PT-2004-1028 · Openssl+1 · Openssl+1
CVE-2004-0079
·
Publicado
2004-03-17
·
Atualizado
2025-01-16
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
OpenSSL versions 0.9.6c through 0.9.6k
OpenSSL versions 0.9.7a through 0.9.7c
Description
The issue is related to a flaw in the do change cipher spec function that allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake, triggering a null dereference. This may lead to a crash of applications that depend on OpenSSL, resulting in loss of availability. The exploitation of this issue can be done remotely.
Recommendations
For OpenSSL versions 0.9.6c through 0.9.6k, update to a version outside of this range to resolve the issue.
For OpenSSL versions 0.9.7a through 0.9.7c, update to a version outside of this range to resolve the issue.
As a temporary workaround, consider restricting access to the do change cipher spec function until a patch is available.
Correção
DoS
Double Free
NULL Pointer Dereference
Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Openssl
Red Hat