PT-2004-1029 · Openssl · Openssl

Published 2004-03-17 · Updated 2021-11-08 · CVE-2004-0081

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 0.9.6d OpenSSL versions 0.9.6 OpenSSL versions 0.9.7a libssl09 (affected versions not specified) openssl096 (affected versions not specified) openssl096b (affected versions not specified) openssl-devel-0.9.7a (affected versions not specified)

Description The issue is related to the handling of unknown message types in OpenSSL, which can lead to a denial of service (infinite loop) when exploited remotely. This can result in the loss of availability for OpenSSL or the application using it. The vulnerability can be exploited remotely and may lead to disruption of confidentiality, integrity, and availability of protected information.

Recommendations For OpenSSL versions prior to 0.9.6d, update to version 0.9.6d or later. For OpenSSL versions 0.9.6, update to version 0.9.6d or later. For OpenSSL versions 0.9.7a, update to a version later than 0.9.7a. For libssl09, openssl096, openssl096b, and openssl-devel-0.9.7a, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Double Free

NULL Pointer Dereference

Weakness Enumeration

CWE-125

CWE-415

CWE-476

Related Identifiers

BDU:2015-03282

BDU:2015-08201

BDU:2015-08203

BDU:2015-08204

BDU:2015-08208

CVE-2004-0081

DSA-465

RHSA-2004:120

Affected Products

Openssl

References · 47

• http://linuxsecurity.com/advisories/engarde_advisory-4135.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-139.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-0081 · Vendor Advisory
• http://fedoranews.org/updates/FEDORA-2004-095.shtml · Vendor Advisory
• http://trustix.org/errata/2004/0012 · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20040304-01-U.asc · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08208 · Security Note
• http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57524 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-121.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08204 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2004-0081 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0081 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200403-03.xml · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0079 · Security Note
• ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.10/SCOSA-2004.10.txt · Vendor Advisory