Solutions de vulnérabilité

L'analyse périodique de vulnérabilité Nimsoft Cloud Monitor vérifie la vulnérabilité ci-dessous. Pour connaître les solutions de vulnérabilité les plus récemment ajoutées analysées par WatchMouse, rendez-vous sur la vue d'ensemble Solutions de vulnérabilité

Catégorie: Web Servers Facteur de risque: Critical Ajouté: 12 mars 2010
Synopsis:

The remote web server has multiple SSL-related vulnerabilities.

Description:

According to its banner, the remote web server uses a version of OpenSSL older than 0.9.8m. Such versions have the following vulnerabilities :

- Session renegotiations are not handled properly, which could be exploited to insert arbitrary plaintext by a man-in-the-middle. (CVE-2009-3555)

- The library does not check for a NULL return value from calls to the bn_wexpand() function, which has unspecified impact. (CVE-2009-3245)

See also:

http://rt.openssl.org/Ticket/Display.html?id=2111&user=guest&pass=guest
http://marc.info/?l=openssl-announce&m=126714485629486&w=2

Solution:

Upgrade to OpenSSL 0.9.8m or later.

Risk factor:

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)