This update adds support for RFC5746 TLS renegotiations to address vulnerabilities tracked as (CVE-2009-3555). It also fixes a mishandling of OOM conditions in bn_wexpand. (CVE-2009-3245)

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.8. This update contains security-related fixes for the following components :

  - App Store
  - ATS
  - Certificate Trust Policy
  - CoreFoundation
  - CoreGraphics
  - FTP Server
  - ImageIO
  - International Components for Unicode
  - Kernel
  - Libsystem
  - libxslt
  - MobileMe
  - MySQL
  - OpenSSL
  - patch
  - QuickLook
  - QuickTime
  - Samba
  - servermgrd
  - subversion

Update to upstream version 0.9.8n fixing multiple security issues:
CVE-2009-3555, CVE-2009-3245, CVE-2009-4355, and CVE-2010-0433. Refer to upstream CHANGES file for the detailed list of changes since version 0.9.8k :

  -     http://cvs.openssl.org/fileview?f=openssl/CHANGES&v=1.12     38.2.193

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2009-3245 openssl: missing bn_wexpand return value checks

It was discovered that OpenSSL did not always check the return value of the bn_wexpand() function. An attacker able to trigger a memory allocation failure in that function could cause an application using the OpenSSL library to crash or, possibly, execute arbitrary code.
(CVE-2009-3245)

For the update to take effect, all programs using the openssl096b library must be restarted.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0977 advisory.

  - openssl: NETSCAPE_REUSE_CIPHER_CHANGE_BUG downgrade-to-disabled ciphersuite attack (CVE-2008-7270)

  - openssl: missing bn_wexpand return value checks (CVE-2009-3245)

  - openssl: NETSCAPE_REUSE_CIPHER_CHANGE_BUG ciphersuite downgrade attack (CVE-2010-4180)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
45385	SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 6943)	Nessus	SuSE Local Security Checks	2010/3/31	2021/1/14	critical
45401	SuSE9 Security Update : OpenSSL (YOU Patch Number 12606)	Nessus	SuSE Local Security Checks	2010/4/2	2021/1/14	critical
55416	Mac OS X 10.6.x < 10.6.8 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2011/6/24	2018/8/22	critical
47385	Fedora 11 : openssl-0.9.8n-1.fc11 (2010-5357)	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	critical
60756	Scientific Linux Security Update : openssl096b on SL3.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	critical
51155	RHEL 4 : openssl (RHSA-2010:0977)	Nessus	Red Hat Local Security Checks	2010/12/14	2024/4/21	critical

検出

プラグインの検索

critical

critical

critical

critical

critical

critical