Summary
The remote host is missing an update to libnasl
announced via advisory MDVSA-2009:271.
Solution
To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.
https://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:271
Insight
A vulnerability has been found and corrected in libnasl:
nasl/nasl_crypto2.c in the Nessus Attack Scripting Language library (aka libnasl) 2.2.11 does not properly check the return value from the OpenSSL DSA_do_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077 (CVE-2009-0125).
This update fixes this vulnerability.
Affected: Corporate 4.0
Severity
Classification
-
CVE CVE-2008-5077, CVE-2009-0125 -
CVSS Base Score: 5.8
AV:N/AC:M/Au:N/C:N/I:P/A:P
Related Vulnerabilities