An overflow flaw related to asn1_d2i_read_bio exists in OpenSSL. The issue is triggered when the program fails to sanitize user-supplied input when parsing DER data, resulting in a heap-based buffer overflow. This may allow an attacker to execute arbitrary code or cause a denial of service via memory corruption.
Classification
Location:
Remote / Network Access
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Solution:
Upgrade
Exploit:
Exploit Public
Disclosure:
Vendor Verified,
Coordinated Disclosure
Solution
Upgrade to version 1.0.1a, 1.0.0i or 0.9.8v or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. IBM WebSphere DataPower Integration Appliance customers can upgrade to version 4.0.2.8.
