OSVDB ID: 3943

Title: OpenSSL ASN.1 Parser Invalid Encoding Handling Remote DoS

Info

Disclosure
Jul 30, 2002

Discovery
Unknown

Dates

Exploit
Jul 30, 2002

Solution
Unknown

Description

 OpenSSL's ASN.1 parser contains a flaw that may allow a malicious user to cause Denial of Service conditions. The issue is triggered when invalid ASN.1 encodings are supplied to the parser. It is possible that the flaw may allow crashing of OpenSSL, resulting in a loss of availability.

Classification

 Location: Local Access Required, Remote / Network Access
Attack Type: Denial of Service, Input Manipulation
Impact: Loss of Availability
Exploit: Exploit Public

Solution

 Upgrade to version 0.9.6e or higher and recompile all applications that were statically linked to OpenSSL, as that has been reported to fix this vulnerability. It is also possible to correct the flaw by applying the vendor-supplied patch to affected versions.

Products

OpenSSL Project

OpenSSL

 0.9.1x
0.9.2x
0.9.3x
0.9.4x
0.9.5x
0.9.6
0.9.6a
0.9.6b
0.9.6c
0.9.6d
0.9.7-beta1
0.9.7-beta2

Novell, Inc.

iManager

 2.02

References

Credit
  • Adi Stav - stavmercury.co.il -
  • James Yonan - jimntlp.com -


Direct URL: http://osvdb.org/3943