OpenSSL Security Advisory [17 March 2004]

OpenSSL Security Advisory 17 March 2004 Updated versions of OpenSSL are now available which correct two security issues: 1. Null-pointer assignment during SSL handshake =============================================== Testing performed by the OpenSSL group using the Codenomicon TLS Test Tool...

Multiple OpenSSL Vulnerabilities

Background The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured, and Open Source toolkit implementing the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocols as well as a full-strength general purpose cryptography library...

Security fix for the ALT Linux 9 package openssl10 version 0.9.6l-alt2

March 17, 2004 Dmitry V. Levin 0.9.6l-alt2 - Fixed null-pointer assignment during SSL handshake CAN-2004-0079...

Security fix for the ALT Linux 9 package openssl1.1 version 0.9.6l-alt2

March 17, 2004 Dmitry V. Levin 0.9.6l-alt2 - Fixed null-pointer assignment during SSL handshake CAN-2004-0079...

Security fix for the ALT Linux 8 package openssl10 version 0.9.6l-alt2

March 17, 2004 Dmitry V. Levin 0.9.6l-alt2 - Fixed null-pointer assignment during SSL handshake CAN-2004-0079...

OpenSSL ChangeCipherSpec denial-of-service vulnerability

A remote attacker could cause an application using OpenSSL to crash by performing a specially crafted SSL/TLS handshake...

CVE-2003-0625

Off-by-one error in certain versions of xfstt allows remote attackers to read potentially sensitive memory via a malformed client request in the connection handshake, which leaks the memory in the server's response...

DEBIAN-CVE-2003-0625

Off-by-one error in certain versions of xfstt allows remote attackers to read potentially sensitive memory via a malformed client request in the connection handshake, which leaks the memory in the server's response...

CVE-2003-0625

Off-by-one error in certain versions of xfstt allows remote attackers to read potentially sensitive memory via a malformed client request in the connection handshake, which leaks the memory in the server's response...

PT-2003-1036 · Xfstt · Xfstt

Name of the Vulnerable Software and Affected Versions: xfstt affected versions not specified Description: The issue is related to an off-by-one error in xfstt, allowing remote attackers to read potentially sensitive memory via a malformed client request in the connection handshake. This can lead ...

TCP/IP implementations handle unusual flag combinations inconsistently

Overview Various vendors' TCP/IP implementations handle packets containing unusual flag combinations in different ways, which may lead to a violation of implicit or explicit security policies. Description Background on TCP/IP Connection Semantics To establish a TCP connection, a client and server...

CVE-2002-1824

Microsoft Internet Explorer 6.0, when handling an expired CA-CERT in a webserver's certificate chain during a SSL/TLS handshake, does not prompt the user before searching for and finding a newer certificate, which may allow attackers to perform a man-in-the-middle attack. NOTE: it is not clear...

Nylon DoS

Closing client socket during SOCKS5 handshake causes server to hang with 100 CPU usage...

Kill a Unisys Clearpath with nmap port scan

Unisys "Clearpath" mainframes are very sensitive to the probes of nmap and similar programs. Basically, by only port-scanning not even fingerprinting, you can cause the entire machine to seize up. Yes, the whole machine...not just a job or the TCP/IP device. The problem may be occurring because t...

apache-linux.txt

/ LINUX X86 APACHE REMOTE EXPLOIT!!!!!!!!! This is the unpublished source for apache OpenSSL handshake exploit. We obtained this exploit by modifying a circulating apache worm, created by contem@efnet BY nebunu compile: gcc -o apache-ex apache.ex.c -lcrypto run: ./apache-ex do not use hostname! u...

OpenSSL clients contain a buffer overflow during the SSL3 handshake process

Overview OpenSSL is an open-source implementation of the Secure Sockets Layer SSL protocol. A remotely exploitable vulnerability exists in OpenSSL clients that could lead to the execution of arbitrary code on the client's system. Description OpenSSL clients using SSLv3 prior to version 0.9.6e and...

OpenSSL servers contain a buffer overflow during the SSL2 handshake process

Overview OpenSSL is an open-source implementation of the Secure Sockets Layer SSL protocol. A remotely exploitable vulnerability exists in OpenSSL servers that could lead to the execution of arbitrary code on the server. Description Versions of OpenSSL servers prior to 0.9.6e and pre-release...

OpenSSL servers contain a remotely exploitable buffer overflow vulnerability during the SSL3 handshake process

Overview OpenSSL is an open-source implementation of the Secure Sockets Layer SSL protocol. A remotely exploitable vulnerability exists in OpenSSL servers that could lead to the execution of arbitrary code on the system Description Servers running OpenSSL pre-release version 0.9.7 with Kerberos...

CVE-2000-0211

The Windows Media server allows remote attackers to cause a denial of service via a series of client handshake packets that are sent in an improper sequence, aka the "Misordered Windows Media Services Handshake" vulnerability...

CVE-2000-0211

The Windows Media server allows remote attackers to cause a denial of service via a series of client handshake packets that are sent in an improper sequence, aka the "Misordered Windows Media Services Handshake" vulnerability...