CVE-2003-0078

ssl3getrecord in s3pkt.c for OpenSSL before 0.9.7a and 0.9.6 before 0.9.6i does not perform a MAC computation if an incorrect block cipher padding is used, which causes an information leak timing discrepancy that may make it easier to launch cryptographic attacks that rely on distinguishing betwe...

Mandrake Linux Security Advisory : openssl (MDKSA-2003:035)

Researchers discovered a timing-based attack on RSA keys that OpenSSL is generally vulnerable to, unless RSA blinding is enabled. Patches from the OpenSSL team have been applied to turn RSA blinding on by default. An extension of the 'Bleichenbacher attack' on RSA with PKS 1 v1.5 padding as used ...

SUSE-SA:2003:011: openssl

The remote host is missing the patch for the advisory SUSE-SA:2003:011 openssl. OpenSSL is an implementation of the Secure Sockets Layer and Transport Layer Security protocols and provides strong cryptography for many applications in a Linux system. It is a default package in all SUSE products. A...

Apache OpenSSL buffer overflow

Buffer overflow if SSLOptions +FakeBasicAuth is used...

OpenSSL DoS

NULL pointer and uninitialized memory reference during SSL/TLS handshake...

CVE-2004-0079

The dochangecipherspec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service crash via a crafted SSL/TLS handshake that triggers a null dereference...

CVE-2004-0079

The dochangecipherspec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service crash via a crafted SSL/TLS handshake that triggers a null dereference...

CVE-2004-0081

OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service infinite loop, as demonstrated using the Codenomicon TLS Test Tool...

CVE-2004-0079

The dochangecipherspec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service crash via a crafted SSL/TLS handshake that triggers a null dereference...

Cisco OpenSSL Implementation Vulnerability

...

OpenSSL does not properly handle unknown message types

Overview OpenSSL does not properly handle unknown message types, allowing an unauthenticated, remote attacker to cause a denial of service. This vulnerability was addressed in OpenSSL 0.9.6d and 0.9.7. Description OpenSSL implements the Secure Sockets Layer SSL and Transport Layer Security TLS...

FreeBSD-SA-04:05.openssl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-04:05.openssl Security Advisory The FreeBSD Project Topic: Denial-of-service vulnerability in OpenSSL Category: crypto Module: openssl Announced: 2004-03-17...

OpenSSL contains null-pointer assignment in do_change_cipher_spec() function

Overview OpenSSL contains a null-pointer assignment in the dochangecipherspec function which could allow a remote, unauthenticated attacker to cause OpenSSL to crash. Description OpenSSL implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols and includes a general...

OpenSSL does not adequately validate length of Kerberos ticket during SSL/TLS handshake

Overview OpenSSL contains a vulnerability in code that processes SSL/TLS handshakes when configured to use the Kerberos cipher suites. This vulnerability could allow a remote attacker to cause OpenSSL to crash. Description OpenSSL implements the Secure Sockets Layer SSL and Transport Layer Securi...

Vulnerability in OpenSSL CVE-2004-0079

The Codenomicon TLS Test Tool uncovered a null-pointer assignment in the dochangecipherspec function. A remote attacker could perform a carefully crafted SSL/TLS handshake against a server that used the OpenSSL library in such a way as to cause a crash. Found by OpenSSL group...

OpenSSL < 0.9.6m / 0.9.7d Multiple Remote DoS

According to its banner, the remote host is using a version of OpenSSL which is older than 0.9.6m / 0.9.7d. There are several bugs in such versions that may allow an attacker to cause a denial of service against the remote host. C Tenable Network Security, Inc. include"compat.inc"; ifdescription...

OpenSSL ChangeCipherSpec denial-of-service vulnerability

A remote attacker could cause an application using OpenSSL to crash by performing a specially crafted SSL/TLS handshake...

CVE-2003-0851

OpenSSL 0.9.6k allows remote attackers to cause a denial of service crash via large recursion via malformed ASN.1 sequences...

CVE-2003-0544

OpenSSL 0.9.6 and 0.9.7 does not properly track the number of characters in certain ASN.1 inputs, which allows remote attackers to cause a denial of service crash via an SSL client certificate that causes OpenSSL to read past the end of a buffer when the long form is used...

CVE-2003-0545

Double free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via an SSL client certificate with a certain invalid ASN.1 encoding...