Vulnerability Note VU#104280
Multiple vulnerabilities in SSL/TLS implementations
Multiple vulnerabilities exist in different vendors' SSL/TLS implementations. The impacts of these vulnerabilities include remote execution of arbitrary code, denial of service, and disclosure of sensitive information.
The U.K. National Infrastructure Security Co-ordination Centre (NISCC) has reported multiple vulnerabilities in different vendors' implementations of the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. SSL and TLS are commonly used to provide authentication, encryption, integrity, and non-repudiation services to network applications such as HTTP, IMAP, POP3, LDAP, and others. Clients and servers exchange authentication information in X.509 certificates. While the SSL and TLS protocols do not use ASN.1/BER to communicate at the application layer, they do require an ASN.1 parser to encode and decode X.509 certificates and other cryptographic elements (e.g., PKCS#1 encoded RSA values and PKCS#7 encoded S/MIME parts) at the presentation layer.
A test suite developed by NISCC has exposed vulnerabilities in a variety of SSL/TLS implementations. While most of these vulnerabilities exist in ASN.1 parsing routines, some vulnerabilities may occur elsewhere. Note that cryptographic libraries that implement SSL/TLS frequently provide more general-purpose cryptographic utility. In such libraries, it is common for ASN.1 parsing code to be shared between SSL/TLS and other cryptographic functions.
The impacts associated with these vulnerabilities include execution of arbitrary code, denial of service, and disclosure of sensitive information.
Patch or Upgrade
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|AppGate Network Security AB||Affected||30 Sep 2003||01 Oct 2003|
|Apple Computer Inc.||Affected||30 Sep 2003||01 Oct 2003|
|Check Point||Affected||30 Sep 2003||22 Oct 2003|
|Cisco Systems Inc.||Affected||30 Sep 2003||02 Oct 2003|
|Conectiva||Affected||30 Sep 2003||02 Oct 2003|
|Cray Inc.||Affected||30 Sep 2003||01 Oct 2003|
|Debian||Affected||30 Sep 2003||08 Oct 2003|
|F5 Networks||Affected||30 Sep 2003||01 Oct 2003|
|FreeBSD||Affected||30 Sep 2003||22 Oct 2003|
|Gentoo Linux||Affected||-||02 Oct 2003|
|Guardian Digital Inc.||Affected||30 Sep 2003||02 Oct 2003|
|Hewlett-Packard Company||Affected||30 Sep 2003||23 Oct 2003|
|Hitachi||Affected||30 Sep 2003||11 Nov 2003|
|IBM||Affected||30 Sep 2003||01 Oct 2003|
|Ingrian Networks||Affected||30 Sep 2003||01 Oct 2003|
CVSS Metrics (Learn More)
This vulnerability was discovered and researched by NISCC.
This document was written by Art Manion.
- CVE IDs: Unknown
- CERT Advisory: CA-2003-26
- Date Public: 30 Sep 2003
- Date First Published: 30 Sep 2003
- Date Last Updated: 25 Aug 2004
- Severity Metric: 11.81
- Document Revision: 26
If you have feedback, comments, or additional information about this vulnerability, please send us email.