This update improves the verification of return values. Prior to this udpate it was possible to bypass the certification chain checks of openssl. (CVE-2008-5077)

According to its self-reported version number, the HP System Management Homepage install on the remote host is earlier than 3.0.1.73.  Such versions are reportedly affected by multiple flaws :

  - A weakness in PHP could be exploited to perform cross-     site scripting attacks, provided PHP directive 'display     errors' is enabled. (CVE-2008-5814)

  - A vulnerability in OpenSSL versions prior to 0.9.8i     could be exploited to bypass the validation of the     certificate chain. (CVE-2008-5077)

  - Windows and Linux versions of SMH are affected by a     cross-site scripting vulnerability. (CVE-2009-1418)

It was discovered that OpenSSL did not properly perform signature verification on DSA and ECDSA keys. If user or automated system connected to a malicious server or a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to view sensitive information.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.7.  Mac OS X 10.5.7 contains security fixes for the following products : 

- Apache
- ATS
- BIND
- CFNetwork
- CoreGraphics
-Cscope
- CUPS
- Disk Images
- enscript
- Flash player
- Help Viewer
- iChat
- Internation Components for Unicode
- IPSec
- Kerberos
- Kernel
- Launch Services
- libxml
- Net-SNMP
- Network Time
- Networking
- OpenSSL
- PHP
- QuickDraw Manager
- ruby
- Safari
- Spotlight
- system_cmds
- telnet
- WebKit
- X11
- Terminal

ID	名前	製品	ファミリー	公開日	更新日	深刻度
41271	SuSE9 Security Update : openssl (YOU Patch Number 12341)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	medium
38832	HP System Management Homepage < 3.0.1.73 Multiple Flaws	Nessus	CGI abuses	2009/5/20	2022/4/11	medium
36382	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : openssl vulnerability (USN-704-1)	Nessus	Ubuntu Local Security Checks	2009/4/23	2021/1/19	medium
5023	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Nessus Network Monitor	Generic	2004/8/18	2019/3/6	critical
800792	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection			high

検出

プラグインの検索

medium

medium

medium

critical

high