Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveMitreCVE-2007-5135
HistorySep 27, 2007 - 8:17 p.m.

CVE-2007-5135

2007-09-2720:17:00
CWE-189
mitre
web.nvd.nist.gov
106
cve-2007-5135
ssl
openssl
security vulnerability
remote code execution
buffer underflow
nvd

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

8.4

Confidence

High

EPSS

0.964

Percentile

99.6%

JSON

Off-by-one error in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 up to 0.9.7l, and 0.9.8 up to 0.9.8f, might allow remote attackers to execute arbitrary code via a crafted packet that triggers a one-byte buffer underflow. NOTE: this issue was introduced as a result of a fix for CVE-2006-3738. As of 20071012, it is unknown whether code execution is possible.

Affected configurations

Nvd
Node
opensslopensslMatch0.9.7
OR
opensslopensslMatch0.9.7beta1
OR
opensslopensslMatch0.9.7beta2
OR
opensslopensslMatch0.9.7beta3
OR
opensslopensslMatch0.9.7beta4
OR
opensslopensslMatch0.9.7beta5
OR
opensslopensslMatch0.9.7beta6
OR
opensslopensslMatch0.9.7a
OR
opensslopensslMatch0.9.7b
OR
opensslopensslMatch0.9.7c
OR
opensslopensslMatch0.9.7d
OR
opensslopensslMatch0.9.7e
OR
opensslopensslMatch0.9.7f
OR
opensslopensslMatch0.9.7g
OR
opensslopensslMatch0.9.7h
OR
opensslopensslMatch0.9.7i
OR
opensslopensslMatch0.9.7j
OR
opensslopensslMatch0.9.7k
OR
opensslopensslMatch0.9.7l
OR
opensslopensslMatch0.9.8
OR
opensslopensslMatch0.9.8a
OR
opensslopensslMatch0.9.8b
OR
opensslopensslMatch0.9.8c
OR
opensslopensslMatch0.9.8d
OR
opensslopensslMatch0.9.8e
OR
opensslopensslMatch0.9.8f
VendorProductVersionCPE
opensslopenssl0.9.7cpe:2.3:a:openssl:openssl:0.9.7:*:*:*:*:*:*:*
opensslopenssl0.9.7cpe:2.3:a:openssl:openssl:0.9.7:beta1:*:*:*:*:*:*
opensslopenssl0.9.7cpe:2.3:a:openssl:openssl:0.9.7:beta2:*:*:*:*:*:*
opensslopenssl0.9.7cpe:2.3:a:openssl:openssl:0.9.7:beta3:*:*:*:*:*:*
opensslopenssl0.9.7cpe:2.3:a:openssl:openssl:0.9.7:beta4:*:*:*:*:*:*
opensslopenssl0.9.7cpe:2.3:a:openssl:openssl:0.9.7:beta5:*:*:*:*:*:*
opensslopenssl0.9.7cpe:2.3:a:openssl:openssl:0.9.7:beta6:*:*:*:*:*:*
opensslopenssl0.9.7acpe:2.3:a:openssl:openssl:0.9.7a:*:*:*:*:*:*:*
opensslopenssl0.9.7bcpe:2.3:a:openssl:openssl:0.9.7b:*:*:*:*:*:*:*
opensslopenssl0.9.7ccpe:2.3:a:openssl:openssl:0.9.7c:*:*:*:*:*:*:*
Rows per page:
1-10 of 261

References

Related

ubuntucve 2
cvelist 2
checkpoint_advisories 1
freebsd_advisory 2
debiancve 2
nvd 2
prion 1
nessus 59
openvas 70
checkpoint_security 3
altlinux 6
osv 3
debian 7
openssl 2
gentoo 3
fedora 2
redhat 4
centos 6
ubuntu 2
oraclelinux 5
securityvulns 3
f5 4
vmware 4
cve 1
suse 1
slackware 1
freebsd 1
ubuntucve
ubuntucve
CVE-2007-5135
2007-09-27 00:00:00
CVE-2006-3738
2006-09-28 00:00:00
cvelist
cvelist
CVE-2007-5135
2007-09-27 20:00:00
CVE-2006-3738
2006-09-28 18:00:00
checkpoint_advisories
checkpoint_advisories
OpenSSL SSL_get_shared_ciphers Function Off-by-one Buffer Overflow (CVE-2006-3738; CVE-2007-5135)
2008-01-20 00:00:00
freebsd_advisory
freebsd_advisory
FreeBSD-SA-07:08.openssl
2007-10-03 00:00:00
FreeBSD-SA-06:23.openssl
2006-09-28 00:00:00
debiancve
debiancve
CVE-2007-5135
2007-09-27 20:17:00
CVE-2006-3738
2006-09-28 18:07:00
nvd
nvd
CVE-2007-5135
2007-09-27 20:17:00
CVE-2006-3738
2006-09-28 18:07:00
prion
prion
Buffer overflow
2007-09-27 20:17:00
nessus
nessus
OpenSSL < 0.9.7m / 0.9.8e Buffer Overflow (deprecated)
2012-01-04 00:00:00
SuSE 10 Security Update : compat-openssl097g (ZYPP Patch Number 5055)
2008-03-07 00:00:00
SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 4477)
2007-12-13 00:00:00
openvas
openvas
FreeBSD Security Advisory (FreeBSD-SA-07:08.openssl.asc)
2008-09-04 00:00:00
SLES9: Security update for OpenSSL
2009-10-10 00:00:00
SLES10: Security update for compat-openssl097g
2009-10-13 00:00:00
checkpoint_security
checkpoint_security
OpenSSLVulnerability CVE-2007-5135 on IPSO 4.2
2008-08-04 21:00:00
Check Point response to OpenSSL vulnerability CVE-2007-5135
2007-10-15 22:00:00
Check Point response to OpenSSL vulnerability CVE-2006-3738
2007-10-27 22:00:00
altlinux
altlinux
Security fix for the ALT Linux 8 package openssl10 version 0.9.8d-alt4
2007-10-10 00:00:00
Security fix for the ALT Linux 9 package openssl10 version 0.9.8d-alt4
2007-10-10 00:00:00
Security fix for the ALT Linux 9 package openssl1.1 version 0.9.8d-alt4
2007-10-10 00:00:00
osv
osv
openssl - arbitrary code execution
2007-10-02 00:00:00
openssl096
2006-10-10 00:00:00
openssl
2006-09-28 00:00:00
debian
debian
[SECURITY] [DSA 1379-1] New openssl packages fix arbitrary code execution
2007-10-02 20:06:48
[SECURITY] [DSA 1379-1] New openssl packages fix arbitrary code execution
2007-10-02 20:06:48
[SECURITY] [DSA 1379-2] New openssl packages fix arbitrary code execution
2007-10-10 17:59:21
openssl
openssl
Vulnerability in OpenSSL CVE-2007-5135
2007-10-12 00:00:00
Vulnerability in OpenSSL CVE-2006-3738
2006-09-28 00:00:00
gentoo
gentoo
OpenSSL: Multiple vulnerabilities
2007-10-07 00:00:00
OpenSSL: Multiple vulnerabilities
2006-10-24 00:00:00
AMD64 x86 emulation base libraries: OpenSSL multiple vulnerabilities
2006-12-11 00:00:00
fedora
fedora
[SECURITY] Fedora Core 6 Update: openssl-0.9.8b-15.fc6
2007-10-15 20:05:56
[SECURITY] Fedora 7 Update: openssl-0.9.8b-15.fc7
2007-10-18 02:26:18
redhat
redhat
(RHSA-2007:1003) Moderate: openssl security and bug fix update
2007-11-15 00:00:00
(RHSA-2007:0813) Moderate: openssl security update
2007-10-22 00:00:00
(RHSA-2007:0964) Important: openssl security update
2007-10-12 00:00:00
centos
centos
openssl security update
2007-11-15 15:53:13
openssl security update
2007-10-23 23:23:09
openssl security update
2007-10-22 12:29:21
ubuntu
ubuntu
openssl vulnerabilities
2007-09-28 00:00:00
openssl vulnerabilities
2006-09-29 00:00:00
oraclelinux
oraclelinux
openssl security and bug fix update
2007-11-27 00:00:00
Moderate: openssl security update
2007-10-22 00:00:00
Important: openssl security update
2007-10-12 00:00:00
securityvulns
securityvulns
Mozilla/5.0 &#40;Windows; U; Windows NT 5.1; en-US; rv:1.8.1.3&#41; Gecko/20070326 Thunderbird/2.0.0.0 Mnenhy/0.7.4.0
2007-10-13 00:00:00
VMSA-2008-0001 Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages
2008-01-08 00:00:00
[OpenPKG-SA-2006.021] OpenPKG Security Advisory &#40;openssl&#41;
2006-09-29 00:00:00
f5
f5
K8106 : OpenSSL SSL_get_shared_ciphers vulnerability CVE-2007-5135
2013-03-27 00:00:00
SOL8106 - OpenSSL SSL_get_shared_ciphers vulnerability CVE-2007-5135
2007-11-15 00:00:00
SOL6734 - Local OpenSSL vulnerabilities VU#547300 and VU#386964, CAN-2006-3738, CAN-2006-2940, CAN-2006-2937, CAN-2006-4343
2007-05-16 00:00:00
vmware
vmware
Updated ESX packages for OpenSSL, net-snmp, perl
2008-08-12 00:00:00
Updated ESX packages for OpenSSL, net-snmp, perl
2008-08-12 00:00:00
Updated service console patches.
2008-01-07 00:00:00
cve
cve
CVE-2006-3738
2006-09-28 18:07:00
suse
suse
remote denial of service in openssl
2006-09-28 16:40:53
slackware
slackware
[slackware-security] openssl
2006-09-29 07:57:13
freebsd
freebsd
OpenSSL -- Multiple problems in crypto(3)
2006-09-28 00:00:00

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

8.4

Confidence

High

EPSS

0.964

Percentile

99.6%

JSON
Related for CVE-2007-5135
ubuntucve2cvelist2checkpoint_advisories1freebsd_advisory2debiancve2nvd2prion1nessus59openvas70checkpoint_security3altlinux6osv3debian7openssl2gentoo3fedora2redhat4centos6ubuntu2oraclelinux5securityvulns3f54vmware4cve1suse1slackware1freebsd1