	According to its self-reported version number, the remote Juniper Junos device is affected by the following vulnerabilities related to OpenSSL : - A flaw exists in the ssl3_get_key_exchange() function in file s3_clnt.c when handling a ServerKeyExchange message for an anonymous DH ciphersuite with the value of
last seen	2020-03-18
modified	2017-01-05
plugin id	96316
published	2017-01-05
reporter	This script is Copyright (C) 2017-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/96316
title	Juniper Junos Multiple OpenSSL Vulnerabilities (JSA10759) (SWEET32)

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-3087-2.NASL
description	USN-3087-1 fixed vulnerabilities in OpenSSL. The fix for CVE-2016-2182 was incomplete and caused a regression when parsing certificates. This update fixes the problem. We apologize for the inconvenience. Shi Lei discovered that OpenSSL incorrectly handled the OCSP Status Request extension. A remote attacker could possibly use this issue to cause memory consumption, resulting in a denial of service. (CVE-2016-6304) Guido Vranken discovered that OpenSSL used undefined behaviour when performing pointer arithmetic. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue has only been addressed in Ubuntu 16.04 LTS in this update. (CVE-2016-2177) Cesar Pereida, Billy Brumley, and Yuval Yarom discovered that OpenSSL did not properly use constant-time operations when performing DSA signing. A remote attacker could possibly use this issue to perform a cache-timing attack and recover private DSA keys. (CVE-2016-2178) Quan Luo discovered that OpenSSL did not properly restrict the lifetime of queue entries in the DTLS implementation. A remote attacker could possibly use this issue to consume memory, resulting in a denial of service. (CVE-2016-2179) Shi Lei discovered that OpenSSL incorrectly handled memory in the TS_OBJ_print_bio() function. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-2180) It was discovered that the OpenSSL incorrectly handled the DTLS anti-replay feature. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-2181) Shi Lei discovered that OpenSSL incorrectly validated division results. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-2182) Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions. This update moves DES from the HIGH cipher list to MEDIUM. (CVE-2016-2183) Shi Lei discovered that OpenSSL incorrectly handled certain ticket lengths. A remote attacker could use this issue to cause a denial of service. (CVE-2016-6302) Shi Lei discovered that OpenSSL incorrectly handled memory in the MDC2_Update() function. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-6303) Shi Lei discovered that OpenSSL incorrectly performed certain message length checks. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-6306). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	93715
published	2016-09-26
reporter	Ubuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93715
title	Ubuntu 12.04 LTS / 14.04 LTS / 16.04 LTS : openssl regression (USN-3087-2)

NASL family	Misc.
NASL id	PVS_5_2_0.NASL
description	The version of Tenable Passive Vulnerability Scanner (PVS) installed on the remote host is 5.x < 5.2.0. It is, therefore, affected by multiple vulnerabilities : - Multiple denial of service vulnerabilities exist in Expat within file xmlparse.c due to a logical error in hash computations. An unauthenticated, remote attacker can exploit these, via a specially crafted XML file containing many identifiers with the same value, to cause the service to exhaust CPU resources. (CVE-2012-0876, CVE-2016-5300) - A flaw exists in the generate_hash_secret_salt() function in file lib/xmlparse.c within Expat due to the generation of non-random output by the PRNG. An unauthenticated, remote attacker can exploit this to more easily predict the PRNG output. (CVE-2012-6702) - Multiple buffer overflow conditions exist within Expat, specifically in the XML_GetBuffer() function in file lib/xmlparse.c, due to improper validation of user-supplied input when handling compressed XML content. An unauthenticated, remote attacker can exploit these to execute arbitrary code. (CVE-2015-1283, CVE-2016-4472) - Multiple buffer overflow conditions exist within the Expat XML parser when handling malformed input documents due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-0718, CVE-2016-0719) - Multiple integer overflow conditions exist in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit these to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	96337
published	2017-01-06
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/96337
title	Tenable Passive Vulnerability Scanner 5.x < 5.2.0 Multiple Vulnerabilities (SWEET32)

NASL family	Misc.
NASL id	SECURITYCENTER_OPENSSL_1_0_1U.NASL
description	The Tenable SecurityCenter application installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities in the bundled version of OpenSSL : - Multiple integer overflow conditions exist in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	101045
published	2017-06-26
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/101045
title	Tenable SecurityCenter OpenSSL 1.0.1 < 1.0.1u Multiple Vulnerabilities (SWEET32)

NASL family	Databases
NASL id	MYSQL_5_6_34_RPM.NASL
description	The version of MySQL running on the remote host is 5.6.x prior to 5.6.34. It is, therefore, affected by multiple vulnerabilities : - Multiple integer overflow conditions exist in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-04
modified	2016-10-21
plugin id	94197
published	2016-10-21
reporter	This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/94197
title	MySQL 5.6.x < 5.6.34 Multiple Vulnerabilities (October 2016 CPU) (SWEET32)

NASL family	CGI abuses : XSS
NASL id	NESSUS_TNS_2016_16.NASL
description	According to its self-reported version number, the Tenable Nessus application running on the remote host is 6.x prior to 6.9. It is, therefore, affected by multiple vulnerabilities : - Multiple integer overflow conditions exist in the OpenSSL component in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the OpenSSL component in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the OpenSSL component in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the OpenSSL component in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	97192
published	2017-02-15
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/97192
title	Tenable Nessus 6.x < 6.9 Multiple Vulnerabilities (TNS-2016-16) (SWEET32)

NASL family	Databases
NASL id	MYSQL_5_7_16.NASL
description	The version of MySQL running on the remote host is 5.7.x prior to 5.7.16. It is, therefore, affected by multiple vulnerabilities : - Multiple integer overflow conditions exist in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	94167
published	2016-10-20
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/94167
title	MySQL 5.7.x < 5.7.16 Multiple Vulnerabilities (October 2016 CPU) (SWEET32)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2016-1189.NASL
description	This update for compat-openssl098 fixes the following issues : OpenSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High - OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low - Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575) - Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) - DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) - DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) - OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) - Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) - Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) - OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) - Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Bugs fixed : - update expired S/MIME certs (bsc#979475) - fix crash in print_notice (bsc#998190) - resume reading from /dev/urandom when interrupted by a signal (bsc#995075) This update was imported from the SUSE:SLE-12:Update update project.
last seen	2020-06-05
modified	2016-10-17
plugin id	94086
published	2016-10-17
reporter	This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/94086
title	openSUSE Security Update : compat-openssl098 (openSUSE-2016-1189)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2016-2394-1.NASL
description	This update for openssl fixes the following issues: OpenSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High - OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low - Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575) - Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) - DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) - OOB read in TS_OBJ_print_bio() (CVE-2016-2180) (bsc#990419) - DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) - OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) - Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) - Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) - OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) - Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Also following bugs were fixed : - update expired S/MIME certs (bsc#979475) - improve s390x performance (bsc#982745) - allow >= 64GB AESGCM transfers (bsc#988591) - fix crash in print_notice (bsc#998190) - resume reading from /dev/urandom when interrupted by a signal (bsc#995075) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	93765
published	2016-09-28
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93765
title	SUSE SLED12 / SLES12 Security Update : openssl (SUSE-SU-2016:2394-1)

NASL family	AIX Local Security Checks
NASL id	AIX_OPENSSL_ADVISORY21.NASL
description	The version of OpenSSL installed on the remote AIX host is affected by the following vulnerabilities : - Multiple integer overflow conditions exist in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	95255
published	2016-11-22
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/95255
title	AIX OpenSSL Advisory : openssl_advisory21.asc (SWEET32)

NASL family	Slackware Local Security Checks
NASL id	SLACKWARE_SSA_2016-266-01.NASL
description	New openssl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	93663
published	2016-09-23
reporter	This script is Copyright (C) 2016-2017 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/93663
title	Slackware 14.0 / 14.1 / 14.2 / current : openssl (SSA:2016-266-01)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2016-2387-1.NASL
description	This update for openssl fixes the following issues: OpenSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High - OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low - Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575) - Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) - DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) - OOB read in TS_OBJ_print_bio() (CVE-2016-2180) (bsc#990419) - DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) - OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) - Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) - Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) - OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) - Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Also following bugs were fixed : - update expired S/MIME certs (bsc#979475) - improve s390x performance (bsc#982745) - allow >= 64GB AESGCM transfers (bsc#988591) - fix crash in print_notice (bsc#998190) - resume reading from /dev/urandom when interrupted by a signal (bsc#995075) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	93734
published	2016-09-27
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93734
title	SUSE SLES12 Security Update : openssl (SUSE-SU-2016:2387-1)

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-3087-1.NASL
description	Shi Lei discovered that OpenSSL incorrectly handled the OCSP Status Request extension. A remote attacker could possibly use this issue to cause memory consumption, resulting in a denial of service. (CVE-2016-6304) Guido Vranken discovered that OpenSSL used undefined behaviour when performing pointer arithmetic. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue has only been addressed in Ubuntu 16.04 LTS in this update. (CVE-2016-2177) Cesar Pereida, Billy Brumley, and Yuval Yarom discovered that OpenSSL did not properly use constant-time operations when performing DSA signing. A remote attacker could possibly use this issue to perform a cache-timing attack and recover private DSA keys. (CVE-2016-2178) Quan Luo discovered that OpenSSL did not properly restrict the lifetime of queue entries in the DTLS implementation. A remote attacker could possibly use this issue to consume memory, resulting in a denial of service. (CVE-2016-2179) Shi Lei discovered that OpenSSL incorrectly handled memory in the TS_OBJ_print_bio() function. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-2180) It was discovered that the OpenSSL incorrectly handled the DTLS anti-replay feature. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-2181) Shi Lei discovered that OpenSSL incorrectly validated division results. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-2182) Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions. This update moves DES from the HIGH cipher list to MEDIUM. (CVE-2016-2183) Shi Lei discovered that OpenSSL incorrectly handled certain ticket lengths. A remote attacker could use this issue to cause a denial of service. (CVE-2016-6302) Shi Lei discovered that OpenSSL incorrectly handled memory in the MDC2_Update() function. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-6303) Shi Lei discovered that OpenSSL incorrectly performed certain message length checks. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-6306). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	93684
published	2016-09-23
reporter	Ubuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93684
title	Ubuntu 12.04 LTS / 14.04 LTS / 16.04 LTS : openssl vulnerabilities (USN-3087-1)

NASL family	Databases
NASL id	MYSQL_5_6_34.NASL
description	The version of MySQL running on the remote host is 5.6.x prior to 5.6.34. It is, therefore, affected by multiple vulnerabilities : - Multiple integer overflow conditions exist in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	94166
published	2016-10-20
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/94166
title	MySQL 5.6.x < 5.6.34 Multiple Vulnerabilities (October 2016 CPU) (SWEET32)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2016-2468-1.NASL
description	This update for compat-openssl098 fixes the following issues: OpenSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High - OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low - Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575) - Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) - DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) - DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) - OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) - Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) - Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) - OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) - Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Bugs fixed : - update expired S/MIME certs (bsc#979475) - fix crash in print_notice (bsc#998190) - resume reading from /dev/urandom when interrupted by a signal (bsc#995075) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	93909
published	2016-10-07
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93909
title	SUSE SLED12 / SLES12 Security Update : compat-openssl098 (SUSE-SU-2016:2468-1)

Packetstorm

data source	https://packetstormsecurity.com/files/download/143369/orionbrowser79-mitm.txt
id	PACKETSTORM:143369
last seen	2017-07-15
published	2017-07-14
reporter	MaXe
source	https://packetstormsecurity.com/files/143369/Orion-Elite-Hidden-IP-Browser-Pro-7.9-OpenSSL-Tor-Man-In-The-Middle.html
title	Orion Elite Hidden IP Browser Pro 7.9 OpenSSL / Tor / Man-In-The-Middle

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Nessus

Packetstorm

References