Π›ΠΎΠ³ΠΎΡ‚ΠΈΠΏ exploitDog
Консоль
Π›ΠΎΠ³ΠΎΡ‚ΠΈΠΏ exploitDog

exploitDog

fstec Π»ΠΎΠ³ΠΎΡ‚ΠΈΠΏ

BDU:2016-00896

ΠžΠΏΡƒΠ±Π»ΠΈΠΊΠΎΠ²Π°Π½ΠΎ: 15 Ρ„Π΅Π². 2016
Π˜ΡΡ‚ΠΎΡ‡Π½ΠΈΠΊ: fstec
CVSS2: 4.3
EPSS Π‘Ρ€Π΅Π΄Π½ΠΈΠΉ

ОписаниС

Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡ‚ΡŒ Ρ„ΡƒΠ½ΠΊΡ†ΠΈΠΈ ssl/s2_srvr.c Π±ΠΈΠ±Π»ΠΈΠΎΡ‚Π΅ΠΊΠΈ OpenSSL связана с ошибками криптографичСских ΠΏΡ€Π΅ΠΎΠ±Ρ€Π°Π·ΠΎΠ²Π°Π½ΠΈΠΉ. Эксплуатация уязвимости ΠΌΠΎΠΆΠ΅Ρ‚ ΠΏΠΎΠ·Π²ΠΎΠ»ΠΈΡ‚ΡŒ Π½Π°Ρ€ΡƒΡˆΠΈΡ‚Π΅Π»ΡŽ, Π΄Π΅ΠΉΡΡ‚Π²ΡƒΡŽΡ‰Π΅ΠΌΡƒ ΡƒΠ΄Π°Π»Ρ‘Π½Π½ΠΎ, Π²Π·Π»ΠΎΠΌΠ°Ρ‚ΡŒ криптографичСский ΠΌΠ΅Ρ…Π°Π½ΠΈΠ·ΠΌ Π·Π°Ρ‰ΠΈΡ‚Ρ‹ ΠΏΡ€ΠΈ ΠΏΠΎΠΌΠΎΡ‰ΠΈ выполнСния вычислСний ΠΏΠΎ SSLv2-Ρ‚Ρ€Π°Ρ„ΠΈΠΊΡƒ, связанному с функциями get_client_master_key ΠΈ get_client_hello

Π’Π΅Π½Π΄ΠΎΡ€

OpenSSL Software Foundation

НаимСнованиС ПО

OpenSSL

ВСрсия ПО

ΠΎΡ‚ 1.0.2 Π΄ΠΎ 1.0.2f (OpenSSL)
ΠΎΡ‚ 1.0.1 Π΄ΠΎ 1.0.1r (OpenSSL)

Вип ПО

ΠŸΡ€ΠΎΠ³Ρ€Π°ΠΌΠΌΠ½ΠΎΠ΅ срСдство Π·Π°Ρ‰ΠΈΡ‚Ρ‹

ΠžΠΏΠ΅Ρ€Π°Ρ†ΠΈΠΎΠ½Π½Ρ‹Π΅ систСмы ΠΈ Π°ΠΏΠΏΠ°Ρ€Π°Ρ‚Π½Ρ‹Π΅ ΠΏΠ»Π°Ρ‚Ρ„ΠΎΡ€ΠΌΡ‹

БообщСство свободного ΠΏΡ€ΠΎΠ³Ρ€Π°ΠΌΠΌΠ½ΠΎΠ³ΠΎ обСспСчСния Linux .
БообщСство свободного ΠΏΡ€ΠΎΠ³Ρ€Π°ΠΌΠΌΠ½ΠΎΠ³ΠΎ обСспСчСния Linux .
Apple Inc. MacOS 10
БообщСство свободного ΠΏΡ€ΠΎΠ³Ρ€Π°ΠΌΠΌΠ½ΠΎΠ³ΠΎ обСспСчСния Linux .
Microsoft Corp Windows -
Microsoft Corp Windows -
Apple Inc. MacOS 10
Apple Inc. MacOS 10
IBM Corp. IBM i .
FreeBSD Project FreeBSD .
FreeBSD Project FreeBSD .
FreeBSD Project FreeBSD .
OpenBSD Project OpenBSD .
OpenBSD Project OpenBSD .
HP Inc. OpenVMS .
HP Inc. OpenVMS .
HP Inc. OpenVMS .

Π£Ρ€ΠΎΠ²Π΅Π½ΡŒ опасности уязвимости

Π‘Ρ€Π΅Π΄Π½ΠΈΠΉ ΡƒΡ€ΠΎΠ²Π΅Π½ΡŒ опасности (базовая ΠΎΡ†Π΅Π½ΠΊΠ° CVSS 2.0 составляСт 4,3)

Π’ΠΎΠ·ΠΌΠΎΠΆΠ½Ρ‹Π΅ ΠΌΠ΅Ρ€Ρ‹ ΠΏΠΎ ΡƒΡΡ‚Ρ€Π°Π½Π΅Π½ΠΈΡŽ уязвимости

ОбновлСниС ΠΏΡ€ΠΎΠ³Ρ€Π°ΠΌΠΌΠ½ΠΎΠ³ΠΎ срСдства Π΄ΠΎ вСрсии 1.0.1r, 1.0.2f ΠΈΠ»ΠΈ Π½ΠΎΠ²Π΅Π΅

Бтатус уязвимости

ΠŸΠΎΠ΄Ρ‚Π²Π΅Ρ€ΠΆΠ΄Π΅Π½Π° ΠΏΡ€ΠΎΠΈΠ·Π²ΠΎΠ΄ΠΈΡ‚Π΅Π»Π΅ΠΌ

НаличиС эксплойта

Π”Π°Π½Π½Ρ‹Π΅ ΡƒΡ‚ΠΎΡ‡Π½ΡΡŽΡ‚ΡΡ

Π˜Π½Ρ„ΠΎΡ€ΠΌΠ°Ρ†ΠΈΡ ΠΎΠ± устранСнии

Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡ‚ΡŒ устранСна

Π˜Π΄Π΅Π½Ρ‚ΠΈΡ„ΠΈΠΊΠ°Ρ‚ΠΎΡ€Ρ‹ Π΄Ρ€ΡƒΠ³ΠΈΡ… систСм описаний уязвимостСй

EPSS

ΠŸΡ€ΠΎΡ†Π΅Π½Ρ‚ΠΈΠ»ΡŒ: 96%
0.21948
Π‘Ρ€Π΅Π΄Π½ΠΈΠΉ

4.3 Medium

CVSS2

БвязанныС уязвимости

CVSS3: 5.9
ubuntu
ΠΎΠΊΠΎΠ»ΠΎ 10 Π»Π΅Ρ‚ Π½Π°Π·Π°Π΄

ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.

redhat
ΠΎΠΊΠΎΠ»ΠΎ 10 Π»Π΅Ρ‚ Π½Π°Π·Π°Π΄

ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.

CVSS3: 5.9
nvd
ΠΎΠΊΠΎΠ»ΠΎ 10 Π»Π΅Ρ‚ Π½Π°Π·Π°Π΄

ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.

CVSS3: 5.9
debian
ΠΎΠΊΠΎΠ»ΠΎ 10 Π»Π΅Ρ‚ Π½Π°Π·Π°Π΄

ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f d ...

CVSS3: 5.9
github
ΠΏΠΎΡ‡Ρ‚ΠΈ 4 Π³ΠΎΠ΄Π° Π½Π°Π·Π°Π΄

ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.

EPSS

ΠŸΡ€ΠΎΡ†Π΅Π½Ρ‚ΠΈΠ»ΡŒ: 96%
0.21948
Π‘Ρ€Π΅Π΄Π½ΠΈΠΉ

4.3 Medium

CVSS2

Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡ‚ΡŒ BDU:2016-00896