Vulnerabilities > CVE-2016-6304 - Memory Leak vulnerability in multiple products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

nessus

NVD

Published: 2016-09-26

Updated: 2024-11-21

Summary

Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.

Vulnerable Configurations

Part	Description	Count
Application	Openssl Openssl Openssl 1.0.2A Openssl Openssl 1.0.2E Openssl Openssl 1.0.2B Openssl Openssl 1.0.2H Openssl Openssl 1.0.2C Openssl Openssl 1.0.2 Openssl Openssl 1.0.2F Openssl Openssl 1.0.2D Openssl Openssl 1.1.0 Openssl Openssl 1.0.1M Openssl Openssl 1.0.1J Openssl Openssl 1.0.1 Openssl Openssl 1.0.1H Openssl Openssl 1.0.1R Openssl Openssl 1.0.1C Openssl Openssl 1.0.1G Openssl Openssl 1.0.1A Openssl Openssl 1.0.1D Openssl Openssl 1.0.1T Openssl Openssl 1.0.1P Openssl Openssl 1.0.1K Openssl Openssl 1.0.1B Openssl Openssl 1.0.1N Openssl Openssl 1.0.1Q Openssl Openssl 1.0.1E Openssl Openssl 1.0.1L Openssl Openssl 1.0.1F Openssl Openssl 1.0.1S Openssl Openssl 1.0.1O Openssl Openssl 1.0.1I	36
Application	Nodejs Nodejs Node.Js 0.12.0 Nodejs Node.Js 0.12.1 Nodejs Node.Js 0.12.2 Nodejs Node.Js 0.12.3 Nodejs Node.Js 0.12.4 Nodejs Node.Js 0.12.5 Nodejs Node.Js 0.12.6 Nodejs Node.Js 0.12.7 Nodejs Node.Js 0.12.8 Nodejs Node.Js 0.12.9 Nodejs Node.Js 0.12.10 Nodejs Node.Js 0.12.11 Nodejs Node.Js 0.12.12 Nodejs Node.Js 0.12.13 Nodejs Node.Js 0.12.14 Nodejs Node.Js 0.12.15 Nodejs Node.Js 0.10.0 Nodejs Node.Js 0.10.1 Nodejs Node.Js 0.10.2 Nodejs Node.Js 0.10.3 Nodejs Node.Js 0.10.4 Nodejs Node.Js 0.10.5 Nodejs Node.Js 0.10.6 Nodejs Node.Js 0.10.7 Nodejs Node.Js 0.10.8 Nodejs Node.Js 0.10.9 Nodejs Node.Js 0.10.10 Nodejs Node.Js 0.10.11 Nodejs Node.Js 0.10.12 Nodejs Node.Js 0.10.13 Nodejs Node.Js 0.10.14 Nodejs Node.Js 0.10.15 Nodejs Node.Js 0.10.16 Nodejs Node.Js 0.10.16-Isaacs-Manual Nodejs Node.Js 0.10.17 Nodejs Node.Js 0.10.18 Nodejs Node.Js 0.10.19 Nodejs Node.Js 0.10.20 Nodejs Node.Js 0.10.21 Nodejs Node.Js 0.10.22 Nodejs Node.Js 0.10.23 Nodejs Node.Js 0.10.24 Nodejs Node.Js 0.10.25 Nodejs Node.Js 0.10.26 Nodejs Node.Js 0.10.27 Nodejs Node.Js 0.10.28 Nodejs Node.Js 0.10.29 Nodejs Node.Js 0.10.30 Nodejs Node.Js 0.10.31 Nodejs Node.Js 0.10.32 Nodejs Node.Js 0.10.33 Nodejs Node.Js 0.10.34 Nodejs Node.Js 0.10.35 Nodejs Node.Js 0.10.36 Nodejs Node.Js 0.10.37 Nodejs Node.Js 0.10.38 Nodejs Node.Js 0.10.39 Nodejs Node.Js 0.10.40 Nodejs Node.Js 0.10.41 Nodejs Node.Js 0.10.42 Nodejs Node.Js 0.10.43 Nodejs Node.Js 0.10.44 Nodejs Node.Js 0.10.45 Nodejs Node.Js 0.10.46 Nodejs Node.Js 6.0.0 Nodejs Node.Js 6.1.0 Nodejs Node.Js 6.2.0 Nodejs Node.Js 6.2.1 Nodejs Node.Js 6.2.2 Nodejs Node.Js 6.3.0 Nodejs Node.Js 6.3.1 Nodejs Node.Js 6.4.0 Nodejs Node.Js 6.5.0 Nodejs Node.Js 6.6.0 Nodejs Node.Js 4.0.0 Nodejs Node.Js 4.1.0 Nodejs Node.Js 4.1.1 Nodejs Node.Js 4.1.2 Nodejs Node.Js 4.2.0 Nodejs Node.Js 4.2.1 Nodejs Node.Js 4.2.2 Nodejs Node.Js 4.2.3 Nodejs Node.Js 4.2.4 Nodejs Node.Js 4.2.5 Nodejs Node.Js 4.2.6 Nodejs Node.Js 4.3.0 Nodejs Node.Js 4.3.1 Nodejs Node.Js 4.3.2 Nodejs Node.Js 4.4.0 Nodejs Node.Js 4.4.1 Nodejs Node.Js 4.4.2 Nodejs Node.Js 4.4.3 Nodejs Node.Js 4.4.4 Nodejs Node.Js 4.4.5 Nodejs Node.Js 4.4.6 Nodejs Node.Js 4.4.7 Nodejs Node.Js 4.5.0	113
OS	Novell Novell Suse Linux Enterprise Module FOR WEB Scripting 12.0	1

Common Weakness Enumeration (CWE)

CWE-401 - Improper Release of Memory Before Removing Last Reference ('Memory Leak')

Nessus

NASL family	CGI abuses
NASL id	MYSQL_ENTERPRISE_MONITOR_3_1_5_7958.NASL
description	According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 3.1.x prior to 3.1.5.7958. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the bundled version of Apache Tomcat in the Manager and Host Manager web applications due to a flaw in the index page when issuing redirects in response to unauthenticated requests for the root directory of the application. An authenticated, remote attacker can exploit this to gain access to the XSRF token information stored in the index page. (CVE-2015-5351) - A remote code execution vulnerability exists in the Framework subcomponent that allows an authenticated, remote attacker to execute arbitrary code. (CVE-2016-0635) - An information disclosure vulnerability exists in the bundled version of Apache Tomcat that allows a specially crafted web application to load the StatusManagerServlet. An authenticated, remote attacker can exploit this to gain unauthorized access to a list of all deployed applications and a list of the HTTP request lines for all requests currently being processed. (CVE-2016-0706) - A remote code execution vulnerability exists in the bundled version of Apache Tomcat due to a flaw in the StandardManager, PersistentManager, and cluster implementations that is triggered when handling persistent sessions. An authenticated, remote attacker can exploit this, via a crafted object in a session, to bypass the security manager and execute arbitrary code. (CVE-2016-0714) - A security bypass vulnerability exists in the bundled version of Apache Tomcat due to a failure to consider whether ResourceLinkFactory.setGlobalContext callers are authorized. An authenticated, remote attacker can exploit this, via a web application that sets a crafted global context, to bypass intended SecurityManager restrictions and read or write to arbitrary application data or cause a denial of service condition. (CVE-2016-0763) - Multiple integer overflow conditions exist in the bundled version of OpenSSL in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the bundled version of OpenSSL in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the bundled version of OpenSSL in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the bundled version of OpenSSL in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	96767
published	2017-01-25
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/96767
title	MySQL Enterprise Monitor 3.1.x < 3.1.5.7958 Multiple Vulnerabilities (SWEET32) (January 2017 CPU)

NASL family	Misc.
NASL id	ORACLE_SECURE_GLOBAL_DESKTOP_APR_2017_CPU.NASL
description	The version of Oracle Secure Global Desktop installed on the remote host is 4.71, 5.2, or 5.3 and is missing a security patch from the April 2017 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities : - An integer overflow condition exists in the Window System (X11) subcomponent in multiple functions in X.Org libExt due to improper validation of user-supplied input when calculating the amount of memory required to handle return data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. Note that this issue only affects version 4.71. (CVE-2013-1982) - An integer overflow condition exists in X.Org libXfixes in the XFixesGetCursorImage() function when handling large cursor dimensions or name lengths due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-1983) - An integer overflow condition exists within multiple functions in X.Org libXi due to improper validation of user-supplied input when calculating the amount of memory needed to handle return data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-1984) - An integer overflow condition exists in X.Org libXinerama in the XineramaQueryScreens() function due to improper validation of user-supplied input when calculating the amount of memory needed to handle return data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-1985) - An integer overflow condition exists in multiple functions in X.Org libXrandr due to improper validation of user-supplied input when calculating the amount of memory needed to handle return data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-1986) - An integer overflow condition exists in multiple functions in X.Org libXrender due to improper validation of user-supplied input when calculating the amount of memory needed to handle return data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-1987) - An overflow condition exists in X.Org libXi in the XListInputDevices() function, related to an unexpected sign extension, due to improper checking of the amount of memory needed to handle returned data when converting smaller integer types to larger ones. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-1995) - An overflow condition exists within multiple functions in X.Org LibXi due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted length or index, to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-1998) - An overflow condition exists in X.Org LibXt in the _XtResourceConfigurationEH() function due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted length or index, to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-2002) - An integer overflow condition exists in X.Org libXcursor in the _XcursorFileHeaderCreate() function due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2013-2003) - An uninitialized pointer flaw exists within multiple functions in X.Org LibXt due to a failure to check for proper initialization of pointers. An unauthenticated, remote attacker can exploit this to corrupt memory, resulting in a denial of service condition or the possible execution of arbitrary code. (CVE-2013-2005) - A flaw exists in the Application Server subcomponent (Apache Tomcat) due to a failure to process passwords when they are paired with non-existent usernames. An authenticated, remote attacker can exploit this, via a timing attack, to enumerate user account names. (CVE-2016-0762) - Multiple integer overflow conditions exist in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit these to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	99930
published	2017-05-02
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/99930
title	Oracle Secure Global Desktop Multiple Vulnerabilities (April 2017 CPU) (SWEET32)

NASL family	MacOS X Local Security Checks
NASL id	MACOSX_SECUPD2016-007.NASL
description	The remote host is running a version of Mac OS X 10.10.5 or 10.11.6 that is missing a security update. It is therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists in the ssl_parse_clienthello_tlsext() function within file ssl/t1_lib.c when handling oversize OCSP Status Request extensions from clients. An unauthenticated, remote attacker can exploit this to cause memory exhaustion in a process linked with the library. (CVE-2016-6304) - A memory corruption issue exists in Bluetooth due to improper validation of user-supplied input. A local attacker can exploit this, via a specially crafted application, to cause a denial of service condition or the execution of arbitrary code with kernel level privileges. (CVE-2016-7596) - A NULL pointer dereference flaw exists in the CoreCapture component due to improper validation of user-supplied input. A local attacker can exploit this to cause a denial of service condition. (CVE-2016-7604)
last seen	2020-06-01
modified	2020-06-02
plugin id	95918
published	2016-12-16
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/95918
title	Mac OS X Multiple Vulnerabilities (Security Updates 2016-003 / 2016-007)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2016-1130.NASL
description	This update for openssl fixes the following issues : OpenSSL Security Advisory [22 Sep 2016] (boo#999665) Severity: High - OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (boo#999666) Severity: Low - Pointer arithmetic undefined behaviour (CVE-2016-2177) (boo#982575) - Constant time flag not preserved in DSA signing (CVE-2016-2178) (boo#983249) - DTLS buffered message DoS (CVE-2016-2179) (boo#994844) - OOB read in TS_OBJ_print_bio() (CVE-2016-2180) (boo#990419) - DTLS replay protection DoS (CVE-2016-2181) (boo#994749) - OOB write in BN_bn2dec() (CVE-2016-2182) (boo#993819) - Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (boo#995359) - Malformed SHA512 ticket DoS (CVE-2016-6302) (boo#995324) - OOB write in MDC2_Update() (CVE-2016-6303) (boo#995377) - Certificate message OOB reads (CVE-2016-6306) (boo#999668) More information can be found on https://www.openssl.org/news/secadv/20160922.txt - update expired S/MIME certs (boo#979475) - allow >= 64GB AESGCM transfers (boo#988591) - fix crash in print_notice (boo#998190) - resume reading from /dev/urandom when interrupted by a signal (boo#995075)
last seen	2020-06-05
modified	2016-09-28
plugin id	93756
published	2016-09-28
reporter	This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/93756
title	openSUSE Security Update : openssl (openSUSE-2016-1130)

NASL family	CGI abuses
NASL id	IBM_BIGFIX_REMOTE_CONTROL_9_1_3.NASL
description	The version of IBM BigFix Remote Control running on the remote host is prior to 9.1.3. It is, therefore, affected by the multiple vulnerabilities : - Multiple integer overflow conditions exist in the bundled version of OpenSSL in files s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the bundled version of OpenSSL in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A vulnerability exists, known as SWEET32, in the bundled version of OpenSSL in the 3DES and Blowfish algorithms due to the use of weak 64-bit block ciphers by default. A man-in-the-middle attacker who has sufficient resources can exploit this vulnerability, via a
last seen	2020-06-01
modified	2020-06-02
plugin id	96145
published	2016-12-27
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/96145
title	IBM BigFix Remote Control < 9.1.3 Multiple Vulnerabilities (SWEET32)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2016-2458-1.NASL
description	This update for openssl fixes the following issues: OpenSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High - OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low - Pointer arithmetic undefined behavior (CVE-2016-2177) (bsc#982575) - Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) - DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) - DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) - OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) - Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) - Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) - OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) - Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Bugs fixed : - Update expired S/MIME certs (bsc#979475) - Fix crash in print_notice (bsc#998190) - Resume reading from /dev/urandom when interrupted by a signal (bsc#995075) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	93893
published	2016-10-06
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93893
title	SUSE SLES11 Security Update : openssl (SUSE-SU-2016:2458-1)

NASL family	F5 Networks Local Security Checks
NASL id	F5_BIGIP_SOL54211024.NASL
description	Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions. (CVE-2016-6304)
last seen	2020-06-01
modified	2020-06-02
plugin id	94479
published	2016-11-03
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/94479
title	F5 Networks BIG-IP : OpenSSL vulnerability (K54211024)

NASL family	Misc.
NASL id	ORACLE_ACCESS_MANAGER_CPU_JAN_2018.NASL
description	The version of Oracle Access Manager installed on the remote host is 10.1.4.3.x prior to 10.1.4.3.13 or 11.1.2.3.x prior to 11.1.2.3.180116. It is, therefore, affected by multiple vulnerabilities as noted in the October 2018 Critical Patch Update advisory: - A Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin (OpenSSL)). The affected version is 10.1.4.3.0. This is a difficult to exploit vulnerability that allows unauthenticated attacker with network access via HTTPS to compromise Oracle Access Manager. A successful attack of this vulnerability may result in unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. (CVE-2017-3732) - A vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). The affected version is 11.1.2.3.0. This is a difficult to exploit vulnerability that allows an unauthenticated attacker with network access via HTTPS to compromise Oracle Access Manager. A successful attack of this vulnerability may result in unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. (CVE-2017-10262) Note that Nessus has not tested for these issues but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	124059
published	2019-04-15
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124059
title	Oracle Access Manager Multiple Vulnerabilities (Jan 2018 CPU)

NASL family	Amazon Linux Local Security Checks
NASL id	ALA_ALAS-2016-749.NASL
description	A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. The OpenSSL Security Advisory [22 Sep 2016] refers to additional CVEs. CVE-2016-6305 does not affect OpenSSL 1.0.1. The remaining CVEs listed will be fixed in a later update. The OpenSSL Security Advisory [26 Sep 2016] refers to two additional CVEs which do not affect OpenSSL 1.0.1. (Updated 2016-09-26: Included a reference to the 26 Sep 2016 upstream advisory.)
last seen	2020-06-01
modified	2020-06-02
plugin id	93665
published	2016-09-23
reporter	This script is Copyright (C) 2016-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/93665
title	Amazon Linux AMI : openssl (ALAS-2016-749)

NASL family	Web Servers
NASL id	OPENSSL_1_0_1U.NASL
description	According to its banner, the remote host is running a version of OpenSSL 1.0.1 prior to 1.0.1u. It is, therefore, affected by the following vulnerabilities : - Multiple integer overflow conditions exist in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	93814
published	2016-09-30
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93814
title	OpenSSL 1.0.1 < 1.0.1u Multiple Vulnerabilities (SWEET32)

NASL family	CGI abuses
NASL id	MYSQL_ENTERPRISE_MONITOR_3_2_5_1141.NASL
description	According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 3.2.x prior to 3.2.5.1141. It is, therefore, affected by multiple vulnerabilities : - Multiple integer overflow conditions exist in the bundled version of OpenSSL in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the bundled version of OpenSSL in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the bundled version of OpenSSL in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the bundled version of OpenSSL in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	96770
published	2017-01-25
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/96770
title	MySQL Enterprise Monitor 3.2.x < 3.2.5.1141 Multiple Vulnerabilities (SWEET32) (January 2017 CPU)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2016-A555159613.NASL
description	Update from upstream with multiple security issues fixed. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2016-09-28
plugin id	93752
published	2016-09-28
reporter	This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93752
title	Fedora 24 : 1:openssl (2016-a555159613)

NASL family	CGI abuses
NASL id	MYSQL_ENTERPRISE_MONITOR_3_3_1_1112.NASL
description	According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 3.3.x prior to 3.3.1.1112. It is, therefore, affected by multiple vulnerabilities in the bundled version of OpenSSL : - Multiple integer overflow conditions exist in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	96771
published	2017-01-25
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/96771
title	MySQL Enterprise Monitor 3.3.x < 3.3.1.1112 Multiple Vulnerabilities (SWEET32) (January 2017 CPU)

NASL family	Misc.
NASL id	ORACLE_E-BUSINESS_CPU_JUL_2017.NASL
description	The version of Oracle E-Business installed on the remote host is missing the July 2017 Oracle Critical Patch Update (CPU). It is, therefore, affected by the following vulnerabilities : - Multiple integer overflow conditions exist in the OpenSSL component in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the OpenSSL component in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the OpennSSL component in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the OpenSSL component in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	101845
published	2017-07-20
reporter	This script is Copyright (C) 2017-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/101845
title	Oracle E-Business Multiple Vulnerabilities (July 2017 CPU) (SWEET32)

NASL family	FreeBSD Local Security Checks
NASL id	FREEBSD_PKG_43EAA65680BC11E6BF52B499BAEBFEAF.NASL
description	OpenSSL reports : High: OCSP Status Request extension unbounded memory growth SSL_peek() hang on empty record SWEET32 Mitigation OOB write in MDC2_Update() Malformed SHA512 ticket DoS OOB write in BN_bn2dec() OOB read in TS_OBJ_print_bio() Pointer arithmetic undefined behaviour Constant time flag not preserved in DSA signing DTLS buffered message DoS DTLS replay protection DoS Certificate message OOB reads Excessive allocation of memory in tls_get_message_header() Excessive allocation of memory in dtls1_preprocess_fragment() NB: LibreSSL is only affected by CVE-2016-6304
last seen	2020-06-01
modified	2020-06-02
plugin id	93674
published	2016-09-23
reporter	This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93674
title	FreeBSD : OpenSSL -- multiple vulnerabilities (43eaa656-80bc-11e6-bf52-b499baebfeaf)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2016-1289.NASL
description	mysql-community-server was updated to 5.6.34 to fix the following issues : - Changes http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6- 34.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6- 33.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6- 32.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6- 31.html - fixed CVEs: CVE-2016-6304, CVE-2016-6662, CVE-2016-7440, CVE-2016-5584, CVE-2016-5617, CVE-2016-5616, CVE-2016-5626, CVE-2016-3492, CVE-2016-5629, CVE-2016-5507, CVE-2016-8283, CVE-2016-5609, CVE-2016-5612, CVE-2016-5627, CVE-2016-5630, CVE-2016-8284, CVE-2016-8288, CVE-2016-3477, CVE-2016-2105, CVE-2016-3486, CVE-2016-3501, CVE-2016-3521, CVE-2016-3615, CVE-2016-3614, CVE-2016-3459, CVE-2016-5439, CVE-2016-5440 - fixes SUSE Bugs: [boo#999666], [boo#998309], [boo#1005581], [boo#1005558], [boo#1005563], [boo#1005562], [boo#1005566], [boo#1005555], [boo#1005569], [boo#1005557], [boo#1005582], [boo#1005560], [boo#1005561], [boo#1005567], [boo#1005570], [boo#1005583], [boo#1005586], [boo#989913], [boo#977614], [boo#989914], [boo#989915], [boo#989919], [boo#989922], [boo#989921], [boo#989911], [boo#989925], [boo#989926] - append
last seen	2020-06-05
modified	2016-11-14
plugin id	94756
published	2016-11-14
reporter	This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/94756
title	openSUSE Security Update : mysql-community-server (openSUSE-2016-1289)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2016-97454404FE.NASL
description	Update from upstream with multiple security issues fixed. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2016-10-12
plugin id	93978
published	2016-10-12
reporter	This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93978
title	Fedora 23 : 1:openssl (2016-97454404fe)

NASL family	Web Servers
NASL id	OPENSSL_1_0_2I.NASL
description	According to its banner, the remote host is running a version of OpenSSL 1.0.2 prior to 1.0.2i. It is, therefore, affected by the following vulnerabilities : - Multiple integer overflow conditions exist in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	93815
published	2016-09-30
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93815
title	OpenSSL 1.0.2 < 1.0.2i Multiple Vulnerabilities (SWEET32)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2018-168.NASL
description	This update for openssl-steam fixes the following issues : - Merged changes from upstream openssl (Factory rev 137) into this fork for Steam. Updated to openssl 1.0.2k : - CVE-2016-7055: Montgomery multiplication may produce incorrect results (boo#1009528) - CVE-2016-7056: ECSDA P-256 timing attack key recovery (boo#1019334) - CVE-2017-3731: Truncated packet could crash via OOB read (boo#1022085) - CVE-2017-3732: BN_mod_exp may produce incorrect results on x86_64 (boo#1022086) Update to openssl-1.0.2j : - CVE-2016-7052: Missing CRL sanity check (boo#1001148) OpenSSL Security Advisory [22 Sep 2016] (boo#999665) - Severity: High - CVE-2016-6304: OCSP Status Request extension unbounded memory growth (boo#999666) - Severity: Low - CVE-2016-2177: Pointer arithmetic undefined behaviour (boo#982575) - CVE-2016-2178: Constant time flag not preserved in DSA signing (boo#983249) - CVE-2016-2179: DTLS buffered message DoS (boo#994844) - CVE-2016-2180: OOB read in TS_OBJ_print_bio() (boo#990419) - CVE-2016-2181: DTLS replay protection DoS (boo#994749) - CVE-2016-2182: OOB write in BN_bn2dec() (boo#993819) - CVE-2016-2183: Birthday attack against 64-bit block ciphers (SWEET32) (boo#995359) - CVE-2016-6302: Malformed SHA512 ticket DoS (boo#995324) - CVE-2016-6303: OOB write in MDC2_Update() (boo#995377) - CVE-2016-6306: Certificate message OOB reads (boo#999668) ALso fixed : - fixed a crash in print_notice (boo#998190) - fix X509_CERT_FILE path (boo#1022271) and rename - resume reading from /dev/urandom when interrupted by a signal (boo#995075) - fix problems with locking in FIPS mode (boo#992120) - duplicates: boo#991877, boo#991193, boo#990392, boo#990428 and boo#990207 - drop openssl-fips_RSA_compute_d_with_lcm.patch (upstream) (boo#984323) - don
last seen	2020-06-05
modified	2018-02-16
plugin id	106863
published	2018-02-16
reporter	This script is Copyright (C) 2018-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/106863
title	openSUSE Security Update : openssl-steam (openSUSE-2018-168)

NASL family	OracleVM Local Security Checks
NASL id	ORACLEVM_OVMSA-2016-0135.NASL
description	The remote OracleVM system is missing necessary patches to address critical security updates : - fix CVE-2016-2177 - possible integer overflow - fix CVE-2016-2178 - non-constant time DSA operations - fix CVE-2016-2179 - further DoS issues in DTLS - fix CVE-2016-2180 - OOB read in TS_OBJ_print_bio - fix CVE-2016-2181 - DTLS1 replay protection and unprocessed records issue - fix CVE-2016-2182 - possible buffer overflow in BN_bn2dec - fix CVE-2016-6302 - insufficient TLS session ticket HMAC length check - fix CVE-2016-6304 - unbound memory growth with OCSP status request - fix CVE-2016-6306 - certificate message OOB reads - mitigate CVE-2016-2183 - degrade all 64bit block ciphers and RC4 to 112 bit effective strength - replace expired testing certificates - fix CVE-2016-2105 - possible overflow in base64 encoding - fix CVE-2016-2106 - possible overflow in EVP_EncryptUpdate - fix CVE-2016-2107 - padding oracle in stitched AES-NI CBC-MAC - fix CVE-2016-2108 - memory corruption in ASN.1 encoder - fix CVE-2016-2109 - possible DoS when reading ASN.1 data from BIO - fix CVE-2016-0799 - memory issues in BIO_printf
last seen	2020-06-01
modified	2020-06-02
plugin id	93761
published	2016-09-28
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93761
title	OracleVM 3.3 / 3.4 : openssl (OVMSA-2016-0135)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2016-1940.NASL
description	An update for openssl is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es) : * A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-6304) * It was discovered that OpenSSL did not always use constant time operations when computing Digital Signature Algorithm (DSA) signatures. A local attacker could possibly use this flaw to obtain a private DSA key belonging to another user or service running on the same system. (CVE-2016-2178) * It was discovered that the Datagram TLS (DTLS) implementation could fail to release memory in certain cases. A malicious DTLS client could cause a DTLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory. (CVE-2016-2179) * A flaw was found in the Datagram TLS (DTLS) replay protection implementation in OpenSSL. A remote attacker could possibly use this flaw to make a DTLS server using OpenSSL to reject further packets sent from a DTLS client over an established DTLS connection. (CVE-2016-2181) * An out of bounds write flaw was discovered in the OpenSSL BN_bn2dec() function. An attacker able to make an application using OpenSSL to process a large BIGNUM could cause the application to crash or, possibly, execute arbitrary code. (CVE-2016-2182) * A flaw was found in the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/ SSL server and client if the communication used a DES/3DES based ciphersuite. (CVE-2016-2183) This update mitigates the CVE-2016-2183 issue by lowering priority of DES cipher suites so they are not preferred over cipher suites using AES. For compatibility reasons, DES cipher suites remain enabled by default and included in the set of cipher suites identified by the HIGH cipher string. Future updates may move them to MEDIUM or not enable them by default. * An integer underflow flaw leading to a buffer over-read was found in the way OpenSSL parsed TLS session tickets. A remote attacker could use this flaw to crash a TLS server using OpenSSL if it used SHA-512 as HMAC for session tickets. (CVE-2016-6302) * Multiple integer overflow flaws were found in the way OpenSSL performed pointer arithmetic. A remote attacker could possibly use these flaws to cause a TLS/SSL server or client using OpenSSL to crash. (CVE-2016-2177) * An out of bounds read flaw was found in the way OpenSSL formatted Public Key Infrastructure Time-Stamp Protocol data for printing. An attacker could possibly cause an application using OpenSSL to crash if it printed time stamp data from the attacker. (CVE-2016-2180) * Multiple out of bounds read flaws were found in the way OpenSSL handled certain TLS/SSL protocol handshake messages. A remote attacker could possibly use these flaws to crash a TLS/SSL server or client using OpenSSL. (CVE-2016-6306) Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6304 and CVE-2016-6306 and OpenVPN for reporting CVE-2016-2183. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter of CVE-2016-6304 and CVE-2016-6306; and Karthikeyan Bhargavan (Inria) and Gaetan Leurent (Inria) as the original reporters of CVE-2016-2183.
last seen	2020-06-01
modified	2020-06-02
plugin id	93763
published	2016-09-28
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93763
title	RHEL 6 / 7 : openssl (RHSA-2016:1940)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2017-1413.NASL
description	An update is now available for Red Hat JBoss Core Services on RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience. This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.23, and includes bug fixes, which are documented in the Release Notes document linked to in the References. Security Fix(es) : * A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-6304) * It was discovered that the mod_session_crypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user
last seen	2020-06-01
modified	2020-06-02
plugin id	117315
published	2018-09-06
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/117315
title	RHEL 7 : JBoss Core Services (RHSA-2017:1413)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-3673.NASL
description	Several vulnerabilities were discovered in OpenSSL : - CVE-2016-2177 Guido Vranken discovered that OpenSSL uses undefined pointer arithmetic. Additional information can be found at https://www.openssl.org/blog/blog/2016/06/27/undefined-p ointer-arithmetic/ - CVE-2016-2178 Cesar Pereida, Billy Brumley and Yuval Yarom discovered a timing leak in the DSA code. - CVE-2016-2179 / CVE-2016-2181 Quan Luo and the OCAP audit team discovered denial of service vulnerabilities in DTLS. - CVE-2016-2180 / CVE-2016-2182 / CVE-2016-6303 Shi Lei discovered an out-of-bounds memory read in TS_OBJ_print_bio() and an out-of-bounds write in BN_bn2dec() and MDC2_Update(). - CVE-2016-2183 DES-based cipher suites are demoted from the HIGH group to MEDIUM as a mitigation for the SWEET32 attack. - CVE-2016-6302 Shi Lei discovered that the use of SHA512 in TLS session tickets is susceptible to denial of service. - CVE-2016-6304 Shi Lei discovered that excessively large OCSP status request may result in denial of service via memory exhaustion. - CVE-2016-6306 Shi Lei discovered that missing message length validation when parsing certificates may potentially result in denial of service.
last seen	2020-06-01
modified	2020-06-02
plugin id	93668
published	2016-09-23
reporter	This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93668
title	Debian DSA-3673-1 : openssl - security update

NASL family	Web Servers
NASL id	OPENSSL_1_1_0A.NASL
description	According to its banner, the remote host is running a version of OpenSSL 1.1.0 prior to 1.1.0a. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the ssl_parse_clienthello_tlsext() function in t1_lib.c due to improper handling of overly large OCSP Status Request extensions from clients. An unauthenticated, remote attacker can exploit this, via large OCSP Status Request extensions, to exhaust memory resources, resulting in a denial of service condition. (CVE-2016-6304) - A flaw exists in the SSL_peek() function in rec_layer_s3.c due to improper handling of empty records. An unauthenticated, remote attacker can exploit this, by triggering a zero-length record in an SSL_peek call, to cause an infinite loop, resulting in a denial of service condition. (CVE-2016-6305) - A denial of service vulnerability exists in the state-machine implementation due to a failure to check for an excessive length before allocating memory. An unauthenticated, remote attacker can exploit this, via a crafted TLS message, to exhaust memory resources. (CVE-2016-6307) - A denial of service vulnerability exists in the DTLS implementation due to improper handling of excessively long DTLS messages. An unauthenticated, remote attacker can exploit this, via a crafted DTLS message, to exhaust available memory resources. (CVE-2016-6308) - A flaw exists in the GOST ciphersuites due to the use of long-term keys to establish an encrypted connection. A man-in-the-middle attacker can exploit this, via a Key Compromise Impersonation (KCI) attack, to impersonate the server.
last seen	2020-06-01
modified	2020-06-02
plugin id	93816
published	2016-09-30
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93816
title	OpenSSL 1.1.0 < 1.1.0a Multiple Vulnerabilities

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2016-1940.NASL
description	An update for openssl is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es) : * A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-6304) * It was discovered that OpenSSL did not always use constant time operations when computing Digital Signature Algorithm (DSA) signatures. A local attacker could possibly use this flaw to obtain a private DSA key belonging to another user or service running on the same system. (CVE-2016-2178) * It was discovered that the Datagram TLS (DTLS) implementation could fail to release memory in certain cases. A malicious DTLS client could cause a DTLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory. (CVE-2016-2179) * A flaw was found in the Datagram TLS (DTLS) replay protection implementation in OpenSSL. A remote attacker could possibly use this flaw to make a DTLS server using OpenSSL to reject further packets sent from a DTLS client over an established DTLS connection. (CVE-2016-2181) * An out of bounds write flaw was discovered in the OpenSSL BN_bn2dec() function. An attacker able to make an application using OpenSSL to process a large BIGNUM could cause the application to crash or, possibly, execute arbitrary code. (CVE-2016-2182) * A flaw was found in the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/ SSL server and client if the communication used a DES/3DES based ciphersuite. (CVE-2016-2183) This update mitigates the CVE-2016-2183 issue by lowering priority of DES cipher suites so they are not preferred over cipher suites using AES. For compatibility reasons, DES cipher suites remain enabled by default and included in the set of cipher suites identified by the HIGH cipher string. Future updates may move them to MEDIUM or not enable them by default. * An integer underflow flaw leading to a buffer over-read was found in the way OpenSSL parsed TLS session tickets. A remote attacker could use this flaw to crash a TLS server using OpenSSL if it used SHA-512 as HMAC for session tickets. (CVE-2016-6302) * Multiple integer overflow flaws were found in the way OpenSSL performed pointer arithmetic. A remote attacker could possibly use these flaws to cause a TLS/SSL server or client using OpenSSL to crash. (CVE-2016-2177) * An out of bounds read flaw was found in the way OpenSSL formatted Public Key Infrastructure Time-Stamp Protocol data for printing. An attacker could possibly cause an application using OpenSSL to crash if it printed time stamp data from the attacker. (CVE-2016-2180) * Multiple out of bounds read flaws were found in the way OpenSSL handled certain TLS/SSL protocol handshake messages. A remote attacker could possibly use these flaws to crash a TLS/SSL server or client using OpenSSL. (CVE-2016-6306) Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6304 and CVE-2016-6306 and OpenVPN for reporting CVE-2016-2183. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter of CVE-2016-6304 and CVE-2016-6306; and Karthikeyan Bhargavan (Inria) and Gaetan Leurent (Inria) as the original reporters of CVE-2016-2183.
last seen	2020-06-01
modified	2020-06-02
plugin id	93777
published	2016-09-28
reporter	This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93777
title	CentOS 6 / 7 : openssl (CESA-2016:1940)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2017-1801.NASL
description	An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 6 and Red Hat JBoss Web Server 3.1 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library. This release of Red Hat JBoss Web Server 3.1 Service Pack 1 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References. Security Fix(es) : * It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application. (CVE-2017-5645) * A vulnerability was discovered in tomcat
last seen	2020-05-09
modified	2018-08-29
plugin id	112177
published	2018-08-29
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/112177
title	RHEL 6 / 7 : Red Hat JBoss Web Server 3.1.0 Service Pack 1 (RHSA-2017:1801)

NASL family	Misc.
NASL id	ORACLE_ENTERPRISE_MANAGER_APR_2017_CPU.NASL
description	The version of Oracle Enterprise Manager Grid Control installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities : - Multiple integer overflow conditions exist in the OpenSSL component in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-2177) - An information disclosure vulnerability exists in the OpenSSL component in dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the OpenSSL component in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the OpenSSL component in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	99594
published	2017-04-21
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/99594
title	Oracle Enterprise Manager Grid Control Multiple Vulnerabilities (April 2017 CPU) (SWEET32)

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20160927_OPENSSL_ON_SL6_X.NASL
description	Security Fix(es) : - A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-6304) - It was discovered that OpenSSL did not always use constant time operations when computing Digital Signature Algorithm (DSA) signatures. A local attacker could possibly use this flaw to obtain a private DSA key belonging to another user or service running on the same system. (CVE-2016-2178) - It was discovered that the Datagram TLS (DTLS) implementation could fail to release memory in certain cases. A malicious DTLS client could cause a DTLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory. (CVE-2016-2179) - A flaw was found in the Datagram TLS (DTLS) replay protection implementation in OpenSSL. A remote attacker could possibly use this flaw to make a DTLS server using OpenSSL to reject further packets sent from a DTLS client over an established DTLS connection. (CVE-2016-2181) - An out of bounds write flaw was discovered in the OpenSSL BN_bn2dec() function. An attacker able to make an application using OpenSSL to process a large BIGNUM could cause the application to crash or, possibly, execute arbitrary code. (CVE-2016-2182) - A flaw was found in the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based ciphersuite. (CVE-2016-2183) This update mitigates the CVE-2016-2183 issue by lowering priority of DES cipher suites so they are not preferred over cipher suites using AES. For compatibility reasons, DES cipher suites remain enabled by default and included in the set of cipher suites identified by the HIGH cipher string. Future updates may move them to MEDIUM or not enable them by default. - An integer underflow flaw leading to a buffer over-read was found in the way OpenSSL parsed TLS session tickets. A remote attacker could use this flaw to crash a TLS server using OpenSSL if it used SHA-512 as HMAC for session tickets. (CVE-2016-6302) - Multiple integer overflow flaws were found in the way OpenSSL performed pointer arithmetic. A remote attacker could possibly use these flaws to cause a TLS/SSL server or client using OpenSSL to crash. (CVE-2016-2177) - An out of bounds read flaw was found in the way OpenSSL formatted Public Key Infrastructure Time-Stamp Protocol data for printing. An attacker could possibly cause an application using OpenSSL to crash if it printed time stamp data from the attacker. (CVE-2016-2180) - Multiple out of bounds read flaws were found in the way OpenSSL handled certain TLS/SSL protocol handshake messages. A remote attacker could possibly use these flaws to crash a TLS/SSL server or client using OpenSSL. (CVE-2016-6306)
last seen	2020-03-18
modified	2016-09-29
plugin id	93795
published	2016-09-29
reporter	This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93795
title	Scientific Linux Security Update : openssl on SL6.x, SL7.x i386/x86_64 (20160927)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2017-1658.NASL
description	An update is now available for Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 6 and Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release includes bug fixes as well as a new release of OpenSSL. For further information, see the knowledge base article linked to in the References section. All users of Red Hat JBoss Enterprise Application Platform 6.4 on Red Hat Enterprise Linux 7 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect. Security Fix(es) : * A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-6304) * It was discovered that OpenSSL did not always use constant time operations when computing Digital Signature Algorithm (DSA) signatures. A local attacker could possibly use this flaw to obtain a private DSA key belonging to another user or service running on the same system. (CVE-2016-2178) * A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610) * Multiple integer overflow flaws were found in the way OpenSSL performed pointer arithmetic. A remote attacker could possibly use these flaws to cause a TLS/SSL server or client using OpenSSL to crash. (CVE-2016-2177) Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6304 and Shi Lei (Gear Team of Qihoo 360 Inc.) for reporting CVE-2016-8610. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter of CVE-2016-6304.
last seen	2020-06-01
modified	2020-06-02
plugin id	101141
published	2017-06-30
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/101141
title	RHEL 6 / 7 : JBoss EAP (RHSA-2017:1658)

NASL family	CGI abuses
NASL id	ORACLE_ILOM_3_2_6.NASL
description	According to its self-reported version number, the version of Oracle Integrated Lights Out Manager (ILOM) is affected by multiple vulnerabilities as described in the advisory.
last seen	2020-06-01
modified	2020-06-02
plugin id	104047
published	2017-10-20
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/104047
title	Oracle Integrated Lights Out Manager (ILOM) < 3.2.6 Multiple Vulnerabilities (uncredentialed check)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2016-1134.NASL
description	This update for openssl fixes the following issues : OpenSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High - OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low - Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575) - Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) - DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) - OOB read in TS_OBJ_print_bio() (CVE-2016-2180) (bsc#990419) - DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) - OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) - Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) - Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) - OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) - Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Also following bugs were fixed : - update expired S/MIME certs (bsc#979475) - improve s390x performance (bsc#982745) - allow >= 64GB AESGCM transfers (bsc#988591) - fix crash in print_notice (bsc#998190) - resume reading from /dev/urandom when interrupted by a signal (bsc#995075) This update was imported from the SUSE:SLE-12-SP1:Update update project.
last seen	2020-06-05
modified	2016-09-28
plugin id	93783
published	2016-09-28
reporter	This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/93783
title	openSUSE Security Update : openssl (openSUSE-2016-1134)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2016-2802.NASL
description	An update for openssl is now available for Red Hat Enterprise Linux 6.2 Advanced Update Support, Red Hat Enterprise Linux 6.4 Advanced Update Support, Red Hat Enterprise Linux 6.5 Advanced Update Support, Red Hat Enterprise Linux 6.5 Telco Extended Update Support, Red Hat Enterprise Linux 6.6 Advanced Update Support, Red Hat Enterprise Linux 6.6 Telco Extended Update Support, and Red Hat Enterprise Linux 6.7 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es) : * A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-6304) Red Hat would like to thank the OpenSSL project for reporting this issue. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter.
last seen	2020-06-01
modified	2020-06-02
plugin id	94937
published	2016-11-17
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/94937
title	RHEL 6 : openssl (RHSA-2016:2802)

NASL family	Databases
NASL id	MYSQL_5_7_16_RPM.NASL
description	The version of MySQL running on the remote host is 5.7.x prior to 5.7.16. It is, therefore, affected by multiple vulnerabilities : - Multiple integer overflow conditions exist in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-04
modified	2016-10-21
plugin id	94198
published	2016-10-21
reporter	This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/94198
title	MySQL 5.7.x < 5.7.16 Multiple Vulnerabilities (October 2016 CPU) (SWEET32)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DLA-637.NASL
description	Several vulnerabilities were discovered in OpenSSL : CVE-2016-2177 Guido Vranken discovered that OpenSSL uses undefined pointer arithmetic. Additional information can be found at https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithme tic/ CVE-2016-2178 Cesar Pereida, Billy Brumley and Yuval Yarom discovered a timing leak in the DSA code. CVE-2016-2179 / CVE-2016-2181 Quan Luo and the OCAP audit team discovered denial of service vulnerabilities in DTLS. CVE-2016-2180 / CVE-2016-2182 / CVE-2016-6303 Shi Lei discovered an out-of-bounds memory read in TS_OBJ_print_bio() and an out-of-bounds write in BN_bn2dec() and MDC2_Update(). CVE-2016-2183 DES-based cipher suites are demoted from the HIGH group to MEDIUM as a mitigation for the SWEET32 attack. CVE-2016-6302 Shi Lei discovered that the use of SHA512 in TLS session tickets is susceptible to denial of service. CVE-2016-6304 Shi Lei discovered that excessively large OCSP status request may result in denial of service via memory exhaustion. CVE-2016-6306 Shi Lei discovered that missing message length validation when parsing certificates may potentially result in denial of service. For Debian 7
last seen	2020-03-17
modified	2016-09-26
plugin id	93690
published	2016-09-26
reporter	This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/93690
title	Debian DLA-637-1 : openssl security update

NASL family	MacOS X Local Security Checks
NASL id	MACOS_10_12_2.NASL
description	The remote host is running a version of macOS that is 10.12.x prior to 10.12.2. It is, therefore, affected by multiple vulnerabilities in the following components : - apache_mod_php - AppleGraphicsPowerManagement - Assets - Audio - Bluetooth - CoreCapture - CoreFoundation - CoreGraphics - CoreMedia External Displays - CoreMedia Playback - CoreStorage - CoreText - curl - Directory Services - Disk Images - FontParser - Foundation - Grapher - ICU - ImageIO - Intel Graphics Driver - IOFireWireFamily - IOAcceleratorFamily - IOHIDFamily - IOKit - IOSurface - Kernel - kext tools - libarchive - LibreSSL - OpenLDAP - OpenPAM - OpenSSL - Power Management - Security - syslog - WiFi - xar Note that successful exploitation of the most serious issues can result in arbitrary code execution. Furthermore, CVE-2016-6304, CVE-2016-7596, and CVE-2016-7604 also affect Mac OS X versions 10.10.5 and 10.11.6. However, this plugin does not check those versions.
last seen	2020-06-01
modified	2020-06-02
plugin id	95917
published	2016-12-16
reporter	This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/95917
title	macOS 10.12.x < 10.12.2 Multiple Vulnerabilities

NASL family	Misc.
NASL id	VIRTUALBOX_5_1_8.NASL
description	The version of the Oracle VM VirtualBox application installed on the remote host is 5.0.x prior to 5.0.28 or 5.1.x prior to 5.1.8. It is, therefore, affected by multiple vulnerabilities : - Multiple unspecified flaws exist in the Core subcomponent that allow a local attacker to gain elevated privileges. (CVE-2016-5501, CVE-2016-5538) - An unspecified flaw exists in the VirtualBox Remote Desktop Extension (VRDE) subcomponent that allows an unauthenticated, remote attacker to impact confidentiality and integrity. (CVE-2016-5605) - Multiple unspecified flaws exist in the Core subcomponent that allow a local attacker to cause a denial of service condition. (CVE-2016-5608, CVE-2016-5613) - An unspecified flaw exists in the Core subcomponent that allows a local attacker to impact on integrity and availability. (CVE-2016-5610) - An unspecified flaw exists in the Core subcomponent that allows a local attacker to disclose sensitive information. (CVE-2016-5611) - A flaw exists in the OpenSSL subcomponent, specifically within the ssl_parse_clienthello_tlsext() function in t1_lib.c due, to improper handling of overly large OCSP Status Request extensions from clients. An unauthenticated, remote attacker can exploit this, via large OCSP Status Request extensions, to exhaust memory resources, resulting in a denial of service condition. (CVE-2016-6304)
last seen	2020-06-01
modified	2020-06-02
plugin id	94168
published	2016-10-20
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/94168
title	Oracle VM VirtualBox 5.0.x < 5.0.28 / 5.1.x < 5.1.8 Multiple Vulnerabilities (October 2016 CPU)

NASL family	Junos Local Security Checks
NASL id	JUNIPER_JSA10759.NASL
description	According to its self-reported version number, the remote Juniper Junos device is affected by the following vulnerabilities related to OpenSSL : - A flaw exists in the ssl3_get_key_exchange() function in file s3_clnt.c when handling a ServerKeyExchange message for an anonymous DH ciphersuite with the value of
last seen	2020-03-18
modified	2017-01-05
plugin id	96316
published	2017-01-05
reporter	This script is Copyright (C) 2017-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/96316
title	Juniper Junos Multiple OpenSSL Vulnerabilities (JSA10759) (SWEET32)

NASL family	Misc.
NASL id	ARISTA_EOS_SA0024_4_17.NASL
description	The version of Arista Networks EOS running on the remote device is affected by multiple vulnerabilities in the included OpenSSL library : - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A vulnerability exists, known as SWEET32, in the 3DES and Blowfish algorithms due to the use of weak 64-bit block ciphers by default. A man-in-the-middle attacker who has sufficient resources can exploit this vulnerability, via a
last seen	2020-03-17
modified	2018-02-28
plugin id	107067
published	2018-02-28
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/107067
title	Arista Networks EOS 4.17 Multiple Vulnerabilities (SA0024) (SWEET32)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2017-2493.NASL
description	An update is now available for Red Hat JBoss Enterprise Web Server 2.1.2 for Red Hat Enterprise Linux 6 and Red Hat JBoss Enterprise Web Server 2.1.2 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. This release provides an update to OpenSSL and Tomcat 6/7 for Red Hat JBoss Web Server 2.1.2. The updates are documented in the Release Notes document linked to in the References. Users of Red Hat JBoss Web Server 2.1.2 should upgrade to these updated packages, which resolve several security issues. Security Fix(es) : * A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-6304) * A vulnerability was discovered in tomcat
last seen	2020-06-01
modified	2020-06-02
plugin id	102692
published	2017-08-23
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/102692
title	RHEL 6 / 7 : JBoss Web Server (RHSA-2017:2493)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2016-1940.NASL
description	From Red Hat Security Advisory 2016:1940 : An update for openssl is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es) : * A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-6304) * It was discovered that OpenSSL did not always use constant time operations when computing Digital Signature Algorithm (DSA) signatures. A local attacker could possibly use this flaw to obtain a private DSA key belonging to another user or service running on the same system. (CVE-2016-2178) * It was discovered that the Datagram TLS (DTLS) implementation could fail to release memory in certain cases. A malicious DTLS client could cause a DTLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory. (CVE-2016-2179) * A flaw was found in the Datagram TLS (DTLS) replay protection implementation in OpenSSL. A remote attacker could possibly use this flaw to make a DTLS server using OpenSSL to reject further packets sent from a DTLS client over an established DTLS connection. (CVE-2016-2181) * An out of bounds write flaw was discovered in the OpenSSL BN_bn2dec() function. An attacker able to make an application using OpenSSL to process a large BIGNUM could cause the application to crash or, possibly, execute arbitrary code. (CVE-2016-2182) * A flaw was found in the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/ SSL server and client if the communication used a DES/3DES based ciphersuite. (CVE-2016-2183) This update mitigates the CVE-2016-2183 issue by lowering priority of DES cipher suites so they are not preferred over cipher suites using AES. For compatibility reasons, DES cipher suites remain enabled by default and included in the set of cipher suites identified by the HIGH cipher string. Future updates may move them to MEDIUM or not enable them by default. * An integer underflow flaw leading to a buffer over-read was found in the way OpenSSL parsed TLS session tickets. A remote attacker could use this flaw to crash a TLS server using OpenSSL if it used SHA-512 as HMAC for session tickets. (CVE-2016-6302) * Multiple integer overflow flaws were found in the way OpenSSL performed pointer arithmetic. A remote attacker could possibly use these flaws to cause a TLS/SSL server or client using OpenSSL to crash. (CVE-2016-2177) * An out of bounds read flaw was found in the way OpenSSL formatted Public Key Infrastructure Time-Stamp Protocol data for printing. An attacker could possibly cause an application using OpenSSL to crash if it printed time stamp data from the attacker. (CVE-2016-2180) * Multiple out of bounds read flaws were found in the way OpenSSL handled certain TLS/SSL protocol handshake messages. A remote attacker could possibly use these flaws to crash a TLS/SSL server or client using OpenSSL. (CVE-2016-6306) Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6304 and CVE-2016-6306 and OpenVPN for reporting CVE-2016-2183. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter of CVE-2016-6304 and CVE-2016-6306; and Karthikeyan Bhargavan (Inria) and Gaetan Leurent (Inria) as the original reporters of CVE-2016-2183.
last seen	2020-06-01
modified	2020-06-02
plugin id	93759
published	2016-09-28
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93759
title	Oracle Linux 6 / 7 : openssl (ELSA-2016-1940)

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-3087-2.NASL
description	USN-3087-1 fixed vulnerabilities in OpenSSL. The fix for CVE-2016-2182 was incomplete and caused a regression when parsing certificates. This update fixes the problem. We apologize for the inconvenience. Shi Lei discovered that OpenSSL incorrectly handled the OCSP Status Request extension. A remote attacker could possibly use this issue to cause memory consumption, resulting in a denial of service. (CVE-2016-6304) Guido Vranken discovered that OpenSSL used undefined behaviour when performing pointer arithmetic. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue has only been addressed in Ubuntu 16.04 LTS in this update. (CVE-2016-2177) Cesar Pereida, Billy Brumley, and Yuval Yarom discovered that OpenSSL did not properly use constant-time operations when performing DSA signing. A remote attacker could possibly use this issue to perform a cache-timing attack and recover private DSA keys. (CVE-2016-2178) Quan Luo discovered that OpenSSL did not properly restrict the lifetime of queue entries in the DTLS implementation. A remote attacker could possibly use this issue to consume memory, resulting in a denial of service. (CVE-2016-2179) Shi Lei discovered that OpenSSL incorrectly handled memory in the TS_OBJ_print_bio() function. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-2180) It was discovered that the OpenSSL incorrectly handled the DTLS anti-replay feature. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-2181) Shi Lei discovered that OpenSSL incorrectly validated division results. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-2182) Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions. This update moves DES from the HIGH cipher list to MEDIUM. (CVE-2016-2183) Shi Lei discovered that OpenSSL incorrectly handled certain ticket lengths. A remote attacker could use this issue to cause a denial of service. (CVE-2016-6302) Shi Lei discovered that OpenSSL incorrectly handled memory in the MDC2_Update() function. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-6303) Shi Lei discovered that OpenSSL incorrectly performed certain message length checks. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-6306). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	93715
published	2016-09-26
reporter	Ubuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93715
title	Ubuntu 12.04 LTS / 14.04 LTS / 16.04 LTS : openssl regression (USN-3087-2)

NASL family	Misc.
NASL id	PVS_5_2_0.NASL
description	The version of Tenable Passive Vulnerability Scanner (PVS) installed on the remote host is 5.x < 5.2.0. It is, therefore, affected by multiple vulnerabilities : - Multiple denial of service vulnerabilities exist in Expat within file xmlparse.c due to a logical error in hash computations. An unauthenticated, remote attacker can exploit these, via a specially crafted XML file containing many identifiers with the same value, to cause the service to exhaust CPU resources. (CVE-2012-0876, CVE-2016-5300) - A flaw exists in the generate_hash_secret_salt() function in file lib/xmlparse.c within Expat due to the generation of non-random output by the PRNG. An unauthenticated, remote attacker can exploit this to more easily predict the PRNG output. (CVE-2012-6702) - Multiple buffer overflow conditions exist within Expat, specifically in the XML_GetBuffer() function in file lib/xmlparse.c, due to improper validation of user-supplied input when handling compressed XML content. An unauthenticated, remote attacker can exploit these to execute arbitrary code. (CVE-2015-1283, CVE-2016-4472) - Multiple buffer overflow conditions exist within the Expat XML parser when handling malformed input documents due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-0718, CVE-2016-0719) - Multiple integer overflow conditions exist in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit these to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	96337
published	2017-01-06
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/96337
title	Tenable Passive Vulnerability Scanner 5.x < 5.2.0 Multiple Vulnerabilities (SWEET32)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2016-64E0743E16.NASL
description	Update from upstream with multiple security issues fixed. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2016-11-15
plugin id	94811
published	2016-11-15
reporter	This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/94811
title	Fedora 25 : 1:openssl (2016-64e0743e16)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2016-1047.NASL
description	According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.(CVE-2016-2177) - The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.(CVE-2016-2178) - The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c.(CVE-2016-2179) - The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted time-stamp file that is mishandled by the
last seen	2020-05-06
modified	2017-05-01
plugin id	99810
published	2017-05-01
reporter	This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/99810
title	EulerOS 2.0 SP1 : openssl (EulerOS-SA-2016-1047)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2016-2470-1.NASL
description	This update brings the new upstream nodejs LTS version 4.6.0, fixing bugs and security issues : - Nodejs embedded openssl version update + upgrade to 1.0.2j (CVE-2016-6304, CVE-2016-2183, CVE-2016-2178, CVE-2016-6306, CVE-2016-7052) + remove support for dynamic 3rd party engine modules - http: Properly validate for allowable characters in input user data. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here. (CVE-2016-5325, bsc#985201) - tls: properly validate wildcard certificates (CVE-2016-7099, bsc#1001652) - buffer: Zero-fill excess bytes in new Buffer objects created with Buffer.concat() Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-24
modified	2019-01-02
plugin id	119982
published	2019-01-02
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/119982
title	SUSE SLES12 Security Update : nodejs4 (SUSE-SU-2016:2470-1)

NASL family	Misc.
NASL id	SECURITYCENTER_OPENSSL_1_0_1U.NASL
description	The Tenable SecurityCenter application installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities in the bundled version of OpenSSL : - Multiple integer overflow conditions exist in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	101045
published	2017-06-26
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/101045
title	Tenable SecurityCenter OpenSSL 1.0.1 < 1.0.1u Multiple Vulnerabilities (SWEET32)

NASL family	Databases
NASL id	MYSQL_5_6_34_RPM.NASL
description	The version of MySQL running on the remote host is 5.6.x prior to 5.6.34. It is, therefore, affected by multiple vulnerabilities : - Multiple integer overflow conditions exist in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-04
modified	2016-10-21
plugin id	94197
published	2016-10-21
reporter	This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/94197
title	MySQL 5.6.x < 5.6.34 Multiple Vulnerabilities (October 2016 CPU) (SWEET32)

NASL family	CGI abuses : XSS
NASL id	NESSUS_TNS_2016_16.NASL
description	According to its self-reported version number, the Tenable Nessus application running on the remote host is 6.x prior to 6.9. It is, therefore, affected by multiple vulnerabilities : - Multiple integer overflow conditions exist in the OpenSSL component in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the OpenSSL component in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the OpenSSL component in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the OpenSSL component in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	97192
published	2017-02-15
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/97192
title	Tenable Nessus 6.x < 6.9 Multiple Vulnerabilities (TNS-2016-16) (SWEET32)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2016-1172.NASL
description	This update brings the new upstream nodejs LTS version 4.6.0, fixing bugs and security issues : - Nodejs embedded openssl version update + upgrade to 1.0.2j (CVE-2016-6304, CVE-2016-2183, CVE-2016-2178, CVE-2016-6306, CVE-2016-7052) + remove support for dynamic 3rd party engine modules - http: Properly validate for allowable characters in input user data. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here. (CVE-2016-5325, bsc#985201) - tls: properly validate wildcard certificates (CVE-2016-7099, bsc#1001652) - buffer: Zero-fill excess bytes in new Buffer objects created with Buffer.concat()
last seen	2020-06-05
modified	2016-10-12
plugin id	94002
published	2016-10-12
reporter	This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/94002
title	openSUSE Security Update : nodejs (openSUSE-2016-1172)

NASL family	Databases
NASL id	MYSQL_5_7_16.NASL
description	The version of MySQL running on the remote host is 5.7.x prior to 5.7.16. It is, therefore, affected by multiple vulnerabilities : - Multiple integer overflow conditions exist in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	94167
published	2016-10-20
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/94167
title	MySQL 5.7.x < 5.7.16 Multiple Vulnerabilities (October 2016 CPU) (SWEET32)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2016-1189.NASL
description	This update for compat-openssl098 fixes the following issues : OpenSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High - OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low - Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575) - Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) - DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) - DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) - OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) - Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) - Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) - OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) - Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Bugs fixed : - update expired S/MIME certs (bsc#979475) - fix crash in print_notice (bsc#998190) - resume reading from /dev/urandom when interrupted by a signal (bsc#995075) This update was imported from the SUSE:SLE-12:Update update project.
last seen	2020-06-05
modified	2016-10-17
plugin id	94086
published	2016-10-17
reporter	This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/94086
title	openSUSE Security Update : compat-openssl098 (openSUSE-2016-1189)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2016-2394-1.NASL
description	This update for openssl fixes the following issues: OpenSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High - OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low - Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575) - Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) - DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) - OOB read in TS_OBJ_print_bio() (CVE-2016-2180) (bsc#990419) - DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) - OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) - Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) - Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) - OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) - Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Also following bugs were fixed : - update expired S/MIME certs (bsc#979475) - improve s390x performance (bsc#982745) - allow >= 64GB AESGCM transfers (bsc#988591) - fix crash in print_notice (bsc#998190) - resume reading from /dev/urandom when interrupted by a signal (bsc#995075) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	93765
published	2016-09-28
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93765
title	SUSE SLED12 / SLES12 Security Update : openssl (SUSE-SU-2016:2394-1)

NASL family	AIX Local Security Checks
NASL id	AIX_OPENSSL_ADVISORY21.NASL
description	The version of OpenSSL installed on the remote AIX host is affected by the following vulnerabilities : - Multiple integer overflow conditions exist in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	95255
published	2016-11-22
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/95255
title	AIX OpenSSL Advisory : openssl_advisory21.asc (SWEET32)

NASL family	Slackware Local Security Checks
NASL id	SLACKWARE_SSA_2016-266-01.NASL
description	New openssl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	93663
published	2016-09-23
reporter	This script is Copyright (C) 2016-2017 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/93663
title	Slackware 14.0 / 14.1 / 14.2 / current : openssl (SSA:2016-266-01)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2016-1283.NASL
description	mysql-community-server was updated to 5.6.34 to fix the following issues : - Changes http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6- 34.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6- 33.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6- 32.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6- 31.html - fixed CVEs: CVE-2016-6304, CVE-2016-6662, CVE-2016-7440, CVE-2016-5584, CVE-2016-5617, CVE-2016-5616, CVE-2016-5626, CVE-2016-3492, CVE-2016-5629, CVE-2016-5507, CVE-2016-8283, CVE-2016-5609, CVE-2016-5612, CVE-2016-5627, CVE-2016-5630, CVE-2016-8284, CVE-2016-8288, CVE-2016-3477, CVE-2016-2105, CVE-2016-3486, CVE-2016-3501, CVE-2016-3521, CVE-2016-3615, CVE-2016-3614, CVE-2016-3459, CVE-2016-5439, CVE-2016-5440 - fixes SUSE Bugs: [boo#999666], [boo#998309], [boo#1005581], [boo#1005558], [boo#1005563], [boo#1005562], [boo#1005566], [boo#1005555], [boo#1005569], [boo#1005557], [boo#1005582], [boo#1005560], [boo#1005561], [boo#1005567], [boo#1005570], [boo#1005583], [boo#1005586], [boo#989913], [boo#977614], [boo#989914], [boo#989915], [boo#989919], [boo#989922], [boo#989921], [boo#989911], [boo#989925], [boo#989926] - append
last seen	2020-06-05
modified	2016-11-11
plugin id	94694
published	2016-11-11
reporter	This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/94694
title	openSUSE Security Update : mysql-community-server (openSUSE-2016-1283)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2016-2387-1.NASL
description	This update for openssl fixes the following issues: OpenSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High - OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low - Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575) - Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) - DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) - OOB read in TS_OBJ_print_bio() (CVE-2016-2180) (bsc#990419) - DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) - OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) - Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) - Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) - OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) - Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Also following bugs were fixed : - update expired S/MIME certs (bsc#979475) - improve s390x performance (bsc#982745) - allow >= 64GB AESGCM transfers (bsc#988591) - fix crash in print_notice (bsc#998190) - resume reading from /dev/urandom when interrupted by a signal (bsc#995075) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	93734
published	2016-09-27
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93734
title	SUSE SLES12 Security Update : openssl (SUSE-SU-2016:2387-1)

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-3087-1.NASL
description	Shi Lei discovered that OpenSSL incorrectly handled the OCSP Status Request extension. A remote attacker could possibly use this issue to cause memory consumption, resulting in a denial of service. (CVE-2016-6304) Guido Vranken discovered that OpenSSL used undefined behaviour when performing pointer arithmetic. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue has only been addressed in Ubuntu 16.04 LTS in this update. (CVE-2016-2177) Cesar Pereida, Billy Brumley, and Yuval Yarom discovered that OpenSSL did not properly use constant-time operations when performing DSA signing. A remote attacker could possibly use this issue to perform a cache-timing attack and recover private DSA keys. (CVE-2016-2178) Quan Luo discovered that OpenSSL did not properly restrict the lifetime of queue entries in the DTLS implementation. A remote attacker could possibly use this issue to consume memory, resulting in a denial of service. (CVE-2016-2179) Shi Lei discovered that OpenSSL incorrectly handled memory in the TS_OBJ_print_bio() function. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-2180) It was discovered that the OpenSSL incorrectly handled the DTLS anti-replay feature. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-2181) Shi Lei discovered that OpenSSL incorrectly validated division results. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-2182) Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions. This update moves DES from the HIGH cipher list to MEDIUM. (CVE-2016-2183) Shi Lei discovered that OpenSSL incorrectly handled certain ticket lengths. A remote attacker could use this issue to cause a denial of service. (CVE-2016-6302) Shi Lei discovered that OpenSSL incorrectly handled memory in the MDC2_Update() function. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-6303) Shi Lei discovered that OpenSSL incorrectly performed certain message length checks. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-6306). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	93684
published	2016-09-23
reporter	Ubuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93684
title	Ubuntu 12.04 LTS / 14.04 LTS / 16.04 LTS : openssl vulnerabilities (USN-3087-1)

NASL family	Databases
NASL id	MYSQL_5_6_34.NASL
description	The version of MySQL running on the remote host is 5.6.x prior to 5.6.34. It is, therefore, affected by multiple vulnerabilities : - Multiple integer overflow conditions exist in s3_srvr.c, ssl_sess.c, and t1_lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2016-2177) - An information disclosure vulnerability exists in the dsa_sign_setup() function in dsa_ossl.c due to a failure to properly ensure the use of constant-time operations. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose DSA key information. (CVE-2016-2178) - A denial of service vulnerability exists in the DTLS implementation due to a failure to properly restrict the lifetime of queue entries associated with unused out-of-order messages. An unauthenticated, remote attacker can exploit this, by maintaining multiple crafted DTLS sessions simultaneously, to exhaust memory. (CVE-2016-2179) - An out-of-bounds read error exists in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. An unauthenticated, remote attacker can exploit this, via a crafted time-stamp file that is mishandled by the
last seen	2020-06-01
modified	2020-06-02
plugin id	94166
published	2016-10-20
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/94166
title	MySQL 5.6.x < 5.6.34 Multiple Vulnerabilities (October 2016 CPU) (SWEET32)

NASL family	Gentoo Local Security Checks
NASL id	GENTOO_GLSA-201612-16.NASL
description	The remote host is affected by the vulnerability described in GLSA-201612-16 (OpenSSL: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in OpenSSL. Please review the CVE identifiers and the International Association for Cryptologic Research’s (IACR) paper, “Make Sure DSA Signing Exponentiations Really are Constant-Time” for further details. Impact : Remote attackers could cause a Denial of Service condition or have other unspecified impacts. Additionally, a time based side-channel attack may allow a local attacker to recover a private DSA key. Workaround : There is no known workaround at this time.
last seen	2020-06-01
modified	2020-06-02
plugin id	95602
published	2016-12-07
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/95602
title	GLSA-201612-16 : OpenSSL: Multiple vulnerabilities

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2017-1414.NASL
description	An update is now available for Red Hat JBoss Core Services on RHEL 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience. This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.23, and includes bug fixes, which are documented in the Release Notes document linked to in the References. Security Fix(es) : * A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-6304) * It was discovered that the mod_session_crypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user
last seen	2020-06-01
modified	2020-06-02
plugin id	117316
published	2018-09-06
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/117316
title	RHEL 6 : JBoss Core Services (RHSA-2017:1414)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2016-2468-1.NASL
description	This update for compat-openssl098 fixes the following issues: OpenSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High - OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low - Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575) - Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) - DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) - DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) - OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) - Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) - Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) - OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) - Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Bugs fixed : - update expired S/MIME certs (bsc#979475) - fix crash in print_notice (bsc#998190) - resume reading from /dev/urandom when interrupted by a signal (bsc#995075) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	93909
published	2016-10-07
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93909
title	SUSE SLED12 / SLES12 Security Update : compat-openssl098 (SUSE-SU-2016:2468-1)

Packetstorm

data source	https://packetstormsecurity.com/files/download/143369/orionbrowser79-mitm.txt
id	PACKETSTORM:143369
last seen	2017-07-15
published	2017-07-14
reporter	MaXe
source	https://packetstormsecurity.com/files/143369/Orion-Elite-Hidden-IP-Browser-Pro-7.9-OpenSSL-Tor-Man-In-The-Middle.html
title	Orion Elite Hidden IP Browser Pro 7.9 OpenSSL / Tor / Man-In-The-Middle

Redhat

advisories

rhsa
id RHSA-2016:1940
rhsa
id RHSA-2016:2802
rhsa
id RHSA-2017:1413
rhsa
id RHSA-2017:1414
rhsa
id RHSA-2017:1415
rhsa
id RHSA-2017:1658
rhsa
id RHSA-2017:1659
rhsa
id RHSA-2017:1801
rhsa
id RHSA-2017:1802
rhsa
id RHSA-2017:2493
rhsa
id RHSA-2017:2494

rpms

openssl-0:1.0.1e-48.el6_8.3
openssl-1:1.0.1e-51.el7_2.7
openssl-debuginfo-0:1.0.1e-48.el6_8.3
openssl-debuginfo-1:1.0.1e-51.el7_2.7
openssl-devel-0:1.0.1e-48.el6_8.3
openssl-devel-1:1.0.1e-51.el7_2.7
openssl-libs-1:1.0.1e-51.el7_2.7
openssl-perl-0:1.0.1e-48.el6_8.3
openssl-perl-1:1.0.1e-51.el7_2.7
openssl-static-0:1.0.1e-48.el6_8.3
openssl-static-1:1.0.1e-51.el7_2.7
openssl-0:1.0.0-20.el6_2.9
openssl-0:1.0.0-27.el6_4.6
openssl-0:1.0.1e-16.el6_5.17
openssl-0:1.0.1e-30.el6_6.13
openssl-0:1.0.1e-42.el6_7.6
openssl-debuginfo-0:1.0.0-20.el6_2.9
openssl-debuginfo-0:1.0.0-27.el6_4.6
openssl-debuginfo-0:1.0.1e-16.el6_5.17
openssl-debuginfo-0:1.0.1e-30.el6_6.13
openssl-debuginfo-0:1.0.1e-42.el6_7.6
openssl-devel-0:1.0.0-20.el6_2.9
openssl-devel-0:1.0.0-27.el6_4.6
openssl-devel-0:1.0.1e-16.el6_5.17
openssl-devel-0:1.0.1e-30.el6_6.13
openssl-devel-0:1.0.1e-42.el6_7.6
openssl-perl-0:1.0.0-20.el6_2.9
openssl-perl-0:1.0.0-27.el6_4.6
openssl-perl-0:1.0.1e-16.el6_5.17
openssl-perl-0:1.0.1e-30.el6_6.13
openssl-perl-0:1.0.1e-42.el6_7.6
openssl-static-0:1.0.0-20.el6_2.9
openssl-static-0:1.0.0-27.el6_4.6
openssl-static-0:1.0.1e-16.el6_5.17
openssl-static-0:1.0.1e-30.el6_6.13
openssl-static-0:1.0.1e-42.el6_7.6
jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7
jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7
jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7
jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7
jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7
jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7
jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7
jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7
jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7
jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7
jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7
jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7
jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7
jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7
jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6
jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6
jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6
jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6
jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6
jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6
jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6
jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6
jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6
jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6
jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6
jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6
jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6
jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7
log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6
log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7
tomcat-native-0:1.2.8-10.redhat_10.ep7.el6
tomcat-native-0:1.2.8-10.redhat_10.ep7.el7
tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6
tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7
tomcat7-0:7.0.70-22.ep7.el6
tomcat7-0:7.0.70-22.ep7.el7
tomcat7-admin-webapps-0:7.0.70-22.ep7.el6
tomcat7-admin-webapps-0:7.0.70-22.ep7.el7
tomcat7-docs-webapp-0:7.0.70-22.ep7.el6
tomcat7-docs-webapp-0:7.0.70-22.ep7.el7
tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6
tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7
tomcat7-javadoc-0:7.0.70-22.ep7.el6
tomcat7-javadoc-0:7.0.70-22.ep7.el7
tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6
tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7
tomcat7-jsvc-0:7.0.70-22.ep7.el6
tomcat7-jsvc-0:7.0.70-22.ep7.el7
tomcat7-lib-0:7.0.70-22.ep7.el6
tomcat7-lib-0:7.0.70-22.ep7.el7
tomcat7-log4j-0:7.0.70-22.ep7.el6
tomcat7-log4j-0:7.0.70-22.ep7.el7
tomcat7-selinux-0:7.0.70-22.ep7.el6
tomcat7-selinux-0:7.0.70-22.ep7.el7
tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6
tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7
tomcat7-webapps-0:7.0.70-22.ep7.el6
tomcat7-webapps-0:7.0.70-22.ep7.el7
tomcat8-0:8.0.36-24.ep7.el6
tomcat8-0:8.0.36-24.ep7.el7
tomcat8-admin-webapps-0:8.0.36-24.ep7.el6
tomcat8-admin-webapps-0:8.0.36-24.ep7.el7
tomcat8-docs-webapp-0:8.0.36-24.ep7.el6
tomcat8-docs-webapp-0:8.0.36-24.ep7.el7
tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6
tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7
tomcat8-javadoc-0:8.0.36-24.ep7.el6
tomcat8-javadoc-0:8.0.36-24.ep7.el7
tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6
tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7
tomcat8-jsvc-0:8.0.36-24.ep7.el6
tomcat8-jsvc-0:8.0.36-24.ep7.el7
tomcat8-lib-0:8.0.36-24.ep7.el6
tomcat8-lib-0:8.0.36-24.ep7.el7
tomcat8-log4j-0:8.0.36-24.ep7.el6
tomcat8-log4j-0:8.0.36-24.ep7.el7
tomcat8-selinux-0:8.0.36-24.ep7.el6
tomcat8-selinux-0:8.0.36-24.ep7.el7
tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6
tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7
tomcat8-webapps-0:8.0.36-24.ep7.el6
tomcat8-webapps-0:8.0.36-24.ep7.el7
jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7
jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6
jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7
tomcat6-0:6.0.41-17_patch_04.ep6.el6
tomcat6-0:6.0.41-17_patch_04.ep6.el7
tomcat6-admin-webapps-0:6.0.41-17_patch_04.ep6.el6
tomcat6-admin-webapps-0:6.0.41-17_patch_04.ep6.el7
tomcat6-docs-webapp-0:6.0.41-17_patch_04.ep6.el6
tomcat6-docs-webapp-0:6.0.41-17_patch_04.ep6.el7
tomcat6-el-2.1-api-0:6.0.41-17_patch_04.ep6.el6
tomcat6-el-2.1-api-0:6.0.41-17_patch_04.ep6.el7
tomcat6-javadoc-0:6.0.41-17_patch_04.ep6.el6
tomcat6-javadoc-0:6.0.41-17_patch_04.ep6.el7
tomcat6-jsp-2.1-api-0:6.0.41-17_patch_04.ep6.el6
tomcat6-jsp-2.1-api-0:6.0.41-17_patch_04.ep6.el7
tomcat6-lib-0:6.0.41-17_patch_04.ep6.el6
tomcat6-lib-0:6.0.41-17_patch_04.ep6.el7
tomcat6-log4j-0:6.0.41-17_patch_04.ep6.el6
tomcat6-log4j-0:6.0.41-17_patch_04.ep6.el7
tomcat6-maven-devel-0:6.0.41-17_patch_04.ep6.el6
tomcat6-maven-devel-0:6.0.41-17_patch_04.ep6.el7
tomcat6-servlet-2.5-api-0:6.0.41-17_patch_04.ep6.el6
tomcat6-servlet-2.5-api-0:6.0.41-17_patch_04.ep6.el7
tomcat6-webapps-0:6.0.41-17_patch_04.ep6.el6
tomcat6-webapps-0:6.0.41-17_patch_04.ep6.el7
tomcat7-0:7.0.54-25_patch_05.ep6.el6
tomcat7-0:7.0.54-25_patch_05.ep6.el7
tomcat7-admin-webapps-0:7.0.54-25_patch_05.ep6.el6
tomcat7-admin-webapps-0:7.0.54-25_patch_05.ep6.el7
tomcat7-docs-webapp-0:7.0.54-25_patch_05.ep6.el6
tomcat7-docs-webapp-0:7.0.54-25_patch_05.ep6.el7
tomcat7-el-2.2-api-0:7.0.54-25_patch_05.ep6.el6
tomcat7-el-2.2-api-0:7.0.54-25_patch_05.ep6.el7
tomcat7-javadoc-0:7.0.54-25_patch_05.ep6.el6
tomcat7-javadoc-0:7.0.54-25_patch_05.ep6.el7
tomcat7-jsp-2.2-api-0:7.0.54-25_patch_05.ep6.el6
tomcat7-jsp-2.2-api-0:7.0.54-25_patch_05.ep6.el7
tomcat7-lib-0:7.0.54-25_patch_05.ep6.el6
tomcat7-lib-0:7.0.54-25_patch_05.ep6.el7
tomcat7-log4j-0:7.0.54-25_patch_05.ep6.el6
tomcat7-log4j-0:7.0.54-25_patch_05.ep6.el7
tomcat7-maven-devel-0:7.0.54-25_patch_05.ep6.el6
tomcat7-maven-devel-0:7.0.54-25_patch_05.ep6.el7
tomcat7-servlet-3.0-api-0:7.0.54-25_patch_05.ep6.el6
tomcat7-servlet-3.0-api-0:7.0.54-25_patch_05.ep6.el7
tomcat7-webapps-0:7.0.54-25_patch_05.ep6.el6
tomcat7-webapps-0:7.0.54-25_patch_05.ep6.el7

The Hacker News

id	THN:35CF2D56C908025E96F8E8ADF33384DB
last seen	2018-01-27
modified	2016-09-23
published	2016-09-23
reporter	Swati Khandelwal
source	https://thehackernews.com/2016/09/openssl-dos-attack.html
title	Critical DoS Flaw found in OpenSSL — How It Works

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Nessus

Packetstorm

Redhat

The Hacker News

References