Vulnerability Assessment & Network Security Forums
If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important. If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery.
Vulnerability Assessment Details
Check for the version of the openssl packages
Detailed Explanation for this Vulnerability Assessment
Updated OpenSSL packages that fix a remote denial of service vulnerability
are now available for Red Hat Enterprise Linux 2.1.
OpenSSL is a toolkit that implements Secure Sockets Layer (SSL v2/v3) and
Transport Layer Security (TLS v1) protocols as well as a full-strength
general purpose cryptography library.
Testing performed by the OpenSSL group using the Codenomicon TLS Test Tool
uncovered a bug in older versions of OpenSSL 0.9.6 prior to 0.9.6d that can
lead to a denial of service attack (infinite loop). The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CVE-2004-0081 to this issue.
Testing performed by Novell using a test suite provided by NISCC uncovered
an issue in the ASN.1 parser in versions of OpenSSL 0.9.6 prior to 0.9.6l
which could cause large recursion and possibly lead to a denial of service
attack if used where stack space is limited. The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0851
to this issue.
These updated packages contain patches provided by the OpenSSL group that
protect against these issues.
NOTE: Because server applications are affected by this issue, users are
advised to either restart all services using OpenSSL functionality or
restart their system after installing these updated packages.
Solution : http://rhn.redhat.com/errata/RHSA-2004-119.html
Network Security Threat Level: High
Networks Security ID:
Vulnerability Assessment Copyright: This script is Copyright (C) 2004 Tenable Network Security
|#USED# Cisco WS-C3750X-12S-S Switch 12 Port GE SFP IP Base
|Cisco Catalyst 2960-X Series WS-C2960X-48FPD-L *No AC*
|CISCO WS-C3750X-48P-S Catalyst 3750X 48 Port PoE IP Base SWITCH
|#NOB# Cisco WS-C3750X-24P-E Switch 24 Port PoE IP Services 10/100/1000
No Discussions have been posted on this vulnerability.