SkipNavigation
US-CERT
American Flag
  Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information


 
 View Notes By
  Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric



 Other Documents
  Technical Alerts

Technical Bulletins

Alerts

Security Tips

 

Vulnerability Note VU#465542

OpenSSL does not properly handle unknown message types

Overview

OpenSSL does not properly handle unknown message types, allowing an unauthenticated, remote attacker to cause a denial of service. This vulnerability was addressed in OpenSSL 0.9.6d and 0.9.7.

I. Description

OpenSSL implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols and includes a general purpose cryptographic library. SSL and TLS are commonly used to provide authentication, encryption, integrity, and non-repudiation services to network applications such as HTTP, IMAP, POP3, LDAP, and others.

OpenSSL prior to version 0.9.6d does not properly handle unknown message types. An attacker could cause the application using OpenSSL to enter an infinite loop, resulting in a denial of service.

Further information is available in NISCC/224012/OpenSSL/3.

II. Impact

An unauthenticated, remote attacker could cause a denial of service in an application that uses OpenSSL.

III. Solution

Upgrade or Patch

This vulnerability was addressed in OpenSSL versions 0.9.6d and 0.9.7. Upgrade to OpenSSL version 0.9.6d or 0.9.7 greater. Alternatively, upgrade or apply a patch as specified by your vendor. Note that it is necessary to recompile any applications that are statically linked to OpenSSL libraries.

Systems Affected

VendorStatusDate NotifiedDate Updated
3ComUnknown18-Mar-2004
AlcatelUnknown18-Mar-2004
ApacheUnknown18-Mar-2004
Apache-SSLUnknown18-Mar-2004
Apple Computer Inc.Not Vulnerable6-May-2005
AT&TUnknown18-Mar-2004
AvayaUnknown18-Mar-2004
BorderwareUnknown18-Mar-2004
CerticomUnknown18-Mar-2004
Check PointUnknown18-Mar-2004
Cisco Systems Inc.Vulnerable18-Mar-2004
ClavisterUnknown18-Mar-2004
Computer AssociatesUnknown18-Mar-2004
ConectivaUnknown18-Mar-2004
CovalentUnknown18-Mar-2004
Cray Inc.Unknown18-Mar-2004
D-Link SystemsUnknown18-Mar-2004
Dan BernsteinUnknown18-Mar-2004
DebianVulnerable18-Mar-2004
EMC CorporationUnknown18-Mar-2004
eSoftUnknown18-Mar-2004
Extreme NetworksUnknown18-Mar-2004
F-SecureUnknown18-Mar-2004
F5 NetworksUnknown18-Mar-2004
Foundry Networks Inc.Unknown18-Mar-2004
FreeBSDUnknown18-Mar-2004
FreeS/WANUnknown18-Mar-2004
FujitsuUnknown18-Mar-2004
Gentoo LinuxVulnerable18-Mar-2004
Global Technology AssociatesUnknown18-Mar-2004
Guardian Digital Inc. Vulnerable18-Mar-2004
Hewlett-Packard CompanyUnknown18-Mar-2004
HitachiUnknown18-Mar-2004
IBMUnknown18-Mar-2004
Ingrian NetworksUnknown18-Mar-2004
IntelUnknown18-Mar-2004
Internet Initiative Japan (IIJ)Unknown18-Mar-2004
IntotoUnknown18-Mar-2004
IP FilterUnknown18-Mar-2004
Juniper NetworksUnknown18-Mar-2004
KAME ProjectUnknown18-Mar-2004
LinksysUnknown18-Mar-2004
Lotus SoftwareUnknown18-Mar-2004
Lucent TechnologiesUnknown18-Mar-2004
Lucent TechnologiesUnknown18-Mar-2004
MandrakeSoftUnknown18-Mar-2004
Microsoft CorporationUnknown18-Mar-2004
MontaVista SoftwareUnknown18-Mar-2004
Multi-Tech Systems Inc.Unknown18-Mar-2004
National Center for Supercomputing Applications (NCSA)Unknown18-Mar-2004
National Institute of Standards and Technology (NIST)Unknown18-Mar-2004
NEC CorporationUnknown18-Mar-2004
NetBSDUnknown18-Mar-2004
NetfilterUnknown18-Mar-2004
NetScreenVulnerable18-Mar-2004
Network ApplianceUnknown18-Mar-2004
Network AssociatesUnknown18-Mar-2004
NokiaUnknown18-Mar-2004
Nortel NetworksUnknown18-Mar-2004
NovellUnknown18-Mar-2004
OpenBSDUnknown18-Mar-2004
OpenSSLVulnerable17-Mar-2004
Openwall GNU/*/LinuxUnknown18-Mar-2004
Red Hat Inc.Vulnerable18-Mar-2004
Redback Networks Inc.Unknown18-Mar-2004
Riverstone NetworksUnknown18-Mar-2004
SafeNetUnknown18-Mar-2004
SCOUnknown18-Mar-2004
Secure Computing CorporationUnknown18-Mar-2004
SecureWorxUnknown18-Mar-2004
SGIUnknown18-Mar-2004
Sony CorporationUnknown18-Mar-2004
SSH Communications SecurityUnknown18-Mar-2004
StonesoftUnknown18-Mar-2004
Sun Microsystems Inc.Unknown18-Mar-2004
SuSE Inc.Unknown18-Mar-2004
Symantec CorporationUnknown18-Mar-2004
TurboLinuxUnknown18-Mar-2004
UnisysUnknown18-Mar-2004
WatchGuardUnknown18-Mar-2004
Wind River Systems Inc.Unknown18-Mar-2004
WirexUnknown18-Mar-2004
ZyXELUnknown18-Mar-2004

References

http://www.us-cert.gov/cas/techalerts/TA04-078A.html
http://www.openssl.org
http://www.uniras.gov.uk/vuls/2004/224012/index.htm
http://cvs.openssl.org/chngview?cn=5721
http://cvs.openssl.org/chngview?cn=5722
http://cvs.openssl.org/getfile?v=1.618.2.137&f=openssl/CHANGES
http://cvs.openssl.org/getfile?v=1.954&f=openssl/CHANGES

Credit

This vulnerability was reported by the OpenSSL Project and the U.K. National Infrastructure Security Co-ordination Centre (NISCC).

This document was written by Damon Morda and Art Manion.

Other Information

Date Public:2004-03-17
Date First Published:2004-03-17
Date Last Updated:2005-05-06
CERT Advisory: 
CVE-ID(s):CAN-2004-0081
NVD-ID(s):CAN-2004-0081
US-CERT Technical Alerts: 
Metric:5.16
Document Revision:27

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

 
Page Corner Image
Copyright 2004 Carnegie Mellon University
Disclaimers and copyright information
Get Adobe Reader Get Adobe Reader