PT-2003-2511 · Openssl+2 · Openssl+2

Publicado 2003-09-30 · Atualizado 2008-09-05 · CVE-2005-1247

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Novell Nsure Audit version 1.0.1 OpenSSL version 0.9.6

Description The issue allows remote attackers to cause a denial of service via malformed ASN.1 packets in corrupt client certificates to an SSL server. An affected network device running an SSL server based on an affected OpenSSL implementation may be vulnerable to a Denial of Service (DoS) attack when presented with a malformed certificate by a client. The network device may be vulnerable to this issue even if it is configured to not authenticate certificates from the client.

Recommendations For Novell Nsure Audit version 1.0.1, consider disabling the webadmin.exe service until a patch is available. For OpenSSL version 0.9.6, restrict access to the SSL server to minimize the risk of exploitation. As a temporary workaround, consider implementing workarounds to mitigate the effects of these issues, such as configuring the server to not accept malformed certificates.

Exploit

Correção

Identificadores relacionados

CVE-2005-1247

Produtos afetados

Cisco Ios

Novell Nsure Audit

Openssl

Referências · 6

• 🔥 http://derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2004-01/0126.html · Exploit
• http://cirt.dk/advisories/cirt-31-advisory.pdf · Aviso do Fabricante
• http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0021.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-1247 · Nota de Segurança
• http://support.novell.com/cgi-bin/search/searchtid.cgi?/10097379.htm · Nota
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20030930-ssl · Aviso do Fabricante