Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When checking my (secure) site with Firefox 3.6.6 the Error Console shows: : potentially vulnerable to CVE-2009-3555

Is this something I need to worry about? Is there an easy way for me to check whether the vulnerability actually exists on my server?

share|improve this question
up vote 4 down vote accepted

The Mitre Web Site will tell you the details of the vulnerability e.g. what software it affects, links to vendors responses and so on:

Mitre also provides a link to National Vulnerability Database (very useful):

The NVD site give you (in my opinion) an unbiased statement on the severity of the problem. That should help you decide how much of a priority you give this problem but that will also depend on what your site provides, whether you have PCI DSS obligations etc.

So now we know that 2009-3555 is an SSL protocol vulnerability so affects the openssl package, openjdk package etc.

Then follow the link to your vendor's response to the incident. The RedHat one is a good write up of this particular problem so I'll follow that:

You can check the packages on your server by looking at the changelog for the openssl rpm installed:

# rpm -q --changelog openssl | grep CVE
- fix CVE-2009-1386 CVE-2009-1387 (DTLS DoS problems)
- fix CVE-2009-1377 CVE-2009-1378 CVE-2009-1379
- fix CVE-2009-0590 - reject incorrectly encoded ASN.1 strings (#492304)

We don't see CVE-2009-3555 so this rpm is potentially vulnerable and should be replaced.

Obtain the recommended replacement for openssl from your vendor, apply Repeat this for all the packages the vendor recommends in the response and you are done.

share|improve this answer


Check the versions of the software on your server with those in the vulnerability report, and if you are running some variant of RHEL then also check the package changelogs to see if the security fix has been backported.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.