The remote host is affected by the vulnerability described in GLSA-201407-05 (OpenSSL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenSSL. Please review       the OpenSSL Security Advisory [05 Jun 2014] and the CVE identifiers       referenced below for details.
  Impact :

    A remote attacker could send specially crafted DTLS fragments to an       OpenSSL DTLS client or server to possibly execute arbitrary code with the       privileges of the process using OpenSSL.
    Furthermore, an attacker could force the use of weak keying material in       OpenSSL SSL/TLS clients and servers, inject data across sessions, or       cause a Denial of Service via various vectors.
  Workaround :

    There is no known workaround at this time.

The version of VMware vCenter Converter installed on the remote Windows host is version 5.1.x prior to 5.1.1 or 5.5.x prior to 5.5.2.
It is, therefore, affected by multiple vulnerabilities in the bundled OpenSSL library :

  - An error exists in the function 'ssl3_read_bytes'     that could allow data to be injected into other     sessions or allow denial of service attacks. Note     this issue is only exploitable if     'SSL_MODE_RELEASE_BUFFERS' is enabled. (CVE-2010-5298)

  - A buffer overflow error exists related to invalid DTLS     fragment handling that could lead to execution of     arbitrary code. Note this issue only affects OpenSSL     when used as a DTLS client or server. (CVE-2014-0195)

  - An error exists in the function 'do_ssl3_write' that     could allow a NULL pointer to be dereferenced leading     to denial of service attacks. Note this issue is     exploitable only if 'SSL_MODE_RELEASE_BUFFERS' is     enabled. (CVE-2014-0198)

  - An error exists related to DTLS handshake handling that     could lead to denial of service attacks. Note this     issue only affects OpenSSL when used as a DTLS client.
    (CVE-2014-0221)

  - An unspecified error exists that could allow an     attacker to cause usage of weak keying material     leading to simplified man-in-the-middle attacks.
    (CVE-2014-0224)

  - An unspecified error exists related to anonymous ECDH     cipher suites that could allow denial of service     attacks. Note this issue only affects OpenSSL TLS     clients. (CVE-2014-3470)

The version of Cerberus FTP Server on the remote host is version 6.x prior to 6.0.10.0 or version 7.x prior to 7.0.0.3. It is, therefore, affected by the following OpenSSL vulnerabilities :

  - An error exists in the 'ssl3_read_bytes' function     that permits data to be injected into other sessions     or allows denial of service attacks. Note that this     issue is exploitable only if SSL_MODE_RELEASE_BUFFERS     is enabled. (CVE-2010-5298)

  - A buffer overflow error exists related to invalid DTLS     fragment handling that permits the execution of     arbitrary code or allows denial of service attacks.
    Note that this issue only affects OpenSSL when used     as a DTLS client or server. (CVE-2014-0195)

  - An error exists in the 'do_ssl3_write' function that     permits a NULL pointer to be dereferenced, which could     allow denial of service attacks. Note that this issue     is exploitable only if SSL_MODE_RELEASE_BUFFERS is     enabled. (CVE-2014-0198)

  - An error exists related to DTLS handshake handling that     could allow denial of service attacks. Note that this     issue only affects OpenSSL when used as a DTLS client.
    (CVE-2014-0221)

  - An error exists in the processing of ChangeCipherSpec     messages that allows the usage of weak keying material.
    This permits simplified man-in-the-middle attacks to be     done. (CVE-2014-0224)

  - An error exists in the 'dtls1_get_message_fragment'     function related to anonymous ECDH cipher suites. This     could allow denial of service attacks. Note that this     issue only affects OpenSSL TLS clients. (CVE-2014-3470)

It was found that OpenSSL clients and servers could be forced, via a specially crafted handshake packet, to use weak keying material for communication. A man-in-the-middle attacker could use this flaw to decrypt and modify traffic between a client and a server.
(CVE-2014-0224)

Note: In order to exploit this flaw, both the server and the client must be using a vulnerable version of OpenSSL; the server must be using OpenSSL version 1.0.1 and above, and the client must be using any version of OpenSSL.

A buffer overflow flaw was found in the way OpenSSL handled invalid DTLS packet fragments. A remote attacker could possibly use this flaw to execute arbitrary code on a DTLS client or server. (CVE-2014-0195)

Multiple flaws were found in the way OpenSSL handled read and write buffers when the SSL_MODE_RELEASE_BUFFERS mode was enabled. A TLS/SSL client or server using OpenSSL could crash or unexpectedly drop connections when processing certain SSL traffic. (CVE-2010-5298 , CVE-2014-0198)

A denial of service flaw was found in the way OpenSSL handled certain DTLS ServerHello requests. A specially crafted DTLS handshake packet could cause a DTLS client using OpenSSL to crash. (CVE-2014-0221)

A NULL pointer dereference flaw was found in the way OpenSSL performed anonymous Elliptic Curve Diffie Hellman (ECDH) key exchange. A specially crafted handshake packet could cause a TLS/SSL client that has the anonymous ECDH cipher suite enabled to crash. (CVE-2014-3470)

An integer underflow flaw, leading to a heap-based buffer overflow, was found in the way OpenSSL decoded certain base64 strings. A remote attacker could provide a specially crafted base64 string via certain PEM processing routines that, when parsed by the OpenSSL library, would cause the OpenSSL server to crash. (CVE-2015-0292)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
76864	GLSA-201407-05 : OpenSSL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2014/7/28	2021/1/6	high
76947	VMware vCenter Converter Multiple Vulnerabilities (VMSA-2014-0006)	Nessus	Windows	2014/7/31	2019/11/25	medium
77004	Cerberus FTP Server 6.x < 6.0.10.0 / 7.x < 7.0.0.3 Multiple OpenSSL Vulnerabilities	Nessus	FTP	2014/8/5	2020/10/16	medium
78292	Amazon Linux AMI : openssl (ALAS-2014-349)	Nessus	Amazon Linux Local Security Checks	2014/10/12	2019/11/12	high

检测

插件搜索

high

medium

medium

high