PT-2006-1069 · Openssl+1 · Openssl+1

Noam Rathaus · Published 2006-09-28 · Updated 2024-06-15 · CVE-2006-4343

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: OpenSSL versions 0.9.7 before 0.9.7l OpenSSL versions 0.9.8 before 0.9.8d OpenSSL earlier versions

Description: The issue allows remote servers to cause a denial of service, potentially leading to a client crash via unknown vectors that trigger a null pointer dereference in the get server hello function. Multiple vulnerabilities in the openssl package may lead to violations of confidentiality, integrity, and availability of protected information, and can be exploited remotely.

Recommendations: For OpenSSL versions 0.9.7 before 0.9.7l, update to version 0.9.7l or later. For OpenSSL versions 0.9.8 before 0.9.8d, update to version 0.9.8d or later. For OpenSSL earlier versions, update to a version 0.9.7l or 0.9.8d, or later.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-399

CWE-476

Related Identifiers

BDU:2015-09525

CVE-2006-4343

DSA-1185-2

DSA-1195-1

HPSBUX02174

OPENSUSE-SU-2024:11125-1

OPENSUSE-SU-2024:11126-1

OPENSUSE-SU-2024:11127-1

RHSA-2006:0695

RHSA-2006_0695

RHSA-2008:0264

RHSA-2008:0525

RHSA-2008:0629

SUSE-FU-2022:0445-1

Affected Products

Openssl

Red Hat

References · 311

• 🔥 https://exploit-db.com/exploits/4773 · Exploit
• 🔥 https://exploit-db.com/exploits/28726 · Exploit
• https://osv.dev/vulnerability/CVE-2006-4343 · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_24_sr.html · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_58_openssl.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09567 · Security Note
• http://cisco.com/en/US/products/hw/contnetw/ps4162/tsd_products_security_response09186a008077af1b.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:177 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4343 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200612-11.xml · Vendor Advisory
• http://itrc.hp.com/service/cki/docDisplay.do?docId=c00849540 · Vendor Advisory
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01118771 · Vendor Advisory
• http://ubuntu.com/usn/usn-353-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3738 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2006-4343 · Vendor Advisory