Family: Mandrake Local Security Checks --> Category: infos
MDKSA-2005:096: openssl Vulnerability Scan
Vulnerability Scan Summary
Check for the version of the openssl package
Detailed Explanation for this Vulnerability Test
The remote host is missing the patch for the advisory MDKSA-2005:096 (openssl).
Colin Percival reported a cache timing attack that could be used to allow a
malicious local user to gain portions of cryptographic keys (CVE-2005-0109).
The OpenSSL library has been patched to add a new fixed-window mod_exp
implementation as default for RSA, DSA, and DH private key operations. The
patch was designed to mitigate cache timing and possibly related attacks.
Solution : http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2005:096
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.