PT-2003-1008 · Openssl+1 · Openssl+1

Published 2003-09-30 · Updated 2024-02-02 · CVE-2003-0545

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenSSL versions 0.9.6 through 0.9.7a

Description The issue concerns multiple vulnerabilities in the OpenSSL package, which can lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely, potentially allowing attackers to cause a denial of service (crash) and possibly execute arbitrary code via an SSL client certificate with crafted invalid ASN.1 encoding. An affected network device running an SSL server based on an affected OpenSSL implementation may be vulnerable to a Denial of Service (DoS) attack when presented with a malformed certificate by a client.

Recommendations For OpenSSL versions 0.9.6 through 0.9.7a, consider applying workarounds to mitigate the effects of these vulnerabilities, such as configuring the server to not authenticate certificates from the client or restricting access to the SSL server. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Double Free

Out of bounds Read

Weakness Enumeration

CWE-415

CWE-125

Related Identifiers

BDU:2015-01443

BDU:2015-08201

BDU:2015-08203

BDU:2015-08204

BDU:2015-08208

CVE-2003-0545

DSA-393

DSA-394

Affected Products

Cisco Ios

Openssl

References · 30

• http://uniras.gov.uk/vuls/2003/006489/openssl.htm · Vendor Advisory
• http://secunia.com/advisories/22249 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01443 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20030930-ssl · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0544 · Security Note
• https://bdu.fstec.ru/vul/2015-08208 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0545 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0543 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2003-0545 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2003-0545 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08204 · Security Note
• https://bdu.fstec.ru/vul/2015-08201 · Security Note
• https://bdu.fstec.ru/vul/2015-08203 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2003-0545 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0545 · Security Note