CVE-2003-0544

OpenSSL 0.9.6 and 0.9.7 does not properly track the number of characters in certain ASN.1 inputs, which allows remote attackers to cause a denial of service crash via an SSL client certificate that causes OpenSSL to read past the end of a buffer when the long form is used...

CVE-2003-0544

OpenSSL 0.9.6 and 0.9.7 are affected by DoS vulnerabilities stemming from ASN.1 parsing issues, specifically CVE-2003-0544 (incorrect character counting in long-form ASN.1 inputs causing a crash via an SSL client certificate) and CVE-2003-0543 (integer overflow in ASN.1 handling). Affected produc...

CVE-2003-0544

OpenSSL 0.9.6 and 0.9.7 does not properly track the number of characters in certain ASN.1 inputs, which allows remote attackers to cause a denial of service crash via an SSL client certificate that causes OpenSSL to read past the end of a buffer when the long form is used...

CVE-2003-0545

Double free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via an SSL client certificate with a certain invalid ASN.1 encoding...

OpenSSL security update

Upgraded OpenSSL packages are available for Slackware 8.1, 9.0, 9.1, and -current. These fix problems with ASN.1 parsing which could lead to a denial of service. It is not known whether the problems could lead to the running of malicious code on the server, but it has not been ruled out. We...

OpenSSL contains integer overflow handling ASN.1 tags (2)

Overview A vulnerability in the way OpenSSL handles ASN.1 tags could allow a remote attacker to cause a denial of service. Description OpenSSL implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols and includes a general purpose cryptographic library. SSL and TLS are...

OpenSSL ASN.1 Parsing Vulnerabilities

Description Multiple vulnerabilities were reported in the ASN.1 parsing code in OpenSSL. Attackers could exploit these issues to cause a denial of service or to execute arbitrary code. Technologies Affected Apple Mac OS X 10.2.0 Apple Mac OS X 10.2.1 Apple Mac OS X 10.2.2 Apple Mac OS X 10.2.3...

Vulnerability in OpenSSL CVE-2003-0545

Certain ASN.1 encodings that were rejected as invalid by the parser could trigger a bug in the deallocation of the corresponding data structure, corrupting the stack, leading to a crash. Found by NISCC...

[Full-Disclosure] [OpenSSL Advisory] Vulnerabilities in ASN.1 parsing

-----BEGIN PGP SIGNED MESSAGE----- OpenSSL Security Advisory 30 September 2003 Vulnerabilities in ASN.1 parsing ================================ NISCC www.niscc.gov.uk prepared a test suite to check the operation of SSL/TLS software when presented with a wide range of malformed client certificate...

(RHSA-2003:293) openssl security update

OpenSSL is a commercial-grade, full-featured, and open source toolkit that implements Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocols as well as a full-strength general purpose cryptography library. NISCC testing of implementations of the SSL protocol uncovered two bu...

OpenSSL contains integer overflow handling ASN.1 tags (1)

Overview A vulnerability in the way OpenSSL handles ASN.1 tags could allow a remote attacker to cause a denial of service. Description OpenSSL implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols and includes a general purpose cryptographic library. SSL and TLS are...

Vulnerability in OpenSSL CVE-2003-0544

Incorrect tracking of the number of characters in certain ASN.1 inputs could allow remote attackers to cause a denial of service crash by sending an SSL client certificate that causes OpenSSL to read past the end of a buffer when the long form is used. Found by NISCC...

Multiple vulnerabilities in SSL/TLS implementations

Overview Multiple vulnerabilities exist in different vendors' SSL/TLS implementations. The impacts of these vulnerabilities include remote execution of arbitrary code, denial of service, and disclosure of sensitive information. Description The U.K. National Infrastructure Security Co-ordination...

OpenSSL ASN.1 parser insecure memory deallocation

Overview A vulnerability in the way OpenSSL deallocates memory used to store ASN.1 structures could allow a remote attacker to execute arbitrary code with the privileges of the process using the OpenSSL library. Description OpenSSL implements the Secure Sockets Layer SSL and Transport Layer...

CVE-2003-0430

The SPNEGO dissector in Ethereal 0.9.12 and earlier allows remote attackers to cause a denial of service crash via an invalid ASN.1 value...

CVE-2003-0430

CVE-2003-0430 concerns Ethereal (Wireshark) 0.9.12 and earlier, where the SPNEGO dissector is vulnerable to processing an invalid ASN.1 value. This can allow remote attackers to cause a denial of service (crash). The affected component is the SPNEGO dissector within Ethereal’s protocol analyzer. ...

CVE-2002-0036

Integer signedness error in MIT Kerberos V5 ASN.1 decoder before krb5 1.2.5 allows remote attackers to cause a denial of service via a large unsigned data element length, which is later used as a negative value...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS. Integer signedness error in MIT Kerberos V5 ASN.1 decoder before krb5 1.2.5 allows remote attackers to cause a denial of service via a large unsigned data element length, which is later used as a negative value...

MIT Kerberos V5 ASN.1 decoder fails to perform bounds checking on data element length fields

Overview The MIT Kerberos V5 implementation contains an ASN.1 decoding flaw that may allow remote attackers to crash affected Kerberos applications. Description Kerberos V5 protocol messages are defined using Abstract Syntax Notation One ASN.1, a formal language that allows protocol specification...

Advisory CA-2002-23 Multiple Vulnerabilities In OpenSSL

-----BEGIN PGP SIGNED MESSAGE----- CERT Advisory CA-2002-23 Multiple Vulnerabilities In OpenSSL Original release date: July 30, 2002 Last revised: -- Source: CERT/CC A complete revision history can be found at the end of this file. Systems Affected OpenSSL prior to 0.9.6e, up to and including...