| VID |
22769 |
| Severity |
40 |
| Port |
80, ... |
| Protocol |
TCP |
| Class |
WWW |
| Detailed Description |
According to its banner, the remote host is running a version of OpenSSL 1.1.0 prior to 1.1.0e. During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause OpenSSL to crash (dependent on ciphersuite). Both clients and servers are affected.
* References:
http://securityaffairs.co/wordpress/56343/security/openssl-cve-2017-3733.html
* Platforms Affected:
OpenSSL 1.1.0 before 1.1.0e
Linux Any version
Unix Any version
Microsoft Windows Any version |
| Recommendation |
Upgrade to the latest version of OpenSSL (1.1.0e or later), available from the OpenSSL Web site at http://www.openssl.org/ |
| Related URL |
CVE-2017-3733 (CVE) |
| Related URL |
(SecurityFocus) |
| Related URL |
(ISS) |
|
