|
| TC: | 12100 | |
| Description: | OpenSSL is a very popular library supporting SSL and cryptographic functions working on many different platforms. Some versions are vulnerable to problems in the ASN.1 parser and in key handling: 1. denial of service due to an integer overflow when parsing ASN.1 values 2. denial of service due to bad number of characters check in certain ASN.1 inputs 3. denial of service due to malformed public key crashing the verify code in debugging mode. 4. server will parse client certificate even when it is not specifically requested to. This is not a vulnerability in itself but can be used to perform attacks 1, 2 and 3. An attack using one of this vulnerabilities will result in a denial of service. | |
| TC Impact: | Gather Info | |
| Service: | http |
| Vulnerability Publication: | September 30, 2003 | |
| Advisory Copyright: | NISCC and Stephen Henson | |
| Summary: | It is possible to create a DOS and probably run code on your computer using a bug in OpenSSL. | |
| Risk: | Medium | |
| CVSS 2.0 metrics: | Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial | |
| CVSS 2.0 Base Score: | 5.0 |
| Vulnerability Impact: |
Denial of Service |
|---|
| Host Impact: | Service can be stopped. | |
| Nature of Remediation: | Update the software. |
| Step required to fix the reported vulnerability: | |
***** Solution type: Upgrade Software ***** Upgrade to OpenSSL 0.9.6l, or 0.9.7c, or later. See references for more details. |
| CVE Link: |
CVE-2003-0543 CVE-2003-0544 |
 |
|---|
| Glossary: |
Denial of Service SSL |
|---|
