Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When checking my (secure) site https://www.just-great-software.com/ with Firefox 3.6.6 the Error Console shows:

www.just-great-software.com : potentially vulnerable to CVE-2009-3555

Is this something I need to worry about? Is there an easy way for me to check whether the vulnerability actually exists on my server?

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

The Mitre Web Site will tell you the details of the vulnerability e.g. what software it affects, links to vendors responses and so on:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555

Mitre also provides a link to National Vulnerability Database (very useful):

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3555

The NVD site give you (in my opinion) an unbiased statement on the severity of the problem. That should help you decide how much of a priority you give this problem but that will also depend on what your site provides, whether you have PCI DSS obligations etc.

So now we know that 2009-3555 is an SSL protocol vulnerability so affects the openssl package, openjdk package etc.

Then follow the link to your vendor's response to the incident. The RedHat one is a good write up of this particular problem so I'll follow that:

https://access.redhat.com/kb/docs/DOC-20491

You can check the packages on your server by looking at the changelog for the openssl rpm installed:

# rpm -q --changelog openssl | grep CVE
- fix CVE-2009-1386 CVE-2009-1387 (DTLS DoS problems)
- fix CVE-2009-1377 CVE-2009-1378 CVE-2009-1379
- fix CVE-2009-0590 - reject incorrectly encoded ASN.1 strings (#492304)

We don't see CVE-2009-3555 so this rpm is potentially vulnerable and should be replaced.

Obtain the recommended replacement for openssl from your vendor, apply Repeat this for all the packages the vendor recommends in the response and you are done.

share|improve this answer
add comment

CVE-2009-3555

Check the versions of the software on your server with those in the vulnerability report, and if you are running some variant of RHEL then also check the package changelogs to see if the security fix has been backported.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.