Summary
The remote host is missing an update to openssl
announced via advisory MDVSA-2009:237.
Solution
To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.
https://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:237
Insight
Multiple vulnerabilities was discovered and corrected in openssl:
ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello (CVE-2009-1386).
The NSS library library before 3.12.3, as used in Firefox GnuTLS
before 2.6.4 and 2.7.4
OpenSSL 0.9.8 through 0.9.8k
and other
products support MD2 with X.509 certificates, which might allow remote attackers to spooof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE:
the scope of this issue is currently limited because the amount of computation required is still large (CVE-2009-2409).
This update provides a solution to these vulnerabilities.
Affected: Corporate 3.0, Corporate 4.0, Multi Network Firewall 2.0
Severity
Classification
-
CVE CVE-2009-1386, CVE-2009-2409 -
CVSS Base Score: 5.1
AV:N/AC:H/Au:N/C:P/I:P/A:P
Related Vulnerabilities