PT-2011-1151 · Openssl+2 · Openssl+2

Vincent Danen · Published 2011-09-06 · Updated 2014-10-24 · CVE-2011-3210

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenSSL versions 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e Gentoo Linux (affected versions not specified)

Description The issue affects the ephemeral ECDH ciphersuite functionality, which does not ensure thread safety during processing of handshake messages from clients. This can be exploited remotely, potentially leading to a denial of service (daemon crash) via out-of-order messages that violate the TLS protocol. The exploitation of these vulnerabilities may compromise the confidentiality, integrity, and availability of protected information.

Recommendations For OpenSSL versions 0.9.8 through 0.9.8r, update to a version that ensures thread safety during handshake message processing. For OpenSSL versions 1.0.x before 1.0.0e, update to version 1.0.0e or later to address the issue. As a temporary workaround, consider restricting access to the ephemeral ECDH ciphersuite functionality until a patch is available.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-09418

CVE-2011-3210

HPSBUX02734

OPENSUSE-SU-2024:10271-1

OPENSUSE-SU-2024:10529-1

SUSE-FU-2022:0445-1

SUSE-SU-2015:1184-1

SUSE-SU-403

Affected Products

Gentoo Linux

Hp-Ux

Openssl

References · 157

• http://openssl.org/news/secadv_20110906.txt · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4576 · Security Note
• https://bdu.fstec.ru/vul/2015-08803 · Security Note
• https://bdu.fstec.ru/vul/2015-06479 · Security Note
• https://bdu.fstec.ru/vul/2015-09442 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4619 · Security Note
• https://bdu.fstec.ru/vul/2015-06480 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3210 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2011:137 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-3210 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-3210 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09418 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-3210 · Security Note
• https://bdu.fstec.ru/vul/2015-08804 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-403 · Vendor Advisory