更新到最新的上游版本。也修复了 CVE-2016-0705、CVE-2016-0639、CVE-2016-2047、CVE-2016-0647、CVE-2016-0648、CVE-2016-0666、CVE-2016-0642、CVE-2016-0655、CVE-2016-0643

请注意，Tenable Network Security 已直接从 Fedora 更新系统网站提取上述描述块。
Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

发现一个跨协议攻击，使用支持 SSLv2 和 EXPORT 加密套件的服务器作为 Bleichenbacher RSA padding oracle 时，可导致 TLS 会话解密。请注意，假设支持 SSLv2 和 EXPORT 加密（即使是使用不同的协议，例如 SMTP、IMAP 或 POP3）的其他服务器共享无漏洞服务器的 RSA 密钥，也可以将客户端和无漏洞服务器之间的流量解密。此漏洞称为 DROWN。
[CVE-2016-0800]

当 OpenSSL 解析畸形的 DSA 私钥时，发现一个双重释放缺陷，如果应用程序从不受信任的来源接收 DSA 私钥，可能会遭致 DoS 攻击或造成内存损坏。
这种情况比较罕见。[CVE-2016-0705]

SRP 用户数据库查找方法 SRP_VBASE_get_by_user 包含容易混淆的内存管理语义；有时返回刚分配的指针，有时返回由被调用者占有的指针。调用代码无法区别这两种情况。
[CVE-2016-0798]

在 BN_hex2bn 函数中，十六进制数使用 int 值 |i| 计算。之后，通过值 |i
* 4| 调用 |bn_expand|。对于大的 |i| 值，这可能会导致 |bn_expand| 不分配任何内存，因为 |i * 4| 是负的。这可能将内部 BIGNUM 数据字段变为空字段，进而导致空指针取消引用。对于非常大的 |i| 值，计算 |i
* 4| 的结果可能是小于 |i| 的正值。在这种情况下，即使向内部 BIGNUM 数据字段分配内存，也会因大小不足而导致堆损坏。在 BN_dec2bn 中存在类似的问题。如果用户的应用程序有不受信任的十六进制/十进制数据且数据值非常大，则调用 BN_hex2bn/BN_dec2bn 时可能会引发安全问题。据预计，这种情况比较罕见。[CVE-2016-0797]

在 BIO_*printf 函数中处理“%s”格式字符串时，计算字符串长度所用的内部 |fmtstr| 函数可能会发生溢出，打印非常长的字符串又可能造成越界读取。[CVE-2016-0799]

发现一个利用 Intel Sandy-Bridge 微架构上的 cache-bank 冲突而发动的边信道攻击，此攻击可能会导致恢复 RSA 密钥。[CVE-2016-0702]

s2_srvr.c 未强制执行“非出口级加密的清除密钥长度为 0”这一设置。如果这些密码存在清除密钥字节，则会取代加密密钥字节。[CVE-2016-0703]

应用出口级加密套件的 Bleichenbacher 防护机制时，s2_srvr.c 错误地覆盖主要密钥中的某些字节。[CVE-2016-0704] 影响：已启用 SSLv2 协议的服务器容易受到“DROWN”攻击的影响，此攻击可让远程攻击者对服务器快速建立大量有记录的 TLS 连接，即使客户端本身未建立任何 SSLv2 连接，亦是如此。

能够将畸形的 DSA 私钥输入 OpenSSL 应用程序的攻击者可造成内存损坏，进而导致拒绝服务。[CVE-2016-0705]

使用无效用户名连接的攻击者可造成内存泄漏，最终可能会导致拒绝服务。
[CVE-2016-0798]

能够将畸形的数据注入应用程序的攻击者可造成内存损坏，进而导致拒绝服务。[CVE-2016-0797、CVE-2016-0799]

对于 hyper 线程核心中运行的线程，若攻击者可控制其中的代码，当受害者的线程也在同一个核心中执行解密操作时，即可借机恢复 RSA 私钥。[CVE-2016-0702]

可拦截 SSLv2 握手的 eavesdropper 能够发动有效的分治法密钥复原攻击，仅需使用 16 个服务器连接和微乎其微的计算量，即可将服务器作为 oracle 来判断 SSLv2 主要密钥。[CVE-2016-0703]

攻击者可使用 Bleichenbacher oracle，进而启用更有效的 DROWN 攻击变体。[CVE-2016-0704]

Versions of OpenSSL prior to 1.0.1s, or 1.0.2g are unpatched for the following vulnerabilities :

 - A flaw exists in the 'SRP_VBASE_get_by_user' method in the SRP Server 'apps/s_server.c' that is triggered when handling invalid usernames. With a specially crafted username, a remote attacker can cause the service to leak 300 bytes of memory per connection, exhausting available memory resources.(
 - A flaw exists in the 'doapr_outch()' function in 'crypto/bio/b_print.c' that is triggered when failing to allocate memory, as the function's return value has no way to signal this error to a calling function. This may allow a context-dependent attacker to corrupt memory and crash a process linked against the library or potentially execute arbitrary code.
 - An out-of-bounds read flaw exists in the 'fmtstr()' function in 'crypto/bio/b_print.c' that is triggered when printing very long strings. This may allow a context-dependent attacker to crash a process linked against the library or to disclose memory contents.
 - A NULL pointer dereference flaw exists in the 'BN_hex2bn()' and 'BN_dec2bn()' functions in 'crypto/bn/bn_print.c'. This may allow a context-dependent attacker to trigger a heap corruption, potentially allowing the execution of arbitrary code.
 - SSLv2 contains a flaw in its implementation, allowing for a cross-protocol Bleichenbacher padding oracle attack (an adaptive chosen-ciphertext attack). Such an attack may allow a man-in-the-middle attacker to decrypt intercepted TLS connections via a series of specially crafted connections to an SSLv2 server that uses the same private key. The monitored connections required to conduct this attack can use any version of the SSL or TLS protocols, including TLS 1.2, as long as they all use the same RSA key exchange method. With each connection, the server response will vary enough so as to leak information to the attacker about the secret keys in use for the victim TLS connection. This information can in turn be used to eventually decrypt the entire TLS connection and gain access to all plaintext traffic between the victim and server.
 - A double-free flaw exists that is triggered as user-supplied input is not properly validated when parsing malformed DSA private keys. This may allow an attacker to corrupt memory to cause a denial of service or potentially execute arbitrary code.
 - A side-channel attack exists that is triggered during the handling of the cache-bank conflicts on the Intel Sandy-bridge microarchitecture. This may allow an attacker to gain access to RSA key information.
 - A flaw exists in 's2_srvr.c' that is triggered as it does not properly enforce that the 'clear-key-length' is 0 for non-export ciphers. This may allow an attacker to displace encrypted-key bytes if clear-key bytes are present for these ciphers, which can allow the attacker to gain access to SSLv2 master-key information.
 - A flaw exists in 's2_srvr.c' that is triggered when the incorrect bytes in the master-key are overwritten during the application of Bleichenbacher protection mechanisms for export cipher suites. This may allow an attacker to potentially execute more efficient variants of the DROWN attack.

Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Versions of OpenSSL prior to 1.0.1s, or 1.0.2g are unpatched for the following vulnerabilities :

According to its banner, the remote host is running a version of OpenSSL 1.0.2 prior to 1.0.2g. It is, therefore, affected by the following vulnerabilities :

  - A key disclosure vulnerability exists due to improper handling of cache-bank conflicts on the Intel Sandy-bridge microarchitecture. An attacker can exploit this to gain access to RSA key information. (CVE-2016-0702)

  - A double-free error exists due to improper validation of user-supplied input when parsing malformed DSA private keys. A remote attacker can exploit this to corrupt memory, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2016-0705)

  - A NULL pointer dereference flaw exists in the BN_hex2bn() and BN_dec2bn() functions. A remote attacker can exploit this to trigger a heap corruption, resulting in the execution of arbitrary code. (CVE-2016-0797)

  - A denial of service vulnerability exists due to improper handling of invalid usernames. A remote attacker can exploit this, via a specially crafted username, to leak 300 bytes of memory per connection, exhausting available memory resources. (CVE-2016-0798)

  - Multiple memory corruption issues exist that allow a remote attacker to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-0799)

  - A flaw exists that allows a cross-protocol Bleichenbacher padding oracle attack known as DROWN (Decrypting RSA with Obsolete and Weakened eNcryption). This vulnerability exists due to a flaw in the Secure Sockets Layer Version 2 (SSLv2) implementation, and it allows captured TLS traffic to be decrypted. A man-in-the-middle attacker can exploit this to decrypt the TSL connection by utilizing previously captured traffic and weak cryptography along with a series of specially crafted connections to an SSLv2 server that uses the same private key. (CVE-2016-0800)

ID	名前	製品	ファミリー	公開日	更新日	深刻度
92063	Fedora 22：community-mysql (2016-1aaf308de4)	Nessus	Fedora Local Security Checks	2016/7/14	2021/1/11	critical
92921	FreeBSD：FreeBSD -- 多种 OpenSSL 漏洞 (7b1a4a27-600a-11e6-a6c3-14dae9d210b8) (DROWN)	Nessus	FreeBSD Local Security Checks	2016/8/12	2021/1/4	critical
9128	OpenSSL 1.0.1 < 1.0.1s / 1.0.2 < 1.0.2g Multiple Vulnerabilities (DROWN)	Nessus Network Monitor	Web Servers	2016/3/1	2019/3/6	medium
503088	Siemens SCALANCE X-200RNA Switch Devices Improper Input Validation (CVE-2016-0705)	Tenable OT Security	Tenable.ot	2025/3/13	2025/3/13	critical
801963	OpenSSL 1.0.1 < 1.0.1s / 1.0.2 < 1.0.2g Multiple Vulnerabilities (DROWN)	Log Correlation Engine	Web Servers	2016/3/7		medium

検出

プラグインの検索

critical

critical

medium

critical

medium