Test ID:	1.3.6.1.4.1.25623.1.0.68751
Category:	Fedora Local Security Checks
Title:	Fedora Core 13 FEDORA-2010-19054 (perl-IO-Socket-SSL)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to perl-IO-Socket-SSL announced via advisory FEDORA-2010-19054. Update Information: This update fixes a problem whereby IO::Socket::SSL fell back to the VERIFY_NONE verification mode if another verification mode was defined but no valid ca_file or ca_path was provided. The updated version throws an error in that situation rather than proceeding with the connection despite being unable to verify the certificate(s) as requested. This issue was originally reported at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=606058 References: [ 1 ] Bug #660847 - CVE-2010-4334 perl-IO-Socket-SSL: ignores user request for peer verification https://bugzilla.redhat.com/show_bug.cgi?id=660847 Solution: Apply the appropriate updates. This update can be installed with the yum update program. Use su -c 'yum update perl-IO-Socket-SSL' at the command line. For more information, refer to Managing Software with yum, available at http://docs.fedoraproject.org/yum/. https://secure1.securityspace.com/smysecure/catid.html?in=FEDORA-2010-19054 Risk factor : Medium CVSS Score: 4.0
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2010-4334 42508 http://secunia.com/advisories/42508 42757 http://secunia.com/advisories/42757 45189 http://www.securityfocus.com/bid/45189 69626 http://osvdb.org/69626 FEDORA-2010-19054 http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052594.html FEDORA-2010-19058 http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052601.html MDVSA-2011:092 http://www.mandriva.com/security/advisories?name=MDVSA-2011:092 [oss-security] 20101209 Re: CVE requests: IO::Socket::SSL, cakephp, collectd, gnash, ocrodjvu, hypermail, libcloud, piwigo http://www.openwall.com/lists/oss-security/2010/12/09/8 [oss-security] 20101224 IO::Socket::SSL perl module: CVE-2010-4501/CVE-2010-4334 dupe http://www.openwall.com/lists/oss-security/2010/12/24/1 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=606058 http://cpansearch.perl.org/src/SULLR/IO-Socket-SSL-1.35/Changes
Copyright	Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.