|
| TC: | 12101 | |
| Description: | OpenSSL is a very popular library supporting SSL and cryptographic functions working on many different platforms. Some versions of the 0.9.7 branch are vulnerable to a problem in the ASN.1 parser. The problem occurs in a bogus double deallocation of memory. SSL and TLS protocols are not directly based on ASN.1, but they do rely on ASN.1 objects used in cryptographic elements. An attack using this vulnerability will result in a denial of service. Arbitrary execution though not proven could be possible. | |
| TC Impact: | Gather Info | |
| Service: | http |
| Vulnerability Publication: | September 30, 2003 | |
| Advisory Copyright: | NISCC | |
| Summary: | It is possible to create a DOS and probably run code on your computer using a bug in OpenSSL. | |
| Risk: | High | |
| CVSS 2.0 metrics: | Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete | |
| CVSS 2.0 Base Score: | 10 |
| Vulnerability Impact: |
Denial of Service Attack |
|---|
| Host Impact: | Service can be stopped. Possible arbitrary code execution. | |
| Nature of Remediation: | Update the software. |
| Step required to fix the reported vulnerability: | |
***** Solution type: Upgrade Software ***** Upgrade to OpenSSL 0.9.7c or later or check with you vendor for a fixed version. See references for more details. |
| CVE Link: |
CVE-2003-0545 |
 |
|---|
| Glossary: |
Arbitrary Command Execution Denial of Service SSL |
|---|
