PT-2003-2511 · Openssl+2 · Openssl+2

Published 2003-09-30 · Updated 2008-09-05 · CVE-2005-1247

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Novell Nsure Audit version 1.0.1 OpenSSL version 0.9.6

Description The issue allows remote attackers to cause a denial of service via malformed ASN.1 packets in corrupt client certificates to an SSL server. An affected network device running an SSL server based on an affected OpenSSL implementation may be vulnerable to a Denial of Service (DoS) attack when presented with a malformed certificate by a client. The network device may be vulnerable to this issue even if it is configured to not authenticate certificates from the client.

Recommendations For Novell Nsure Audit version 1.0.1, consider disabling the webadmin.exe service until a patch is available. For OpenSSL version 0.9.6, restrict access to the SSL server to minimize the risk of exploitation. As a temporary workaround, consider implementing workarounds to mitigate the effects of these issues, such as configuring the server to not accept malformed certificates.

Exploit

Fix

Related Identifiers

CVE-2005-1247

Affected Products

Cisco Ios

Novell Nsure Audit

Openssl

References · 6

• 🔥 http://derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2004-01/0126.html · Exploit
• http://cirt.dk/advisories/cirt-31-advisory.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-1247 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20030930-ssl · Vendor Advisory
• http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0021.html · Note
• http://support.novell.com/cgi-bin/search/searchtid.cgi?/10097379.htm · Note