PT-2012-1110 · Openssl+4 · Openssl+4
Publicado
2012-01-04
·
Atualizado
2017-08-29
·
CVE-2011-4109
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
OpenSSL versions 0.9.8 through 0.9.8s
OpenSSL versions prior to 1.0.0g
Description
The issue allows remote attackers to have an unspecified impact by triggering failure of a policy check when X509 V FLAG POLICY CHECK is enabled. Multiple vulnerabilities in the OpenSSL package can lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely, potentially allowing an attacker to cause a denial of service or access encrypted data without knowledge of the encryption key.
Recommendations
For OpenSSL versions 0.9.8 through 0.9.8s, update to version 0.9.8s or later.
For OpenSSL versions prior to 1.0.0g, update to version 1.0.0g or later.
As a temporary workaround, consider disabling the X509 V FLAG POLICY CHECK flag until a patch is available. Restrict access to sensitive data and encrypted information to minimize the risk of exploitation.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Hp-Ux
Ibm Aix
Openssl
Red Hat
Suse