OSVDB ID: 70847 Title: OpenSSL ClientHello Handshake Message Parsing Invalid Memory Access |
Info |
|
|
Dates |
||||
|
|
Description |
OpenSSL contains a flaw that may allow a remote denial of service. The issue is triggered when an error occurs while parsing malformed ClientHello handshake messages, which may be exploited to trigger an invalid memory access with a crafted ClientHello handshake message. This may allow a remote attacker to cause a denial of service. Certain applications which use SSL may also allow the disclosure of the contents of parsed OCSP extensions. |
Classification |
Location:
Remote / Network Access
Attack Type: Denial of Service, Information Disclosure Impact: Loss of Confidentiality, Loss of Availability Solution: Patch / RCS, Upgrade Exploit: Exploit Unknown Disclosure: Vendor Verified OSVDB: Security Software |
Solution |
Upgrade to version 0.9.8r or 1.0.0d or higher, as they have been reported to fix this vulnerability. In addition, the OpenSSL team has released a patch for some older versions. |
Products |
|
Credit |
Unknown or Incomplete |