Executive Summary
| Summary | |
|---|---|
| Title | OpenSSL TLS handshake Denial of Service |
| Informations | |||
|---|---|---|---|
| Name | VU#520586 | First vendor Publication | 2008-05-30 |
| Vendor | VU-CERT | Last vendor Modification | 2008-05-30 |
| Severity (Vendor) | N/A | Revision | M |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:N/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
Vulnerability Note VU#520586OpenSSL TLS handshake Denial of ServiceOverviewA vulnerability exists in OpenSSL that may allow a remote attacker to cause a denial of service.I. DescriptionOpenSSL contains a vulnerability in the way specially crafted TLS handshake packets are handled that may result in a denial of service. According to OpenSSL Security Advisory [28-Mar-2008]:... if the 'Server Key exchange message' is omitted from a TLS handshake in OpenSSL 0.9.8f and OpenSSL 0.9.8g. If a client connects to a malicious server with particular cipher suites, the server could cause the client to crash. OpenSSL has issued an upgrade and a patch to address this issue. See OpenSSL Security Advisory [28-Mar-2008] for more information. OpenSSL is included in various Linux and UNIX distributions. Please consult the relevant documentation of your distribution to obtain the appropriate updates.
References
This issue was reported in OpenSSL Security Advisory [28-Mar-2008]. OpenSSL credits Codenomicon for reporting these issues. This document was written by Chris Taschner.
|
Original Source
| Url : http://www.kb.cert.org/vuls/id/520586 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-476 | NULL Pointer Dereference |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:17643 | |||
| Oval ID: | oval:org.mitre.oval:def:17643 | ||
| Title: | USN-620-1 -- openssl vulnerabilities | ||
| Description: | It was discovered that OpenSSL was vulnerable to a double-free when using TLS server extensions. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-620-1 CVE-2008-0891 CVE-2008-1672 | Version: | 7 |
| Platform(s): | Ubuntu 8.04 | Product(s): | openssl |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 2 | |
| Os | 1 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-06-23 | Name : Fedora Core 9 FEDORA-2009-5423 (openssl) File : nvt/fcore_2009_5423.nasl |
| 2009-04-09 | Name : Mandriva Update for openssl MDVSA-2008:107 (openssl) File : nvt/gb_mandriva_MDVSA_2008_107.nasl |
| 2009-03-23 | Name : Ubuntu Update for openssl vulnerabilities USN-620-1 File : nvt/gb_ubuntu_USN_620_1.nasl |
| 2009-02-17 | Name : Fedora Update for openssl FEDORA-2008-4723 File : nvt/gb_fedora_2008_4723_openssl_fc9.nasl |
| 2009-01-13 | Name : Fedora Core 9 FEDORA-2009-0325 (openssl) File : nvt/fcore_2009_0325.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200806-08 (openssl) File : nvt/glsa_200806_08.nasl |
| 0000-00-00 | Name : Slackware Advisory SSA:2008-210-08 openssl File : nvt/esoft_slk_ssa_2008_210_08.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 45661 | OpenSSL Malformed TLS Handshake Remote DoS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2011-12-02 | Name : The remote web server has multiple SSL-related vulnerabilities. File : openssl_0_9_8h.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-107.nasl - Type : ACT_GATHER_INFO |
| 2008-07-29 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2008-210-08.nasl - Type : ACT_GATHER_INFO |
| 2008-07-02 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-620-1.nasl - Type : ACT_GATHER_INFO |
| 2008-06-24 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200806-08.nasl - Type : ACT_GATHER_INFO |
| 2008-06-02 | Name : The remote Fedora host is missing a security update. File : fedora_2008-4723.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 12:07:54 |
|
