Test Kennung:	1.3.6.1.4.1.25623.1.0.64675
Kategorie:	Mandrake Local Security Checks
Titel:	Mandrake Security Advisory MDVSA-2009:203 (curl)
Zusammenfassung:	NOSUMMARY
Beschreibung:	Description: The remote host is missing an update to curl announced via advisory MDVSA-2009:203. A vulnerability has been found and corrected in curl: lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408 (CVE-2009-2417). This update provides a solution to this vulnerability. Affected: 2008.1, 2009.0, Corporate 3.0, Corporate 4.0, Enterprise Server 5.0, Multi Network Firewall 2.0 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. http://www.securityspace.com/smysecure/catid.html?in=MDVSA-2009:203 CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2009-2408 Debian Security Information: DSA-1874 (Google Search) http://www.debian.org/security/2009/dsa-1874 http://www.mandriva.com/security/advisories?name=MDVSA-2009:197 http://www.mandriva.com/security/advisories?name=MDVSA-2009:216 http://www.mandriva.com/security/advisories?name=MDVSA-2009:217 http://isc.sans.org/diary.html?storyid=7003 http://www.wired.com/threatlevel/2009/07/kaminsky/ http://marc.info/?l=oss-security&m=125198917018936&w=2 http://osvdb.org/56723 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10751 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8458 http://www.redhat.com/support/errata/RHSA-2009-1207.html http://www.redhat.com/support/errata/RHSA-2009-1432.html http://www.securitytracker.com/id?1022632 http://secunia.com/advisories/36088 http://secunia.com/advisories/36125 http://secunia.com/advisories/36139 http://secunia.com/advisories/36157 http://secunia.com/advisories/36434 http://secunia.com/advisories/36669 http://secunia.com/advisories/37098 http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021030.1-1 SuSE Security Announcement: SUSE-SA:2009:048 (Google Search) http://www.novell.com/linux/security/advisories/2009_48_firefox.html SuSE Security Announcement: SUSE-SR:2009:018 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html http://www.ubuntu.com/usn/usn-810-1 https://usn.ubuntu.com/810-2/ http://www.vupen.com/english/advisories/2009/2085 http://www.vupen.com/english/advisories/2009/3184 Common Vulnerability Exposure (CVE) ID: CVE-2009-2417 http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html BugTraq ID: 36032 http://www.securityfocus.com/bid/36032 Bugtraq: 20090824 rPSA-2009-0124-1 curl (Google Search) http://www.securityfocus.com/archive/1/506055/100/0/threaded Bugtraq: 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components (Google Search) http://www.securityfocus.com/archive/1/507985/100/0/threaded https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10114 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8542 http://secunia.com/advisories/36238 http://secunia.com/advisories/36475 http://secunia.com/advisories/37471 http://secunia.com/advisories/45047 http://www.ubuntu.com/usn/USN-1158-1 http://www.vupen.com/english/advisories/2009/2263 http://www.vupen.com/english/advisories/2009/3316 XForce ISS Database: curl-certificate-security-bypass(52405) https://exchange.xforce.ibmcloud.com/vulnerabilities/52405
Copyright	Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.