Lucene search

K
freebsdFreeBSDFBC8413F-2F7A-11DE-9A3F-001B77D09812
HistoryMar 25, 2009 - 12:00 a.m.

FreeBSD -- remotely exploitable crash in OpenSSL

2009-03-2500:00:00
vuxml.freebsd.org
10

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.271 Low

EPSS

Percentile

96.7%

Problem Description
The function ASN1_STRING_print_ex does not properly validate
the lengths of BMPString or UniversalString objects before
attempting to print them.
Impact
An application which attempts to print a BMPString or
UniversalString which has an invalid length will crash as a
result of OpenSSL accessing invalid memory locations. This
could be used by an attacker to crash a remote application.
Workaround
No workaround is available, but applications which do not use
the ASN1_STRING_print_ex function (either directly or indirectly)
are not affected.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchfreebsd=ย 6.3UNKNOWN
FreeBSDanynoarchfreebsd<ย 6.3_10UNKNOWN

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.271 Low

EPSS

Percentile

96.7%