ID de Prueba:	1.3.6.1.4.1.25623.1.0.106347
Categoría:	General
Título:	MatrixSSL <= 3.8.5 Multiple Vulnerabilities
Resumen:	MatrixSSL is prone to multiple vulnerabilities.
Descripción:	Summary: MatrixSSL is prone to multiple vulnerabilities. Vulnerability Insight: The following flaws exist: - CVE-2016-6890 (Heap-based Buffer Overflow): The Subject Alt Name field of X.509 certificates is not properly parsed. A specially crafted certificate may result in a heap-based buffer overflow and arbitrary code execution. - CVE-2016-6891 (Improper Restriction of Operations within the Bounds of a Memory Buffer): The ASN.1 Bit Field is not properly parsed. A specially crafted certificate may lead to a denial of service condition due to an out of bounds read in memory. - CVE-2016-6892 (Free of Memory not on the Heap): The x509FreeExtensions() function does not properly parse X.509 certificates. A specially crafted certificate may cause a free operation on unallocated memory, resulting in a denial of service condition. Vulnerability Impact: A remote, unauthenticated attacker may be able to create a denial of service condition or execute arbitrary code in the context of the SSL stack. Affected Software/OS: MatrixSSL 3.8.5 and prior. Solution: Update to version 3.8.6 or later. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2016-6890 BugTraq ID: 93498 http://www.securityfocus.com/bid/93498 CERT/CC vulnerability note: VU#396440 https://www.kb.cert.org/vuls/id/396440 http://www.tripwire.com/state-of-security/security-data-protection/cyber-security/flawed-matrixssl-code-highlights-need-for-better-iot-update-practices/ Common Vulnerability Exposure (CVE) ID: CVE-2016-6891 Common Vulnerability Exposure (CVE) ID: CVE-2016-6892 Common Vulnerability Exposure (CVE) ID: CVE-2016-6882 BugTraq ID: 91488 http://www.securityfocus.com/bid/91488 https://access.redhat.com/blogs/766093/posts/1976703 https://people.redhat.com/~fweimer/rsa-crt-leaks.pdf http://www.openwall.com/lists/oss-security/2016/08/19/7 Common Vulnerability Exposure (CVE) ID: CVE-2016-6883 http://www.openwall.com/lists/oss-security/2016/08/19/8 Common Vulnerability Exposure (CVE) ID: CVE-2016-6884
Copyright	Copyright (C) 2016 Greenbone Networks GmbH

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.