PT-2015-1686 · Openssl+1 · Openssl+3

Daniel Danner

+1

·

Published

2015-03-19

·

Updated

2022-12-13

·

CVE-2015-0290

CVSS v2.0

5.0

Medium

VectorAV:N/AC:L/Au:N/C:N/I:N/A:P
Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.0.2 through 1.0.2a
Description The issue is related to the multi-block feature in the ssl3 write bytes function, which does not properly handle certain non-blocking I/O cases. This can allow remote attackers to cause a denial of service, resulting in pointer corruption and application crash. The vulnerability is associated with errors in the code and can be exploited by a remote attacker to cause a denial of service due to errors in handling certain input-output operations.
Recommendations For OpenSSL versions 1.0.2 through 1.0.2a, update to version 1.0.2a or later to resolve the issue. As a temporary workaround, consider restricting the use of the ssl3 write bytes function until a patch is available. Avoid using non-blocking I/O cases with the multi-block feature in the ssl3 write bytes function until the issue is resolved.

Fix

DoS

Weakness Enumeration

CWE-17

Related Identifiers

BDU:2015-11032
CVE-2015-0290

Affected Products

Cisco Asa
Cisco Ios Xe
Cisco Nexus
Openssl