Multiple vulnerabilities have been found in OpenSSL. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2012-0884     Ivan Nestlerode discovered a weakness in the CMS and     PKCS #7 implementations that could allow an attacker to     decrypt data via a Million Message Attack (MMA).

  - CVE-2012-1165     It was discovered that a NULL pointer could be     dereferenced when parsing certain S/MIME messages,     leading to denial of service.

  - CVE-2012-2110     Tavis Ormandy, Google Security Team, discovered a     vulnerability in the way DER-encoded ASN.1 data is     parsed that can result in a heap overflow.

Additionally, the fix for CVE-2011-4619 has been updated to address an issue with SGC handshakes.

Tomas Hoger, Red Hat, discovered that the fix for CVE-2012-2110 for the 0.9.8 series of OpenSSL was incomplete. It has been assigned the CVE-2012-2131 identifier.

The remote host is running a version of Mac OS X 10.8.x that is prior to 10.8.4. The newer version contains multiple security-related fixes for the following components :

  - CFNetwork
  - CoreAnimation
  - CoreMedia Playback
  - CUPS
  - Disk Management
  - OpenSSL
  - QuickDraw Manager
  - QuickTime
  - SMB

The remote host is running a version of Mac OS X 10.6 or 10.7 that does not have Security Update 2013-002 applied.  This update contains numerous security-related fixes for the following components :

  - CoreMedia Playback (10.7 only)
  - Directory Service (10.6 only)
  - OpenSSL
  - QuickDraw Manager
  - QuickTime
  - Ruby (10.6 only)
  - SMB (10.7 only)

According to its self-reported version, the version of IVE / UAC OS running on the remote host may be affected by multiple vulnerabilities :

  - Remote attackers may be able to trigger buffer overflow     vulnerabilities on the OpenSSL libraries by sending     specially crafted DER data, resulting in memory     corruption. (CVE-2012-2131)

  - A weakness in the OpenSSL library leaves it vulnerable     to an attack that could allow a third party to recover     (fully or partially) the plaintext from encrypted     traffic. (CVE-2013-0169)

  - A flaw in OCSP signature verification in the OpenSSL     library allows remote OCSP servers to cause a denial of     service condition with an invalid key. (CVE-2013-0166)

The version of OpenSSL installed on the remote host is prior to 0.9.8w. It is, therefore, affected by a vulnerability as referenced in the 0.9.8w advisory.

  - Multiple integer signedness errors in crypto/buffer/buffer.c in OpenSSL 0.9.8v allow remote attackers to     conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have     unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public     key. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-2110. (CVE-2012-2131)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This compat-openssl097g rollup update contains various security fixes :

  - incorrect integer conversions in OpenSSL could have     resulted in memory corruption during buffer management     operations. (CVE-2012-2131 / CVE-2012-2110)

This update of openssl fixes an integer conversation issue which could cause a heap-based memory corruption. (CVE-2012-2110)

Additionally, a check for negative buffer length values was added (CVE-2012-2131) and the stack made non-executable by marking the enhanced Intel SSSE3 assembler code as not needing executable stack.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
58804	Debian DSA-2454-2 : openssl - multiple vulnerabilities	Nessus	Debian Local Security Checks	2012/4/20	2021/1/11	high
66808	Mac OS X 10.8.x < 10.8.4 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2013/6/5	2024/5/28	high
66809	Mac OS X Multiple Vulnerabilities (Security Update 2013-002)	Nessus	MacOS X Local Security Checks	2013/6/5	2024/5/28	critical
69987	Junos Pulse Secure IVE / UAC OS Multiple SSL Vulnerabilities	Nessus	Misc.	2013/9/19	2022/12/5	high
200192	OpenSSL 0.9.8v < 0.9.8w Vulnerability	Nessus	Web Servers	2024/6/7	2024/10/7	critical
62060	SuSE 10 Security Update : compat-openssl097g (ZYPP Patch Number 8262)	Nessus	SuSE Local Security Checks	2012/9/12	2021/1/19	high
64184	SuSE 11.1 Security Update : openssl (SAT Patch Number 6245)	Nessus	SuSE Local Security Checks	2013/1/25	2021/1/19	high

检测

插件搜索

high

high

critical

high

critical

high

high