OSVDB ID: 29261

Title: OpenSSL Crafted Public Key CPU Consumption DoS

Info

Disclosure
Sep 28, 2006

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Unknown

Description

 OpenSSL contains a flaw that may allow a remote denial of service. The issue is triggered when large values in X.509 certificates require extra time to process, and may result in loss of availability for the service.

Classification

 Location: Remote / Network Access
Attack Type: Denial of Service
Impact: Loss of Availability
Disclosure: OSVDB Verified, Vendor Verified

Solution

 Upgrade to version 0.9.7l, 0.9.8d or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

The OpenSSL Project

OpenSSL

 0.9.7
0.9.8

CyberGuard Corporation

SnapGear

 3.1.4u1

References

Credit
  • Dr. S. N. Henson - The OpenSSL Project
  • Open Network Security - Open Network Security


Direct URL: http://osvdb.org/29261