Veracode Vulnerability DatabaseVERACODE:10700Denial Of Service (DoS) Through Memory Consumption And Buffer Overflow
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
OpenSSL is vulnerable to denial of service (DoS) attacks and possible other attacks. These attacks are possible because the asn1_d2i_read_bio function doesn’t correctly interpret integer data which can be leveraged to do buffer overflow attacks or cause memory consumption.
References
archives.neohapsis.com/archives/fulldisclosure/2012-04/0209.html
cvs.openssl.org/chngview?cn=22431
cvs.openssl.org/chngview?cn=22434
cvs.openssl.org/chngview?cn=22439
lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
lists.fedoraproject.org/pipermail/package-announce/2012-April/079149.html
lists.fedoraproject.org/pipermail/package-announce/2012-April/079299.html
lists.fedoraproject.org/pipermail/package-announce/2012-May/080176.html
lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html
lists.opensuse.org/opensuse-security-announce/2012-05/msg00014.html
lists.opensuse.org/opensuse-security-announce/2012-05/msg00015.html
lists.opensuse.org/opensuse-security-announce/2012-09/msg00007.html
marc.info/?l=bugtraq&m=133728068926468&w=2
marc.info/?l=bugtraq&m=133951357207000&w=2
marc.info/?l=bugtraq&m=134039053214295&w=2
osvdb.org/81223
rhn.redhat.com/errata/RHSA-2012-0518.html
rhn.redhat.com/errata/RHSA-2012-0522.html
rhn.redhat.com/errata/RHSA-2012-1306.html
rhn.redhat.com/errata/RHSA-2012-1307.html
rhn.redhat.com/errata/RHSA-2012-1308.html
secunia.com/advisories/48847
secunia.com/advisories/48895
secunia.com/advisories/48899
secunia.com/advisories/48942
secunia.com/advisories/48999
secunia.com/advisories/57353
support.apple.com/kb/HT5784
www-01.ibm.com/support/docview.wss?uid=ssg1S1004564
www.collax.com/produkte/AllinOne-server-for-small-businesses#id2565578
www.debian.org/security/2012/dsa-2454
www.exploit-db.com/exploits/18756
www.mandriva.com/security/advisories?name=MDVSA-2012:060
www.openssl.org/news/secadv_20120419.txt
www.securityfocus.com/bid/53158
www.securitytracker.com/id?1026957
www.ubuntu.com/usn/USN-1424-1
access.redhat.com/security/updates/classification/#important
h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862
kb.juniper.net/KB27376
rhn.redhat.com/errata/RHSA-2012-0522.html
Related
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P