CVE-2004-0079, a remote crasher, was originally believed to only affect versions of OpenSSL after 0.9.6b verified with Codenomicon test suite (see pkt539.c). However we've had a customer report that this affects 0.9.6b via a different reproducer. This therefore affects the openssl096b compat packages as shipped with FC-3.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is missing Security Update 2003-12-19.

This security update includes the following components :

 - AFP Server
 - cd9600.util
 - Directory Services
 - fetchmail
 - fs_usage
 - rsync
 - System Initialization

For MacOS X 10.3, it also includes :

 - ASN.1 Decoding for PKI

This update contains various fixes which may allow an attacker to execute arbitrary code on the remote host.

遠端主機上安裝的 OpenSSL 為 0.9.6l 之前版本。因此，它會受到 0.9.6l 公告中提及的一個弱點影響。

  - OpenSSL 0.9.6k 允許遠端攻擊者透過格式錯誤的 ASN.1 序列，來造成拒絕服務 (透過大型遞回造成當機)。(CVE-2003-0851)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程主机上安装的 OpenSSL 版本低于 0.9.6l。因此，该应用程序受到 0.9.6l 公告中提及的漏洞的影响。

  - OpenSSL 0.9.6k 允许远程攻击者通过畸形 ASN.1 序列造成拒绝服务（通过大型递归导致崩溃）。(CVE-2003-0851)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

リモートホストにインストールされている OpenSSL は、0.9.6l より前のバージョンです。したがって、0.9.6l のアドバイザリに記載されている脆弱性の影響を受けます。

  - OpenSSL 0.9.6k では、リモートの攻撃者が、無効な形式の ASN.1 シーケンスを介して、サービス拒否 (大きな再帰によるクラッシュ) を引き起こす可能性があります。(CVE-2003-0851)

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The version of OpenSSL installed on the remote host is prior to 0.9.6l. It is, therefore, affected by a vulnerability as referenced in the 0.9.6l advisory.

  - OpenSSL 0.9.6k allows remote attackers to cause a denial of service (crash via large recursion) via     malformed ASN.1 sequences. (CVE-2003-0851)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated OpenSSL packages that fix a remote denial of service vulnerability are now available for Red Hat Enterprise Linux 2.1.

OpenSSL is a toolkit that implements Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library.

Testing performed by the OpenSSL group using the Codenomicon TLS Test Tool uncovered a bug in older versions of OpenSSL 0.9.6 prior to 0.9.6d that can lead to a denial of service attack (infinite loop).
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0081 to this issue.

Testing performed by Novell using a test suite provided by NISCC uncovered an issue in the ASN.1 parser in versions of OpenSSL 0.9.6 prior to 0.9.6l which could cause large recursion and possibly lead to a denial of service attack if used where stack space is limited. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0851 to this issue.

These updated packages contain patches provided by the OpenSSL group that protect against these issues.

NOTE: Because server applications are affected by this issue, users are advised to either restart all services using OpenSSL functionality or restart their system after installing these updated packages.

The remote host is using a version of OpenSSL that is older than 0.9.6m or 0.9.7d  There are several vulnerabilities in this version of OpenSSL that may allow an attacker to cause a denial of service against the remote host.

ID	名稱	產品	系列	已發布	已更新	嚴重性
20114	Fedora Core 3 : openssl096b-0.9.6b-21.42 (2005-1042)	Nessus	Fedora Local Security Checks	2005/11/2	2021/1/11	medium
12516	Mac OS X Multiple Vulnerabilities (Security Update 2003-12-19)	Nessus	MacOS X Local Security Checks	2004/7/6	2024/5/28	critical
17749	OpenSSL 0.9.6k < 0.9.6l 弱點	Nessus	Web Servers	2012/1/4	2024/6/7	high
17749	OpenSSL 0.9.6k < 0.9.6l 漏洞	Nessus	Web Servers	2012/1/4	2024/6/7	high
17749	OpenSSL 0.9.6k < 0.9.6l の脆弱性	Nessus	Web Servers	2012/1/4	2024/6/7	high
17749	OpenSSL 0.9.6k < 0.9.6l Vulnerability	Nessus	Web Servers	2012/1/4	2024/6/7	high
12479	RHEL 2.1 : openssl (RHSA-2004:119)	Nessus	Red Hat Local Security Checks	2004/7/6	2021/1/14	medium
2183	OpenSSL < 0.9.6m / 0.9.7d Multiple DoS	Nessus Network Monitor	Web Servers	2004/8/30	2019/3/6	medium
801058	OpenSSL < 0.9.6m / 0.9.7d Multiple DoS	Log Correlation Engine	Web Servers			medium

偵測

搜尋 Plugin

medium

critical

high

high

high

high

medium

medium

medium