|
Vulnerability Assessment & Network Security Forums |
|||||||||
If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important. If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery. Home >> Browse Vulnerability Assessment Database >> Mandrake Local Security Checks >> MDKSA-2003:035: openssl Vulnerability Assessment Details
|
MDKSA-2003:035: openssl |
||
Check for the version of the openssl package Detailed Explanation for this Vulnerability Assessment The remote host is missing the patch for the advisory MDKSA-2003:035 (openssl). Researchers discovered a timing-based attack on RSA keys that OpenSSL is generally vulnerable to, unless RSA blinding is enabled. Patches from the OpenSSL team have been applied to turn RSA blinding on by default. An extension of the 'Bleichenbacher attack' on RSA with PKS #1 v1.5 padding as used in SSL 3.0 and TSL 1.0 was also created by Czech cryptologists Vlastimil Klima, Ondrej Pokorny, and Tomas Rosa. This attack requires the attacker to open millions of SSL/TLS connections to the server they are attacking. This is done because the server's behaviour when faced with specially crafted RSA ciphertexts can reveal information that would in effect permit the attacker to perform a single RSA private key operation on a ciphertext of their choice, using the server's RSA key. Despite this, the server's RSA key is not compromised at any time. Patches from the OpenSSL team modify SSL/TLS server behaviour to avoid this vulnerability. Solution : http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2003:035 Network Security Threat Level: High Networks Security ID: 7101, 7148 Vulnerability Assessment Copyright: This script is Copyright (C) 2004 Tenable Network Security |
||
Cables, Connectors |
DELL PowerEdge R730XD 24x 2.5" Server Dual 750W Dual Heatsink - BareBones TESTED
$299.99
Dell PowerEdge R630 8SFF 2.6Ghz 20-Core 128GB Mem 2x10G+2x1G NIC 2x750W PSU
$399.04
Dell Poweredge R640 Server | 2x Xeon Gold 6132 | 128GB | H730P | 8x HDD Trays
$1849.00
Supermicro 4U 36 Bay Storage Server 2.4Ghz 8-C 128GB 1x1280W Rails TrueNAS ZFS
$712.98
Intel Xeon E5-2697A V4 2.6GHz CPU Processor 16-Core Socket LGA2011 SR2K1
$39.99
Intel Xeon Gold 6140 SR3AX 2.3GHz 18-Core Processor CPU
$39.99
SR1XP Intel Xeon E5-2680 v3 12 Core 30MB 2.5GHz LGA 2011-3 A Grade Processor
$4.79
Intel Xeon E5-2699v4 SR2JS 2.2GHz 22-Core 55MB 145W Server Processor CPU
$144.95
HP Workstation Z640 2x Xeon E5-2623V4 32GB Ram Dual 256GB SSD K420 Linux GA
$234.98
Lenovo Thinkstation P510 E5-1620 V4 16GB RAM 512GB SSD DVD Quadro M2000 W10 Pro
$164.95
|
||
No Discussions have been posted on this vulnerability. |