The version of HP Smart Update manager running on the remote host is prior to 6.4.1. It is, therefore, affected by the following vulnerabilities :

  - An error exists in the function 'ssl3_read_bytes' that     can allow data to be injected into other sessions or     allow denial of service attacks. Note that this issue is     exploitable only if 'SSL_MODE_RELEASE_BUFFERS' is     enabled. (CVE-2010-5298)

  - A buffer overflow error exists related to invalid DTLS     fragment handling that can lead to the execution of     arbitrary code. Note that this issue only affects     OpenSSL when used as a DTLS client or server.
    (CVE-2014-0195)

  - An error exists in the function 'do_ssl3_write' that     can allow a NULL pointer to be dereferenced leading to     denial of service attacks. Note that this issue is     exploitable only if 'SSL_MODE_RELEASE_BUFFERS' is     enabled. (CVE-2014-0198)

  - An error exists related to DTLS handshake handling that     can lead to denial of service attacks. Note that this     issue only affects OpenSSL when used as a DTLS client.
    (CVE-2014-0221)

  - An unspecified error exists in how ChangeCipherSpec     messages are processed that can allow an attacker to     cause usage of weak keying material, leading to     simplified man-in-the-middle attacks. (CVE-2014-0224)

  - An unspecified flaw exists that allows a local attacker     to disclose sensitive information. Note that if the host     OS is Linux based, only versions 6.2.0, 6.3.0, 6.3.1,     and 6.4.0 suffer from this flaw. (CVE-2014-2608)

  - An unspecified error exists related to anonymous ECDH     cipher suites that can allow denial of service attacks.
    Note that this issue only affects OpenSSL TLS clients.
    (CVE-2014-3470)

The remote host is affected by the vulnerability described in GLSA-201407-05 (OpenSSL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenSSL. Please review       the OpenSSL Security Advisory [05 Jun 2014] and the CVE identifiers       referenced below for details.
  Impact :

    A remote attacker could send specially crafted DTLS fragments to an       OpenSSL DTLS client or server to possibly execute arbitrary code with the       privileges of the process using OpenSSL.
    Furthermore, an attacker could force the use of weak keying material in       OpenSSL SSL/TLS clients and servers, inject data across sessions, or       cause a Denial of Service via various vectors.
  Workaround :

    There is no known workaround at this time.

The version of VMware vCenter Converter installed on the remote Windows host is version 5.1.x prior to 5.1.1 or 5.5.x prior to 5.5.2.
It is, therefore, affected by multiple vulnerabilities in the bundled OpenSSL library :

  - An error exists in the function 'ssl3_read_bytes'     that could allow data to be injected into other     sessions or allow denial of service attacks. Note     this issue is only exploitable if     'SSL_MODE_RELEASE_BUFFERS' is enabled. (CVE-2010-5298)

  - A buffer overflow error exists related to invalid DTLS     fragment handling that could lead to execution of     arbitrary code. Note this issue only affects OpenSSL     when used as a DTLS client or server. (CVE-2014-0195)

  - An error exists in the function 'do_ssl3_write' that     could allow a NULL pointer to be dereferenced leading     to denial of service attacks. Note this issue is     exploitable only if 'SSL_MODE_RELEASE_BUFFERS' is     enabled. (CVE-2014-0198)

  - An error exists related to DTLS handshake handling that     could lead to denial of service attacks. Note this     issue only affects OpenSSL when used as a DTLS client.
    (CVE-2014-0221)

  - An unspecified error exists that could allow an     attacker to cause usage of weak keying material     leading to simplified man-in-the-middle attacks.
    (CVE-2014-0224)

  - An unspecified error exists related to anonymous ECDH     cipher suites that could allow denial of service     attacks. Note this issue only affects OpenSSL TLS     clients. (CVE-2014-3470)

The version of Cerberus FTP Server on the remote host is version 6.x prior to 6.0.10.0 or version 7.x prior to 7.0.0.3. It is, therefore, affected by the following OpenSSL vulnerabilities :

  - An error exists in the 'ssl3_read_bytes' function     that permits data to be injected into other sessions     or allows denial of service attacks. Note that this     issue is exploitable only if SSL_MODE_RELEASE_BUFFERS     is enabled. (CVE-2010-5298)

  - A buffer overflow error exists related to invalid DTLS     fragment handling that permits the execution of     arbitrary code or allows denial of service attacks.
    Note that this issue only affects OpenSSL when used     as a DTLS client or server. (CVE-2014-0195)

  - An error exists in the 'do_ssl3_write' function that     permits a NULL pointer to be dereferenced, which could     allow denial of service attacks. Note that this issue     is exploitable only if SSL_MODE_RELEASE_BUFFERS is     enabled. (CVE-2014-0198)

  - An error exists related to DTLS handshake handling that     could allow denial of service attacks. Note that this     issue only affects OpenSSL when used as a DTLS client.
    (CVE-2014-0221)

  - An error exists in the processing of ChangeCipherSpec     messages that allows the usage of weak keying material.
    This permits simplified man-in-the-middle attacks to be     done. (CVE-2014-0224)

  - An error exists in the 'dtls1_get_message_fragment'     function related to anonymous ECDH cipher suites. This     could allow denial of service attacks. Note that this     issue only affects OpenSSL TLS clients. (CVE-2014-3470)

ID	名稱	產品	系列	已發布	已更新	嚴重性
76769	HP Smart Update Manager 6.x < 6.4.1 Multiple Vulnerabilities	Nessus	CGI abuses	2014/7/24	2021/1/19	medium
76864	GLSA-201407-05 : OpenSSL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2014/7/28	2021/1/6	high
76947	VMware vCenter Converter Multiple Vulnerabilities (VMSA-2014-0006)	Nessus	Windows	2014/7/31	2019/11/25	medium
77004	Cerberus FTP Server 6.x < 6.0.10.0 / 7.x < 7.0.0.3 Multiple OpenSSL Vulnerabilities	Nessus	FTP	2014/8/5	2020/10/16	medium

偵測

搜尋 Plugin

medium

high

medium

medium