|
| TC: | 12105 | |
| Description: | OpenSSL is a very popular library supporting SSL and cryptographic functions working on many different platforms. By sending a specially crafted SSL/TLS handshake to an application that uses a vulnerable OpenSSL library, a remote, unauthenticated attacker could cause OpenSSL to crash. All versions of OpenSSL from 0.9.6c to 0.9.6l inclusive and from 0.9.7a to 0.9.7c inclusive are affected by this issue. Any application that makes use of OpenSSL's SSL/TLS library may be affected. Please contact your application vendor for details. | |
| TC Impact: | Gather Info | |
| Service: | http |
| Vulnerability Publication: | March 17, 2004 | |
| Advisory Copyright: | Stephen Henson and the OpenSSL Group | |
| Summary: | It is possible to create a DoS using a bug in OpenSSL. | |
| Risk: | Medium | |
| CVSS 2.0 metrics: | Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial | |
| CVSS 2.0 Base Score: | 5.0 |
| Vulnerability Impact: |
Denial of Service |
|---|
| Host Impact: | Service can be stopped. | |
| Nature of Remediation: | Update the software. |
| Step required to fix the reported vulnerability: | |
***** Solution type: Upgrade Software ***** Upgrade to OpenSSL 0.9.7d or 0.9.6m. Recompile any OpenSSL applications statically linked to OpenSSL libraries. See references for more details. |
| CVE Link: |
CVE-2004-0079 |
 |
|---|
| Glossary: |
Denial of Service SSL |
|---|
