OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library.

A NULL pointer dereference flaw was found in the way OpenSSL parsed Secure/Multipurpose Internet Mail Extensions (S/MIME) messages. An attacker could use this flaw to crash an application that uses OpenSSL to decrypt or verify S/MIME messages. (CVE-2012-1165)

A flaw was found in the PKCS#7 and Cryptographic Message Syntax (CMS) implementations in OpenSSL. An attacker could possibly use this flaw to perform a Bleichenbacher attack to decrypt an encrypted CMS, PKCS#7, or S/MIME message by sending a large number of chosen ciphertext messages to a service using OpenSSL and measuring error response times. (CVE-2012-0884)

This update also fixes a regression caused by the fix for CVE-2011-4619, released in a previous update, which caused Server Gated Cryptography (SGC) handshakes to fail.

All OpenSSL users should upgrade to these updated packages, which contain backported patches to resolve these issues. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.

The remote host is affected by the vulnerability described in GLSA-201312-03 (OpenSSL: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenSSL. Please review       the CVE identifiers referenced below for details.
  Impact :

    Remote attackers can determine private keys, decrypt data, cause a       Denial of Service or possibly have other unspecified impact.
  Workaround :

    There is no known workaround at this time.

openssl was updated to 1.0.0k security release to fix bugs and security issues. (bnc#802648 bnc#802746) The version was upgraded to avoid backporting the large fixes for SSL, TLS and DTLS Plaintext Recovery Attack (CVE-2013-0169) TLS 1.1 and 1.2 AES-NI crash (CVE-2012-2686) OCSP invalid key DoS issue (CVE-2013-0166)

Also the following bugfix was included: bnc#757773 - c_rehash to accept more filename extensions

It was discovered that OpenSSL could be made to dereference a NULL pointer when processing S/MIME messages. A remote attacker could use this to cause a denial of service. These issues did not affect Ubuntu 8.04 LTS. (CVE-2006-7250, CVE-2012-1165)

Tavis Ormandy discovered that OpenSSL did not properly perform bounds checking when processing DER data via BIO or FILE functions. A remote attacker could trigger this flaw in services that used SSL to cause a denial of service or possibly execute arbitrary code with application privileges. (CVE-2012-2110).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Changes in openssl :

  - S/MIME verification may erroneously fail

  - Free headers after use in error message

  - Symmetric crypto errors in PKCS7_decrypt

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
61293	Scientific Linux Security Update : openssl on SL5.x, SL6.x i386/x86_64 (20120327)	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
71169	GLSA-201312-03 : OpenSSL: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2013/12/3	2022/12/5	high
74901	openSUSE Security Update : openssl (openSUSE-SU-2013:0336-1)	Nessus	SuSE Local Security Checks	2014/6/13	2022/12/5	high
58808	Ubuntu 8.04 LTS / 10.04 LTS / 11.04 / 11.10 : openssl vulnerabilities (USN-1424-1)	Nessus	Ubuntu Local Security Checks	2012/4/20	2019/9/19	high
74590	openSUSE Security Update : openssl (openSUSE-SU-2012:0474-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	medium

检测

插件搜索

medium

high

high

high

medium