PT-2003-1916 · Openssl+1 · Openssl+1

Published 2003-09-30 · Updated 2018-10-30 · CVE-2003-0851

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions OpenSSL version 0.9.6k

Description The issue allows remote attackers to cause a denial of service by crashing the system via large recursion. This can be achieved by sending malformed ASN.1 sequences or a specifically crafted certificate. An affected network device running an SSL server based on the affected OpenSSL implementation may be vulnerable to a Denial of Service (DoS) attack when presented with a malformed certificate by a client.

Recommendations For OpenSSL version 0.9.6k, consider applying available workarounds to mitigate the effects of this issue, such as configuring the server to handle malformed certificates in a way that prevents the denial of service. As a temporary workaround, consider restricting the handling of ASN.1 tags to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2003-0851

Affected Products

Cisco Ios

Openssl

References · 17

• http://openssl.org/news/secadv_20031104.txt · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20040304-01-U.asc · Vendor Advisory
• http://redhat.com/archives/fedora-announce-list/2005-October/msg00087.html · Vendor Advisory
• http://securityfocus.com/bid/8970 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2004-119.html · Vendor Advisory
• http://cisco.com/warp/public/707/cisco-sa-20030930-ssl.shtml · Vendor Advisory
• ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-003.txt.asc · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20030930-ssl · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0851 · Security Note
• http://kb.cert.org/vuls/id/412478 · Patch
• http://marc.theaimsgroup.com/?l=bugtraq&m=108403850228012&w=2 · Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20030930-ssl · Note
• http://marc.theaimsgroup.com/?l=bugtraq&m=106796246511667&w=2 · Note
• http://marc.info/?l=bugtraq&m=108403850228012&w=2 · Note
• http://secunia.com/advisories/17381 · Note