Lucene search

K
nessusTenable9463.PRM
HistoryAug 05, 2016 - 12:00 a.m.

OpenSSL 1.0.2 < 1.0.2e Multiple Vulnerabilities

2016-08-0500:00:00
Tenable
www.tenable.com
13

According to its banner, the version of OpenSSL on the remote host is 1.0.2 prior to 1.0.2e and is affected by the following vulnerabilities :

  • A flaw in the ‘ssl3_get_key_exchange()’ function in ‘ssl/s3_clnt.c’ is triggered when handling a ‘ServerKeyExchange’ for an anon DH ciphersuite with the value of ‘p’ set to 0. This may allow a context-dependent attacker to crash an application linked against the library. (CVE-2015-1794)
  • A carry propagating flaw exists within the x86_64 Montgomery squaring procedure. This may cause ‘BN_mod_exp’ to produce incorrect results, which may potentially allow an attacker to derive information regarding private keys. (CVE-2015-3193)
Binary data 9463.prm
VendorProductVersionCPE
opensslopensslcpe:/a:openssl:openssl