JVN Info.

Id
29016  
Name
JVNDB-2012-004723  
Title
Linux Kernel の sfc ドライバにおけるサービス運用妨害 (DoS) の脆弱性  
Summary
Linux Kernel の sfc ドライバには、サービス運用妨害 (DMA ディスクリプタ消費およびネットワークコントローラの停止) 状態となる脆弱性が存在します。  
Nvdinfo
CVE-2012-3412  
Cvssv2
7.8  
Jvnurl
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-004723.html  
Published Date
2012-09-19  
Registered Date
2012-10-04  
Last Updated Date
2012-11-09  

Actions

Related Nessuslogs

Id Log ID Jvninfo Id Plugin ID CVE CVSS Risk Host Protocol Port Name Synopsis Description Solution See Also Plugin Output Actions
18919 H28-MOJ-Teikyo-Nara-17-seg-1-20161128-w510.csv 29016 77200 CVE-2014-0076 9.3 High 172.30.201.61 tcp 443 OpenSSL "ChangeCipherSpec" MiTM Vulnerability The remote host is affected by a vulnerability that could allow sensitive data to be decrypted. The OpenSSL service on the remote host is vulnerable to a man-in-the-middle (MiTM) attack, based on its acceptance of a specially crafted handshake. This flaw could allow a MiTM attacker to decrypt or forge SSL messages by telling the service to begin encrypted communications before key material has been exchanged, which causes predictable keys to be used to secure future traffic. Note that Nessus has only tested for an SSL/TLS MiTM vulnerability (CVE-2014-0224). However, Nessus has inferred that the OpenSSL service on the remote host is also affected by six additional vulnerabilities that were disclosed in OpenSSL"s June 5th, 2014 security advisory : - An error exists in the "ssl3_read_bytes" function that permits data to be injected into other sessions or allows denial of service attacks. Note that this issue is exploitable only if SSL_MODE_RELEASE_BUFFERS is enabled. (CVE-2010-5298) - An error exists related to the implementation of the Elliptic Curve Digital Signature Algorithm (ECDSA) that allows nonce disclosure via the "FLUSH+RELOAD" cache side-channel attack. (CVE-2014-0076) - A buffer overflow error exists related to invalid DTLS fragment handling that permits the execution of arbitrary code or allows denial of service attacks. Note that this issue only affects OpenSSL when used as a DTLS client or server. (CVE-2014-0195) - An error exists in the "do_ssl3_write" function that permits a NULL pointer to be dereferenced, which could allow denial of service attacks. Note that this issue is exploitable only if SSL_MODE_RELEASE_BUFFERS is enabled. (CVE-2014-0198) - An error exists related to DTLS handshake handling that could allow denial of service attacks. Note that this issue only affects OpenSSL when used as a DTLS client. (CVE-2014-0221) - An error exists in the "dtls1_get_message_fragment" function related to anonymous ECDH cipher suites. This could allow denial of service attacks. Note that this issue only affects OpenSSL TLS clients. (CVE-2014-3470) OpenSSL did not release individual patches for these vulnerabilities, instead they were all patched under a single version release. Note that the service will remain vulnerable after patching until the service or host is restarted. OpenSSL 0.9.8 SSL/TLS users (client and/or server) should upgrade to 0.9.8za. OpenSSL 1.0.0 SSL/TLS users (client and/or server) should upgrade to 1.0.0m. OpenSSL 1.0.1 SSL/TLS users (client and/or server) should upgrade to 1.0.1h. http://www.nessus.org/u?d5709faa https://www.imperialviolet.org/2014/06/05/earlyccs.html https://www.openssl.org/news/secadv/20140605.txt The remote service on port 443 accepted an early ChangeCipherSpec message, which caused the MAC and encryption keys to be derived entirely from public information. The entire SSL handshake was completed, with the server accepting and producing messages encrypted and authenticated using these weak keys.
45551 H28-MOJ-Teikyo-Yokohama-18-seg-02-21161121-abe_vilnov.csv 29016 77200 CVE-2014-0076 9.3 High 172.30.138.61 tcp 443 OpenSSL "ChangeCipherSpec" MiTM Vulnerability The remote host is affected by a vulnerability that could allow sensitive data to be decrypted. The OpenSSL service on the remote host is vulnerable to a man-in-the-middle (MiTM) attack, based on its acceptance of a specially crafted handshake. This flaw could allow a MiTM attacker to decrypt or forge SSL messages by telling the service to begin encrypted communications before key material has been exchanged, which causes predictable keys to be used to secure future traffic. Note that Nessus has only tested for an SSL/TLS MiTM vulnerability (CVE-2014-0224). However, Nessus has inferred that the OpenSSL service on the remote host is also affected by six additional vulnerabilities that were disclosed in OpenSSL"s June 5th, 2014 security advisory : - An error exists in the "ssl3_read_bytes" function that permits data to be injected into other sessions or allows denial of service attacks. Note that this issue is exploitable only if SSL_MODE_RELEASE_BUFFERS is enabled. (CVE-2010-5298) - An error exists related to the implementation of the Elliptic Curve Digital Signature Algorithm (ECDSA) that allows nonce disclosure via the "FLUSH+RELOAD" cache side-channel attack. (CVE-2014-0076) - A buffer overflow error exists related to invalid DTLS fragment handling that permits the execution of arbitrary code or allows denial of service attacks. Note that this issue only affects OpenSSL when used as a DTLS client or server. (CVE-2014-0195) - An error exists in the "do_ssl3_write" function that permits a NULL pointer to be dereferenced, which could allow denial of service attacks. Note that this issue is exploitable only if SSL_MODE_RELEASE_BUFFERS is enabled. (CVE-2014-0198) - An error exists related to DTLS handshake handling that could allow denial of service attacks. Note that this issue only affects OpenSSL when used as a DTLS client. (CVE-2014-0221) - An error exists in the "dtls1_get_message_fragment" function related to anonymous ECDH cipher suites. This could allow denial of service attacks. Note that this issue only affects OpenSSL TLS clients. (CVE-2014-3470) OpenSSL did not release individual patches for these vulnerabilities, instead they were all patched under a single version release. Note that the service will remain vulnerable after patching until the service or host is restarted. OpenSSL 0.9.8 SSL/TLS users (client and/or server) should upgrade to 0.9.8za. OpenSSL 1.0.0 SSL/TLS users (client and/or server) should upgrade to 1.0.0m. OpenSSL 1.0.1 SSL/TLS users (client and/or server) should upgrade to 1.0.1h. http://www.nessus.org/u?d5709faa https://www.imperialviolet.org/2014/06/05/earlyccs.html https://www.openssl.org/news/secadv/20140605.txt The remote service on port 443 accepted an early ChangeCipherSpec message, which caused the MAC and encryption keys to be derived entirely from public information. The entire SSL handshake was completed, with the server accepting and producing messages encrypted and authenticated using these weak keys.
54480 1_Tokyu_remi_20170126.csv 29016 77200 CVE-2014-0076 9.3 High 54.199.215.149 tcp 443 OpenSSL "ChangeCipherSpec" MiTM Vulnerability The remote host is affected by a vulnerability that could allow sensitive data to be decrypted. The OpenSSL service on the remote host is vulnerable to a man-in-the-middle (MiTM) attack, based on its acceptance of a specially crafted handshake. This flaw could allow a MiTM attacker to decrypt or forge SSL messages by telling the service to begin encrypted communications before key material has been exchanged, which causes predictable keys to be used to secure future traffic. Note that Nessus has only tested for an SSL/TLS MiTM vulnerability (CVE-2014-0224). However, Nessus has inferred that the OpenSSL service on the remote host is also affected by six additional vulnerabilities that were disclosed in OpenSSL"s June 5th, 2014 security advisory : - An error exists in the "ssl3_read_bytes" function that permits data to be injected into other sessions or allows denial of service attacks. Note that this issue is exploitable only if SSL_MODE_RELEASE_BUFFERS is enabled. (CVE-2010-5298) - An error exists related to the implementation of the Elliptic Curve Digital Signature Algorithm (ECDSA) that allows nonce disclosure via the "FLUSH+RELOAD" cache side-channel attack. (CVE-2014-0076) - A buffer overflow error exists related to invalid DTLS fragment handling that permits the execution of arbitrary code or allows denial of service attacks. Note that this issue only affects OpenSSL when used as a DTLS client or server. (CVE-2014-0195) - An error exists in the "do_ssl3_write" function that permits a NULL pointer to be dereferenced, which could allow denial of service attacks. Note that this issue is exploitable only if SSL_MODE_RELEASE_BUFFERS is enabled. (CVE-2014-0198) - An error exists related to DTLS handshake handling that could allow denial of service attacks. Note that this issue only affects OpenSSL when used as a DTLS client. (CVE-2014-0221) - An error exists in the "dtls1_get_message_fragment" function related to anonymous ECDH cipher suites. This could allow denial of service attacks. Note that this issue only affects OpenSSL TLS clients. (CVE-2014-3470) OpenSSL did not release individual patches for these vulnerabilities, instead they were all patched under a single version release. Note that the service will remain vulnerable after patching until the service or host is restarted. OpenSSL 0.9.8 SSL/TLS users (client and/or server) should upgrade to 0.9.8za. OpenSSL 1.0.0 SSL/TLS users (client and/or server) should upgrade to 1.0.0m. OpenSSL 1.0.1 SSL/TLS users (client and/or server) should upgrade to 1.0.1h. http://www.nessus.org/u?d5709faa https://www.imperialviolet.org/2014/06/05/earlyccs.html https://www.openssl.org/news/secadv/20140605.txt The remote service on port 443 accepted an early ChangeCipherSpec message, which caused the MAC and encryption keys to be derived entirely from public information. The entire SSL handshake was completed, with the server accepting and producing messages encrypted and authenticated using these weak keys.