Test Kennung:	1.3.6.1.4.1.25623.1.0.71997
Kategorie:	Mandrake Local Security Checks
Titel:	Mandriva Security Advisory MDVSA-2011:137 (openssl)
Zusammenfassung:	NOSUMMARY
Beschreibung:	Description: The remote host is missing an update to openssl announced via advisory MDVSA-2011:137. Multiple vulnerabilities has been discovered and corrected in openssl: The elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm (ECDSA) is used for the ECDHE_ECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine private keys via a timing attack and a lattice calculation (CVE-2011-1945). crypto/x509/x509_vfy.c in OpenSSL 1.0.x before 1.0.0e does not initialize certain structure members, which makes it easier for remote attackers to bypass CRL validation by using a nextUpdate value corresponding to a time in the past (CVE-2011-3207). The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8s and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages, which allows remote attackers to cause a denial of service (application crash) via out-of-order messages that violate the TLS protocol (CVE-2011-3210). Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more: http://store.mandriva.com/product_info.php?cPath=149&products_id=490 The updated packages have been patched to correct these issues. Affected: 2010.1, 2011. Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. http://www.securityspace.com/smysecure/catid.html?in=MDVSA-2011:137 Risk factor : High
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2011-1945 http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html CERT/CC vulnerability note: VU#536044 http://www.kb.cert.org/vuls/id/536044 Debian Security Information: DSA-2309 (Google Search) http://www.debian.org/security/2011/dsa-2309 http://www.mandriva.com/security/advisories?name=MDVSA-2011:136 http://www.mandriva.com/security/advisories?name=MDVSA-2011:137 http://eprint.iacr.org/2011/232.pdf http://secunia.com/advisories/44935 SuSE Security Announcement: SUSE-SU-2011:0636 (Google Search) https://hermes.opensuse.org/messages/8764170 SuSE Security Announcement: openSUSE-SU-2011:0634 (Google Search) https://hermes.opensuse.org/messages/8760466 Common Vulnerability Exposure (CVE) ID: CVE-2011-3207 http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065744.html http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065712.html http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html HPdes Security Advisory: HPSBMU02752 http://marc.info/?l=bugtraq&m=133226187115472&w=2 HPdes Security Advisory: SSRT100802 http://www.redhat.com/support/errata/RHSA-2011-1409.html http://www.securitytracker.com/id?1026012 http://secunia.com/advisories/45956 http://secunia.com/advisories/57353 Common Vulnerability Exposure (CVE) ID: CVE-2011-3210 HPdes Security Advisory: HPSBUX02734 http://marc.info/?l=bugtraq&m=132750648501816&w=2 HPdes Security Advisory: SSRT100729
Copyright	Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.