PT-2015-1692 · Openssl+9 · Openssl+12
Emilia Kã¤Sper
·
Published
2014-10-24
·
Updated
2024-06-15
·
CVE-2015-1791
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
OpenSSL versions 0.9.8 before 0.9.8zg
OpenSSL versions 1.0.0 before 1.0.0s
OpenSSL versions 1.0.1 before 1.0.1n
OpenSSL versions 1.0.2 before 1.0.2b
Description
The issue is related to a race condition in the
ssl3 get new session ticket function, which can be exploited by remote attackers to cause a denial of service (double free and application crash) or possibly have other unspecified impacts. This occurs when a NewSessionTicket is provided during an attempt to reuse a ticket that had been obtained earlier, specifically in multi-threaded client scenarios. The vulnerability is associated with errors in accessing shared resources.Recommendations
For OpenSSL versions 0.9.8 before 0.9.8zg, update to version 0.9.8zg or later.
For OpenSSL versions 1.0.0 before 1.0.0s, update to version 1.0.0s or later.
For OpenSSL versions 1.0.1 before 1.0.1n, update to version 1.0.1n or later.
For OpenSSL versions 1.0.2 before 1.0.2b, update to version 1.0.2b or later.
As a temporary workaround, consider restricting access to the
ssl3 get new session ticket function to minimize the risk of exploitation.Exploit
Fix
DoS
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Cisco Ios
Cisco Ios Xe
Cisco Nexus
Cisco Wls
Hp-Ux
Ibm Aix
Junos
Openssl
Red Hat
Suse
Ubuntu