Summary
The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-05:21.openssl.asc
Solution
Upgrade your system to the appropriate stable release or security branch dated after the correction date
https://secure1.securityspace.com/smysecure/catid.html?in=FreeBSD-SA-05:21.openssl.asc
Insight
The OpenSSL library implements the Secure Sockets Layer and Transport Layer Security protocols, as well as providing a large number of basic cryptographic functions.
The Secure Sockets Layer protocol exists in two versions and includes a mechanism for negotiating the protocol version to be used. If the protocol is executed correctly, it is impossible for a client and server both capable of the newer version of the protocol (SSLv3) to end up using the older version of the protocol (SSLv2).
In order to provide bug-for-bug compatibility with Microsoft Internet Explorer 3.02, a verification step required by the Secure Sockets Layer protocol can be disabled by using the SSL_OP_MSIE_SSLV2_RSA_PADDING option in OpenSSL. This option is implied by the frequently-used SSL_OP_ALL option.
Severity
Classification
-
CVE CVE-2005-2969 -
CVSS Base Score: 5.0
AV:N/AC:L/Au:N/C:N/I:P/A:N
Related Vulnerabilities