CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
AI Score
Confidence
High
EPSS
Percentile
96.7%
The version of OpenSSL installed on the remote host is prior to 1.0.0a. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.0a advisory.
RSA verification recovery in the EVP_PKEY_verify_recover function in OpenSSL 1.x before 1.0.0a, as used by pkeyutl and possibly other applications, returns uninitialized memory upon failure, which might allow context-dependent attackers to bypass intended key requirements or obtain sensitive information via unspecified vectors. NOTE: some of these details are obtained from third party information.
(CVE-2010-1633)
The Cryptographic Message Syntax (CMS) implementation in crypto/cms/cms_asn1.c in OpenSSL before 0.9.8o and 1.x before 1.0.0a does not properly handle structures that contain OriginatorInfo, which allows context-dependent attackers to modify invalid memory locations or conduct double-free attacks, and possibly execute arbitrary code, via unspecified vectors. (CVE-2010-0742)
Note that Nessus has not tested for these issues but has instead relied only on the applicationโs self-reported version number.
#
# (C) Tenable Network Security, Inc.
#
include('compat.inc');
if (description)
{
script_id(46801);
script_version("1.11");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/06/07");
script_cve_id("CVE-2010-0742", "CVE-2010-1633");
script_bugtraq_id(40502, 40503);
script_xref(name:"Secunia", value:"40024");
script_name(english:"OpenSSL 1.0.0 < 1.0.0a Multiple Vulnerabilities");
script_set_attribute(attribute:"synopsis", value:
"The remote service is affected by multiple vulnerabilities.");
script_set_attribute(attribute:"description", value:
"The version of OpenSSL installed on the remote host is prior to 1.0.0a. It is, therefore, affected by multiple
vulnerabilities as referenced in the 1.0.0a advisory.
- RSA verification recovery in the EVP_PKEY_verify_recover function in OpenSSL 1.x before 1.0.0a, as used by
pkeyutl and possibly other applications, returns uninitialized memory upon failure, which might allow
context-dependent attackers to bypass intended key requirements or obtain sensitive information via
unspecified vectors. NOTE: some of these details are obtained from third party information.
(CVE-2010-1633)
- The Cryptographic Message Syntax (CMS) implementation in crypto/cms/cms_asn1.c in OpenSSL before 0.9.8o
and 1.x before 1.0.0a does not properly handle structures that contain OriginatorInfo, which allows
context-dependent attackers to modify invalid memory locations or conduct double-free attacks, and
possibly execute arbitrary code, via unspecified vectors. (CVE-2010-0742)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2010-0742");
script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2010-1633");
script_set_attribute(attribute:"see_also", value:"https://www.openssl.org/news/secadv/20100601.txt");
script_set_attribute(attribute:"solution", value:
"Upgrade to OpenSSL version 1.0.0a or later.");
script_set_attribute(attribute:"agent", value:"all");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2010-0742");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"vuln_publication_date", value:"2010/06/01");
script_set_attribute(attribute:"patch_publication_date", value:"2010/06/01");
script_set_attribute(attribute:"plugin_publication_date", value:"2010/06/03");
script_set_attribute(attribute:"plugin_type", value:"combined");
script_set_attribute(attribute:"cpe", value:"cpe:/a:openssl:openssl");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Web Servers");
script_copyright(english:"This script is Copyright (C) 2010-2024 Tenable Network Security, Inc.");
script_dependencies("openssl_nix_installed.nbin", "openssl_version.nasl", "openssl_win_installed.nbin");
script_require_keys("installed_sw/OpenSSL");
exit(0);
}
include('vcf.inc');
include('vcf_extras_openssl.inc');
var app_info = vcf::combined_get_app_info(app:'OpenSSL');
vcf::check_all_backporting(app_info:app_info);
var constraints = [
{ 'min_version' : '1.0.0', 'fixed_version' : '1.0.0a' }
];
vcf::openssl::check_version_and_report(
app_info:app_info,
constraints:constraints,
severity:SECURITY_HOLE
);