PT-2003-1916 · Openssl+1 · Openssl+1
Publicado
2003-09-30
·
Atualizado
2018-10-30
·
CVE-2003-0851
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
OpenSSL version 0.9.6k
Description
The issue allows remote attackers to cause a denial of service by crashing the system via large recursion. This can be achieved by sending malformed ASN.1 sequences or a specifically crafted certificate. An affected network device running an SSL server based on the affected OpenSSL implementation may be vulnerable to a Denial of Service (DoS) attack when presented with a malformed certificate by a client.
Recommendations
For OpenSSL version 0.9.6k, consider applying available workarounds to mitigate the effects of this issue, such as configuring the server to handle malformed certificates in a way that prevents the denial of service. As a temporary workaround, consider restricting the handling of ASN.1 tags to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Cisco Ios
Openssl