[ MDVSA-2009:271 ] libnasl

[dude67]

_______________________________________________________________________

Package : libnasl
Date : October 12, 2009
Affected: Corporate 4.0
_______________________________________________________________________

Problem Description:

A vulnerability has been found and corrected in libnasl:

nasl/nasl_crypto2.c in the Nessus Attack Scripting Language library
(aka libnasl) 2.2.11 does not properly check the return value from
the OpenSSL DSA_do_verify function, which allows remote attackers to
bypass validation of the certificate chain via a malformed SSL/TLS
signature, a similar vulnerability to CVE-2008-5077 (CVE-2009-0125).

This update fixes this vulnerability.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-0125
_______________________________________________________________________