A remote overflow exists in OpenSSL. OpenSSL fails to correctly handle error conditions in ASN.1 tags in SSL client certificates, resulting in a integer overflow. With a specially crafted request, an attacker can cause a denial of service in OpenSSL or an application using it, resulting in a loss of availability.
Classification
Location:
Local Access Required,
Remote / Network Access
Attack Type:
Denial of Service,
Input Manipulation
Impact:
Loss of Integrity,
Loss of Availability
Exploit:
Exploit Public
Disclosure:
Vendor Verified
Solution
Upgrade to version 0.9.7c or 0.9.6k. or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. Recompile any OpenSSL applications statically linked to OpenSSL libraries.
openssl.org -
OpenSSL
