OpenSSL's ASN.1 parser contains a flaw that may allow a malicious user to cause Denial of Service conditions. The issue is triggered when invalid ASN.1 encodings are supplied to the parser. It is possible that the flaw may allow crashing of OpenSSL, resulting in a loss of availability.
Classification
Location:
Local Access Required,
Remote / Network Access
Attack Type:
Denial of Service,
Input Manipulation
Impact:
Loss of Availability
Exploit:
Exploit Public
Solution
Upgrade to version 0.9.6e or higher and recompile all applications that were statically linked to OpenSSL, as that has been reported to fix this vulnerability. It is also possible to correct the flaw by applying the vendor-supplied patch to affected versions.
mercury.co.il -
