PT-2012-1079 · Openssl+5 · Openssl+5

Published 2012-01-04 · Updated 2024-06-15 · CVE-2011-4619

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 1.0.0f OpenSSL versions 1.0.0 through 1.0.0g

Description The vulnerability in OpenSSL can be exploited remotely, potentially leading to a disruption of confidentiality, integrity, and availability of protected information. The Server Gated Cryptography (SGC) implementation in OpenSSL does not properly handle handshake restarts, allowing remote attackers to cause a denial of service via unspecified vectors.

Recommendations For OpenSSL versions prior to 1.0.0f, update to version 1.0.0f or later. For OpenSSL versions 1.0.0 through 1.0.0g, update to version 1.0.0g or later. As a temporary workaround, consider restricting access to the vulnerable openssl package until a patch is available.

Fix

DoS

Weakness Enumeration

CWE-399

CWE-310

Related Identifiers

BDU:2015-06476

BDU:2015-06477

BDU:2015-06479

BDU:2015-06480

BDU:2015-08802

BDU:2015-08803

BDU:2015-08804

BDU:2015-08805

BDU:2015-09442

CESA-2012_0059

CVE-2011-4619

DSA-2390-1

HPSBUX02734

HPSBUX02782

OPENSUSE-SU-2024:10271-1

OPENSUSE-SU-2024:10529-1

OPENSUSE-SU-2024:11127-1

RHSA-2012:0059

RHSA-2012:0060

RHSA-2012:0086

RHSA-2012:0109

RHSA-2012_0059

RHSA-2012_0060

RHSA-2012_0086

SUSE-FU-2022:0445-1

SUSE-SU-2015:1184-1

SUSE-SU-403

Affected Products

Centos

Hp-Ux

Ibm Aix

Openssl

Red Hat

Suse

References · 286

• http://debian.org/security/2012/dsa-2390 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1165 · Security Note
• https://bdu.fstec.ru/vul/2015-08803 · Security Note
• https://bdu.fstec.ru/vul/2015-09442 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4619 · Security Note
• http://marc.info/?l=bugtraq&m=133951357207000&w=2 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1306.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3210 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2012:006 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-403 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-4619 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08802 · Security Note
• https://bdu.fstec.ru/vul/2015-08805 · Security Note
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 · Vendor Advisory