CERT-In Advisory
CIAD-2006-0036
Multiple vulnerabilities in OpenSSL
Original Issue Date: September 29, 2006
Severity Rating: Medium
Systems Affected
Overview
Multiple vulnerabilities have been reported in 'OpenSSL' which could be exploited by remote attackers to execute arbitrary code cause denial of service attack.
Description
1. OpenSSL invalid ASN.1 handling vulnerability
(
CVE-2006-2937
)
A vulnerability has been reported in OpenSSL due to an infinite loop while handling invalid ASN.1. This could be exploited by attacker to cause denial of service attacks.
2. OpenSSL public keys handling vulnerability
(
CVE-2006-2940
)
A vulnerability has been reported in OpenSSL while processing of certain public keys that requires more time to process. This could be exploited by remote attackers to cause denial of service attack.
3. Buffer overflow vulnerability in "SSL_get_shared_ciphers " function
(
CVE-2006-3738
)
A buffer overflow vulnerability has been reported in the "SSL_get_shared_ciphers " function while handling specially crafted list of ciphers. This could be exploited by remote attackers to potentially compromise a vulnerable system.
4. SSLv2 client code vulnerability
(
CVE-2006-4343
)
An unspecified vulnerability has been reported in the SSLv2 client code which could be exploited by remote attacker cause Denial of Service attack or crash the client .
Solution
Upgrade to OpenSSL
http://www.openssl.org/source/
Vendor Information
OpenSSL
http://www.openssl.org/news/secadv_20060928.txt
References
RedHat
https://rhn.redhat.com/errata/RHSA-2006-0695.html
FrSIRT- ADV-2006-3820
http://www.frsirt.com/english/advisories/2006/3820 20
Secunia
http://secunia.com/advisories/22130/
CVE Name
CVE-2006-2937
CVE-2006-2940
CVE-2006-3738
CVE-2006-4343
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|