Ubuntu: Security Advisory (USN-2079-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu Update for openssl USN-2079-1

Check for the Version of openssl OpenVAS Vulnerability Test $Id: gbubuntuUSN20791.nasl 7957 2017-12-01 06:40:08Z santu $ Ubuntu Update for openssl USN-2079-1 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software...

Scientific Linux Security Update : openssl on SL6.x i386/x86_64 (20140108)

A flaw was found in the way OpenSSL determined which hashing algorithm to use when TLS protocol version 1.2 was enabled. This could possibly cause OpenSSL to use an incorrect hashing algorithm, leading to a crash of an application using the library. CVE-2013-6449 It was discovered that the Datagr...

Ubuntu 12.04 LTS / 12.10 / 13.04 / 13.10 : openssl vulnerabilities (USN-2079-1)

Anton Johansson discovered that OpenSSL incorrectly handled certain invalid TLS handshakes. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service. CVE-2013-4353 Ron Barber discovered that OpenSSL used an incorrect data structure to obtain a version...

USN-2079-1: OpenSSL vulnerabilities

Anton Johansson discovered that OpenSSL incorrectly handled certain invalid TLS handshakes. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service. CVE-2013-4353 Ron Barber discovered that OpenSSL used an incorrect data structure to obtain a version...

RHEL 6 : openssl (RHSA-2014:0015)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0015 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocols, as well as a...

Important: Red Hat Security Advisory: openssl security update

Updated openssl packages that fix three security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

openssl: crash in DTLS renegotiation after packet loss

The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service...

OpenSSL 1.0.1 < 1.0.1f Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.0.1f. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.1f advisory. - The ssl3takemac function in ssl/s3both.c in OpenSSL 1.0.1 before 1.0.1f allows remote TLS servers to cause a denial of service NUL...

OpenSSL 1.0.0 < 1.0.0l Vulnerability

The version of OpenSSL installed on the remote host is prior to 1.0.0l. It is, therefore, affected by a vulnerability as referenced in the 1.0.0l advisory. - The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures fo...

FreeBSD : openssl -- multiple vulnerabilities (5aaa257e-772d-11e3-a65a-3c970e169bc2)

OpenSSL development team reports : Major changes between OpenSSL 1.0.1e and OpenSSL 1.0.1f 6 Jan 2014 : - Fix for TLS record tampering bug CVE-2013-4353 - Fix for TLS version checking bug CVE-2013-6449 - Fix for DTLS retransmission bug CVE-2013-6450 %NASLMINLEVEL 70300 C Tenable Network Security,...

openssl -- multiple vulnerabilities

OpenSSL development team reports: Major changes between OpenSSL 1.0.1e and OpenSSL 1.0.1f 6 Jan 2014: Fix for TLS record tampering bug CVE-2013-4353 Fix for TLS version checking bug CVE-2013-6449 Fix for DTLS retransmission bug CVE-2013-6450...

OpenSSL DTLS中间人攻击多个安全措施绕过漏洞

BUGTRAQ ID: 64618 CVECAN ID: CVE-2013-6450 OpenSSL是一种开放源码的SSL实现，用来实现网络通信的高强度加密，现在被广泛地用于各种网络应用程序中。 OpenSSL 0.9.8y, 1.0.0-1.0.1e的DTLS中继实现中，摘要及加密上下文的数据结构没有被正确维护，可使中间人攻击者通过干涉数据包传输（相关ssl/d1both.c、ssl/t1enc.c），使用不同的上下文，获取敏感信息。 0 OpenSSL Project OpenSSL 1.0.0 厂商补丁： OpenSSL Project ---------------...

Debian DSA-2833-1 : openssl - several vulnerabilities

Multiple security issues have been fixed in OpenSSL: The TLS 1.2 support was susceptible to denial of service and retransmission of DTLS messages was fixed. In addition this update disables the insecure DualECDRBG algorithm which was unused anyway, see...

CVE-2013-6450

The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service...

DEBIAN-CVE-2013-6450

The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service...

CVE-2013-6450

The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service...

Information disclosure

The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service...

CVE-2013-6450

CVE-2013-6450 affects OpenSSL DTLS retransmission handling. The vulnerability arises from improper maintenance of digest/encryption context data structures during DTLS retransmission, in particular related to ssl/d1_both.c and ssl/t1_enc.c, which can allow a remote attacker to trigger a crash of ...

CVE-2013-6450

The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service...