JVN Info.

Id
31659  
Name
JVNDB-2011-001899  
Title
Microsoft Windows Vista および Windows 7 の Bluetooth Stack における任意のコードを実行される脆弱性  
Summary
Microsoft Windows Vista および Windows 7 の Bluetooth Stack は、(1) 適切に初期化されなかった、または (2) 既に削除されているメモリ内のオブジェクトへのアクセスを防止しないため、任意のコードを実行される脆弱性が存在します。  
Nvdinfo
CVE-2011-1265  
Cvssv2
10  
Jvnurl
http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-001899.html  
Published Date
2011-07-12  
Registered Date
2011-07-21  
Last Updated Date
2011-07-21  

Actions

Related Nessuslogs

Id Log ID Jvninfo Id Plugin ID CVE CVSS Risk Host Protocol Port Name Synopsis Description Solution See Also Plugin Output Actions
18924 H28-MOJ-Teikyo-Nara-17-seg-1-20161128-w510.csv 31659 77200 CVE-2014-3470 9.3 High 172.30.201.61 tcp 443 OpenSSL "ChangeCipherSpec" MiTM Vulnerability The remote host is affected by a vulnerability that could allow sensitive data to be decrypted. The OpenSSL service on the remote host is vulnerable to a man-in-the-middle (MiTM) attack, based on its acceptance of a specially crafted handshake. This flaw could allow a MiTM attacker to decrypt or forge SSL messages by telling the service to begin encrypted communications before key material has been exchanged, which causes predictable keys to be used to secure future traffic. Note that Nessus has only tested for an SSL/TLS MiTM vulnerability (CVE-2014-0224). However, Nessus has inferred that the OpenSSL service on the remote host is also affected by six additional vulnerabilities that were disclosed in OpenSSL"s June 5th, 2014 security advisory : - An error exists in the "ssl3_read_bytes" function that permits data to be injected into other sessions or allows denial of service attacks. Note that this issue is exploitable only if SSL_MODE_RELEASE_BUFFERS is enabled. (CVE-2010-5298) - An error exists related to the implementation of the Elliptic Curve Digital Signature Algorithm (ECDSA) that allows nonce disclosure via the "FLUSH+RELOAD" cache side-channel attack. (CVE-2014-0076) - A buffer overflow error exists related to invalid DTLS fragment handling that permits the execution of arbitrary code or allows denial of service attacks. Note that this issue only affects OpenSSL when used as a DTLS client or server. (CVE-2014-0195) - An error exists in the "do_ssl3_write" function that permits a NULL pointer to be dereferenced, which could allow denial of service attacks. Note that this issue is exploitable only if SSL_MODE_RELEASE_BUFFERS is enabled. (CVE-2014-0198) - An error exists related to DTLS handshake handling that could allow denial of service attacks. Note that this issue only affects OpenSSL when used as a DTLS client. (CVE-2014-0221) - An error exists in the "dtls1_get_message_fragment" function related to anonymous ECDH cipher suites. This could allow denial of service attacks. Note that this issue only affects OpenSSL TLS clients. (CVE-2014-3470) OpenSSL did not release individual patches for these vulnerabilities, instead they were all patched under a single version release. Note that the service will remain vulnerable after patching until the service or host is restarted. OpenSSL 0.9.8 SSL/TLS users (client and/or server) should upgrade to 0.9.8za. OpenSSL 1.0.0 SSL/TLS users (client and/or server) should upgrade to 1.0.0m. OpenSSL 1.0.1 SSL/TLS users (client and/or server) should upgrade to 1.0.1h. http://www.nessus.org/u?d5709faa https://www.imperialviolet.org/2014/06/05/earlyccs.html https://www.openssl.org/news/secadv/20140605.txt The remote service on port 443 accepted an early ChangeCipherSpec message, which caused the MAC and encryption keys to be derived entirely from public information. The entire SSL handshake was completed, with the server accepting and producing messages encrypted and authenticated using these weak keys.
45556 H28-MOJ-Teikyo-Yokohama-18-seg-02-21161121-abe_vilnov.csv 31659 77200 CVE-2014-3470 9.3 High 172.30.138.61 tcp 443 OpenSSL "ChangeCipherSpec" MiTM Vulnerability The remote host is affected by a vulnerability that could allow sensitive data to be decrypted. The OpenSSL service on the remote host is vulnerable to a man-in-the-middle (MiTM) attack, based on its acceptance of a specially crafted handshake. This flaw could allow a MiTM attacker to decrypt or forge SSL messages by telling the service to begin encrypted communications before key material has been exchanged, which causes predictable keys to be used to secure future traffic. Note that Nessus has only tested for an SSL/TLS MiTM vulnerability (CVE-2014-0224). However, Nessus has inferred that the OpenSSL service on the remote host is also affected by six additional vulnerabilities that were disclosed in OpenSSL"s June 5th, 2014 security advisory : - An error exists in the "ssl3_read_bytes" function that permits data to be injected into other sessions or allows denial of service attacks. Note that this issue is exploitable only if SSL_MODE_RELEASE_BUFFERS is enabled. (CVE-2010-5298) - An error exists related to the implementation of the Elliptic Curve Digital Signature Algorithm (ECDSA) that allows nonce disclosure via the "FLUSH+RELOAD" cache side-channel attack. (CVE-2014-0076) - A buffer overflow error exists related to invalid DTLS fragment handling that permits the execution of arbitrary code or allows denial of service attacks. Note that this issue only affects OpenSSL when used as a DTLS client or server. (CVE-2014-0195) - An error exists in the "do_ssl3_write" function that permits a NULL pointer to be dereferenced, which could allow denial of service attacks. Note that this issue is exploitable only if SSL_MODE_RELEASE_BUFFERS is enabled. (CVE-2014-0198) - An error exists related to DTLS handshake handling that could allow denial of service attacks. Note that this issue only affects OpenSSL when used as a DTLS client. (CVE-2014-0221) - An error exists in the "dtls1_get_message_fragment" function related to anonymous ECDH cipher suites. This could allow denial of service attacks. Note that this issue only affects OpenSSL TLS clients. (CVE-2014-3470) OpenSSL did not release individual patches for these vulnerabilities, instead they were all patched under a single version release. Note that the service will remain vulnerable after patching until the service or host is restarted. OpenSSL 0.9.8 SSL/TLS users (client and/or server) should upgrade to 0.9.8za. OpenSSL 1.0.0 SSL/TLS users (client and/or server) should upgrade to 1.0.0m. OpenSSL 1.0.1 SSL/TLS users (client and/or server) should upgrade to 1.0.1h. http://www.nessus.org/u?d5709faa https://www.imperialviolet.org/2014/06/05/earlyccs.html https://www.openssl.org/news/secadv/20140605.txt The remote service on port 443 accepted an early ChangeCipherSpec message, which caused the MAC and encryption keys to be derived entirely from public information. The entire SSL handshake was completed, with the server accepting and producing messages encrypted and authenticated using these weak keys.
54485 1_Tokyu_remi_20170126.csv 31659 77200 CVE-2014-3470 9.3 High 54.199.215.149 tcp 443 OpenSSL "ChangeCipherSpec" MiTM Vulnerability The remote host is affected by a vulnerability that could allow sensitive data to be decrypted. The OpenSSL service on the remote host is vulnerable to a man-in-the-middle (MiTM) attack, based on its acceptance of a specially crafted handshake. This flaw could allow a MiTM attacker to decrypt or forge SSL messages by telling the service to begin encrypted communications before key material has been exchanged, which causes predictable keys to be used to secure future traffic. Note that Nessus has only tested for an SSL/TLS MiTM vulnerability (CVE-2014-0224). However, Nessus has inferred that the OpenSSL service on the remote host is also affected by six additional vulnerabilities that were disclosed in OpenSSL"s June 5th, 2014 security advisory : - An error exists in the "ssl3_read_bytes" function that permits data to be injected into other sessions or allows denial of service attacks. Note that this issue is exploitable only if SSL_MODE_RELEASE_BUFFERS is enabled. (CVE-2010-5298) - An error exists related to the implementation of the Elliptic Curve Digital Signature Algorithm (ECDSA) that allows nonce disclosure via the "FLUSH+RELOAD" cache side-channel attack. (CVE-2014-0076) - A buffer overflow error exists related to invalid DTLS fragment handling that permits the execution of arbitrary code or allows denial of service attacks. Note that this issue only affects OpenSSL when used as a DTLS client or server. (CVE-2014-0195) - An error exists in the "do_ssl3_write" function that permits a NULL pointer to be dereferenced, which could allow denial of service attacks. Note that this issue is exploitable only if SSL_MODE_RELEASE_BUFFERS is enabled. (CVE-2014-0198) - An error exists related to DTLS handshake handling that could allow denial of service attacks. Note that this issue only affects OpenSSL when used as a DTLS client. (CVE-2014-0221) - An error exists in the "dtls1_get_message_fragment" function related to anonymous ECDH cipher suites. This could allow denial of service attacks. Note that this issue only affects OpenSSL TLS clients. (CVE-2014-3470) OpenSSL did not release individual patches for these vulnerabilities, instead they were all patched under a single version release. Note that the service will remain vulnerable after patching until the service or host is restarted. OpenSSL 0.9.8 SSL/TLS users (client and/or server) should upgrade to 0.9.8za. OpenSSL 1.0.0 SSL/TLS users (client and/or server) should upgrade to 1.0.0m. OpenSSL 1.0.1 SSL/TLS users (client and/or server) should upgrade to 1.0.1h. http://www.nessus.org/u?d5709faa https://www.imperialviolet.org/2014/06/05/earlyccs.html https://www.openssl.org/news/secadv/20140605.txt The remote service on port 443 accepted an early ChangeCipherSpec message, which caused the MAC and encryption keys to be derived entirely from public information. The entire SSL handshake was completed, with the server accepting and producing messages encrypted and authenticated using these weak keys.