Executive Summary
Summary | |
---|---|
Title | OpenSSL Server Name extension Denial of Service |
Informations | |||
---|---|---|---|
Name | VU#661475 | First vendor Publication | 2008-05-30 |
Vendor | VU-CERT | Last vendor Modification | 2008-05-30 |
Severity (Vendor) | N/A | Revision | M |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:N/I:N/A:P) | |||
---|---|---|---|
Cvss Base Score | 4.3 | Attack Range | Network |
Cvss Impact Score | 2.9 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Vulnerability Note VU#661475OpenSSL Server Name extension Denial of ServiceOverviewA vulnerability exists in OpenSSL that may allow a remote attacker to cause a denial of service.I. DescriptionOpenSSL contains a vulnerability in the way server name extension data is handled that may result in a denial of service. According to OpenSSL Security Advisory [28-Mar-2008]:If OpenSSL has been compiled using the non-default TLS server name extensions, a remote attacker could send a carefully crafted packet to a server application using OpenSSL and cause it to crash. Note that this issue may affect OpenSSL versions prior to 0.9.8h. II. ImpactA remote, unauthorized attacker may be able to cause a denial of service.III. SolutionUpgrade or Apply PatchOpenSSL has issued an upgrade and a patch to address this issue. See OpenSSL Security Advisory [28-Mar-2008] for more information. OpenSSL is included in various Linux and UNIX distributions. Please consult the relevant documentation of your distribution to obtain the appropriate updates..
References
This issue was reported in OpenSSL Security Advisory [28-Mar-2008]. OpenSSL credits Codenomicon for reporting these issues. This document was written by Chris Taschner.
|
Original Source
Url : http://www.kb.cert.org/vuls/id/661475 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 2 |
OpenVAS Exploits
Date | Description |
---|---|
2009-06-23 | Name : Fedora Core 9 FEDORA-2009-5423 (openssl) File : nvt/fcore_2009_5423.nasl |
2009-04-09 | Name : Mandriva Update for openssl MDVSA-2008:107 (openssl) File : nvt/gb_mandriva_MDVSA_2008_107.nasl |
2009-03-23 | Name : Ubuntu Update for openssl vulnerabilities USN-620-1 File : nvt/gb_ubuntu_USN_620_1.nasl |
2009-02-17 | Name : Fedora Update for openssl FEDORA-2008-4723 File : nvt/gb_fedora_2008_4723_openssl_fc9.nasl |
2009-01-13 | Name : Fedora Core 9 FEDORA-2009-0325 (openssl) File : nvt/fcore_2009_0325.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200806-08 (openssl) File : nvt/glsa_200806_08.nasl |
0000-00-00 | Name : Slackware Advisory SSA:2008-210-08 openssl File : nvt/esoft_slk_ssa_2008_210_08.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
45660 | OpenSSL Server Name Extension Data Handling Crafted Packet Remote DoS |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2011-12-02 | Name : The remote web server has multiple SSL-related vulnerabilities. File : openssl_0_9_8h.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-107.nasl - Type : ACT_GATHER_INFO |
2008-07-29 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2008-210-08.nasl - Type : ACT_GATHER_INFO |
2008-07-02 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-620-1.nasl - Type : ACT_GATHER_INFO |
2008-06-24 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200806-08.nasl - Type : ACT_GATHER_INFO |
2008-06-02 | Name : The remote Fedora host is missing a security update. File : fedora_2008-4723.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 12:08:04 |
|