Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - erlang の lib/crypto/c_src/crypto_drv.c は、OpenSSL DSA_do_verify 関数からの戻り値を適切にチェックしません。これにより、リモートの攻撃者が、無効な形式の SSL/TLS 署名を通じて、証明書チェーンの検証をバイパスできる可能性があります。これは、 と類似する脆弱性です CVE-2008-5077。 ] 注 パッケージのメンテナーがこの問題に異議を申し立て、crypto_drv.c の該当する部分を使用する唯一のコード内に適切なチェックがあるため、このレポートは無効であると報告しています。CVE-2009-0130

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

SunOS 5.10_x86: openssl patch.
Date this patch was last updated by Sun : Feb/24/09

SunOS 5.10_x86：openssl 修補程式。上次由 Sun 更新此修補程式的日期：2009 年 2 月 24 日

SunOS 5.10_x86：openssl 修补程序。Sun 上次更新此修补程序的日期：2019 年 2 月 24 日

SunOS 5.10_x86：openssl パッチ。
Sun によるこのパッチの最終更新日：Feb/24/09

セキュリティ問題を解決する更新済みの ntp パッケージが Red Hat Enterprise Linux 4 および 5 で現在利用可能です。

Red Hat セキュリティレスポンスチームは、この更新は重要度中のセキュリティ影響があると評価しています。

Network Time Protocol（NTP）は、コンピューターの時刻と参照される時刻ソースを同期させるために使用されます。

ntpd デーモンが OpenSSL EVP_VerifyFinal 関数の戻り値をチェックする方法に欠陥が発見されました。このため NTPv4 認証を使用するシステムでは暗号署名の検証が正しく実行されず、時間スプーフィング攻撃を受ける可能性があります。
（CVE-2009-0021）

注：この問題は、NTP 認証が有効化されているシステムにのみ影響を与えます。デフォルトでは、NTP 認証は有効化されていません。

ntp のすべてのユーザーは、バックポートされたパッチが含まれる更新済みパッケージにアップグレードし、この問題を解決することが推奨されます。更新のインストール後、 ntpd デーモンが自動的に再起動します。

It was discovered that Bind did not properly perform signature verification. When DNSSEC with DSA signatures are in use, a remote attacker could exploit this to bypass signature validation to spoof DNS entries and poison DNS caches. Among other things, this could lead to misdirected email and web traffic.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - lib/crypto/c_src/crypto_drv.c in erlang does not properly check the return value from the OpenSSL     DSA_do_verify function, which might allow remote attackers to bypass validation of the certificate chain     via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a package maintainer     disputes this issue, reporting that there is a proper check within the only code that uses the applicable     part of crypto_drv.c, and thus this report is invalid. (CVE-2009-0130)

Note that Nessus relies on the presence of the package as reported by the vendor.

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - erlang 中的 lib/crypto/c_src/crypto_drv.c 未正确检查来自 OpenSSL DSA_do_verify 函数的返回值这可能允许远程攻击者通过格式错误的 SSL/TLS 签名绕过证书链验证此漏洞与 CVE-2008-5077。注意程序包维护者对此问题有争议称其为使用 crypto_drv.c 适用部分的唯一代码内适当的检查因此该报告无效。 (CVE-2009-0130)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - erlang 中的 lib/crypto/c_src/crypto_drv.c 未正確檢查 OpenSSL DSA_do_verify 函式的傳回值這可能會允許遠端攻擊者透過格式錯誤的 SSL/TLS 簽章繞過憑證鏈驗證此弱點類似於 CVE-2008-5077。注意套件維護者對此問題有爭議指出在使用 crypto_drv.c 適用部分的唯一程式碼中有適當的檢查因此此報告無效。 (CVE-2009-0130)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Updated OpenSSL packages that correct a security issue are now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenSSL is a toolkit that implements Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength, general purpose, cryptography library.

The Google security team discovered a flaw in the way OpenSSL checked the verification of certificates. An attacker in control of a malicious server, or able to effect a 'man in the middle' attack, could present a malformed SSL/TLS signature from a certificate chain to a vulnerable client and bypass validation. (CVE-2008-5077)

All OpenSSL users should upgrade to these updated packages, which contain backported patches to resolve these issues. For the update to take effect, all running OpenSSL client applications must be restarted, or the system rebooted.

Updated ntp packages to correct a security issue are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Network Time Protocol (NTP) is used to synchronize a computer's time with a referenced time source.

A flaw was discovered in the way the ntpd daemon checked the return value of the OpenSSL EVP_VerifyFinal function. On systems using NTPv4 authentication, this could lead to an incorrect verification of cryptographic signatures, allowing time-spoofing attacks.
(CVE-2009-0021)

Note: This issue only affects systems that have enabled NTP authentication. By default, NTP authentication is not enabled.

All ntp users are advised to upgrade to the updated packages, which contain a backported patch to resolve this issue. After installing the update, the ntpd daemon will restart automatically.

It was discovered that OpenSSL does not properly verify DSA signatures on X.509 certificates due to an API misuse, potentially leading to the acceptance of incorrect X.509 certificates as genuine (CVE-2008-5077 ).

SunOS 5.10: openssl patch.
Date this patch was last updated by Sun : Apr/01/09

It has been discovered that NTP, an implementation of the Network Time Protocol, does not properly check the result of an OpenSSL function for verifying cryptographic signatures, which may ultimately lead to the acceptance of unauthenticated time information. (Note that cryptographic authentication of time servers is often not enabled in the first place.)

Updated Bind packages to correct a security issue are now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols.

A flaw was discovered in the way BIND checked the return value of the OpenSSL DSA_do_verify function. On systems using DNSSEC, a malicious zone could present a malformed DSA certificate and bypass proper certificate validation, allowing spoofing attacks. (CVE-2009-0025)

For users of Red Hat Enterprise Linux 3 this update also addresses a bug which can cause BIND to occasionally exit with an assertion failure.

All BIND users are advised to upgrade to the updated package, which contains a backported patch to resolve this issue. After installing the update, BIND daemon will be restarted automatically.

It was discovered that NTP did not properly perform signature verification. A remote attacker could exploit this to bypass certificate validation via a malformed SSL/TLS signature.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

a. Updated OpenSSL package for the Service Console fixes a    security issue.

   OpenSSL 0.9.7a-33.24 and earlier does not properly check the return    value from the EVP_VerifyFinal function, which could allow a remote    attacker to bypass validation of the certificate chain via a    malformed SSL/TLS signature for DSA and ECDSA keys.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2008-5077 to this issue.

b. Update bind package for the Service Console fixes a security issue.

   A flaw was discovered in the way Berkeley Internet Name Domain    (BIND) checked the return value of the OpenSSL DSA_do_verify    function. On systems using DNSSEC, a malicious zone could present    a malformed DSA certificate and bypass proper certificate    validation, allowing spoofing attacks.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2009-0025 to this issue.

c. Updated vim package for the Service Console addresses several    security issues.

   Several input flaws were found in Visual editor IMproved's (Vim)    keyword and tag handling. If Vim looked up a document's maliciously    crafted tag or keyword, it was possible to execute arbitrary code as    the user running Vim.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2008-4101 to this issue.

   A heap-based overflow flaw was discovered in Vim's expansion of file    name patterns with shell wildcards. An attacker could create a    specially crafted file or directory name, when opened by Vim causes    the application to stop responding or execute arbitrary code.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2008-3432 to this issue.

   Several input flaws were found in various Vim system functions. If a    user opened a specially crafted file, it was possible to execute    arbitrary code as the user running Vim.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2008-2712 to this issue.

   A format string flaw was discovered in Vim's help tag processor. If    a user was tricked into executing the 'helptags' command on    malicious data, arbitrary code could be executed with the    permissions of the user running VIM.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2007-2953 to this issue.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
253857	Linux Distros のパッチ未適用の脆弱性: CVE-2009-0130	Nessus	Misc.	2025/8/24	2025/9/2	high
36555	Solaris 10 (x86) : 139501-02	Nessus	Solaris Local Security Checks	2009/4/23	2021/1/14	medium
108014	Solaris 10 (x86)：139501-02	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	medium
108014	Solaris 10 (x86)：139501-02	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	medium
108014	Solaris 10 (x86 ) ： 139501-02	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	medium
43728	CentOS 4/5：ntp（CESA-2009:0046）	Nessus	CentOS Local Security Checks	2010/1/6	2021/1/4	medium
36220	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : bind9 vulnerability (USN-706-1)	Nessus	Ubuntu Local Security Checks	2009/4/23	2021/1/19	medium
253857	Linux Distros Unpatched Vulnerability : CVE-2009-0130	Nessus	Misc.	2025/8/24	2025/9/2	high
253857	Linux Distros 未修补的漏洞：CVE-2009-0130	Nessus	Misc.	2025/8/24	2025/9/2	high
253857	Linux Distros 未修補的弱點：CVE-2009-0130	Nessus	Misc.	2025/8/24	2025/9/2	high
35310	CentOS 3 / 4 / 5 : openssl (CESA-2009:0004)	Nessus	CentOS Local Security Checks	2009/1/8	2021/1/4	medium
43728	CentOS 4 / 5 : ntp (CESA-2009:0046)	Nessus	CentOS Local Security Checks	2010/1/6	2021/1/4	medium
35364	Debian DSA-1701-1 : openssl, openssl097 - interpretation conflict	Nessus	Debian Local Security Checks	2009/1/14	2021/1/4	medium
38118	Solaris 10 (sparc) : 139500-04	Nessus	Solaris Local Security Checks	2009/4/23	2021/1/14	medium
35365	Debian DSA-1702-1 : ntp - interpretation conflict	Nessus	Debian Local Security Checks	2009/1/14	2021/1/4	medium
35551	RHEL 4 / 5 : ntp (RHSA-2009:0046)	Nessus	Red Hat Local Security Checks	2009/1/29	2021/1/14	medium
35589	CentOS 3 / 4 / 5 : bind (CESA-2009:0020)	Nessus	CentOS Local Security Checks	2009/2/5	2021/1/4	medium
37876	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : ntp vulnerability (USN-705-1)	Nessus	Ubuntu Local Security Checks	2009/4/23	2021/1/19	medium
40389	VMSA-2009-0004 : ESX Service Console updates for openssl, bind, and vim	Nessus	VMware ESX Local Security Checks	2009/7/27	2021/1/6	high
108014	Solaris 10 (x86) : 139501-02	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	medium

检测

插件搜索

high

medium

medium

medium

medium

medium

medium

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

high

medium