Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
Производитель ПО
Описание
OpenSSL содержит уязвимость, которая может позволять удаленно вызвать отказ в обслуживании. Эта уязвимость возникает, когда отправляется TLS-сообщение неизвестного типа, что ведет к зацикливанию и, в результате, к недоступности OpenSSL или приложения, работающего с ним.
Как исправить
Для устранения уязвимости необходимо установить последнюю версию продукта, соответствующую используемой платформе. Необходимую информацию можно получить по адресу:
http://openssl.org/
http://openssl.org/
Ссылки
CERT (OpenSSL does not properly handle unknown message types): http://www.kb.cert.org/vuls/id/465542
ISS X-Force (OpenSSL unknown TLS message types denial of service): http://xforce.iss.net/xforce/xfdb/15509
Security Focus (OpenSSL Denial of Service Vulnerabilities): http://www.securityfocus.com/bid/9899
BUGTRAQ (20040317 Re: New OpenSSL releases fix denial of service attacks [17 March 2004]): http://marc.theaimsgroup.com/?l=bugtraq&m=107955049331965&w=2
MISC (http://www.uniras.gov.uk/vuls/2004/224012/index.htm): http://www.uniras.gov.uk/vuls/2004/224012/index.htm
CONECTIVA (CLA-2004:834): http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000834
ENGARDE (ESA-20040317-003): http://www.linuxsecurity.com/advisories/engarde_advisory-4135.html
DEBIAN (DSA-465): http://www.debian.org/security/2004/dsa-465
REDHAT (RHSA-2004:119): http://rhn.redhat.com/errata/RHSA-2004-119.html
REDHAT (RHSA-2004:121): http://www.redhat.com/support/errata/RHSA-2004-121.html
SCO (SCOSA-2004.10): ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.10/SCOSA-2004.10.txt
SGI (20040304-01-U): ftp://patches.sgi.com/support/free/security/advisories/20040304-01-U.asc
SUNALERT (57524): http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57524
BUGTRAQ (20040508 [FLSA-2004:1395] Updated OpenSSL resolves security vulnerability): http://marc.theaimsgroup.com/?l=bugtraq&m=108403850228012&w=2
CERT (TA04-078A): http://www.us-cert.gov/cas/techalerts/TA04-078A.html
OVAL (OVAL871): http://oval.mitre.org/oval/definitions/data/oval871.html
OVAL (OVAL902): http://oval.mitre.org/oval/definitions/data/oval902.html
CISCO (20040317 Cisco OpenSSL Implementation Vulnerability): http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20040317-openssl
GENTOO (GLSA-200403-03): http://security.gentoo.org/glsa/glsa-200403-03.xml
REDHAT (RHSA-2004:120): http://www.redhat.com/support/errata/RHSA-2004-120.html
REDHAT (RHSA-2004:139): http://www.redhat.com/support/errata/RHSA-2004-139.html
TRUSTIX (2004-0012): http://www.trustix.org/errata/2004/0012
OVAL (oval:org.mitre.oval:def:871): http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:871
OVAL (oval:org.mitre.oval:def:902): http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:902
ISS X-Force (OpenSSL unknown TLS message types denial of service): http://xforce.iss.net/xforce/xfdb/15509
Security Focus (OpenSSL Denial of Service Vulnerabilities): http://www.securityfocus.com/bid/9899
BUGTRAQ (20040317 Re: New OpenSSL releases fix denial of service attacks [17 March 2004]): http://marc.theaimsgroup.com/?l=bugtraq&m=107955049331965&w=2
MISC (http://www.uniras.gov.uk/vuls/2004/224012/index.htm): http://www.uniras.gov.uk/vuls/2004/224012/index.htm
CONECTIVA (CLA-2004:834): http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000834
ENGARDE (ESA-20040317-003): http://www.linuxsecurity.com/advisories/engarde_advisory-4135.html
DEBIAN (DSA-465): http://www.debian.org/security/2004/dsa-465
REDHAT (RHSA-2004:119): http://rhn.redhat.com/errata/RHSA-2004-119.html
REDHAT (RHSA-2004:121): http://www.redhat.com/support/errata/RHSA-2004-121.html
SCO (SCOSA-2004.10): ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.10/SCOSA-2004.10.txt
SGI (20040304-01-U): ftp://patches.sgi.com/support/free/security/advisories/20040304-01-U.asc
SUNALERT (57524): http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57524
BUGTRAQ (20040508 [FLSA-2004:1395] Updated OpenSSL resolves security vulnerability): http://marc.theaimsgroup.com/?l=bugtraq&m=108403850228012&w=2
CERT (TA04-078A): http://www.us-cert.gov/cas/techalerts/TA04-078A.html
OVAL (OVAL871): http://oval.mitre.org/oval/definitions/data/oval871.html
OVAL (OVAL902): http://oval.mitre.org/oval/definitions/data/oval902.html
CISCO (20040317 Cisco OpenSSL Implementation Vulnerability): http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20040317-openssl
GENTOO (GLSA-200403-03): http://security.gentoo.org/glsa/glsa-200403-03.xml
REDHAT (RHSA-2004:120): http://www.redhat.com/support/errata/RHSA-2004-120.html
REDHAT (RHSA-2004:139): http://www.redhat.com/support/errata/RHSA-2004-139.html
TRUSTIX (2004-0012): http://www.trustix.org/errata/2004/0012
OVAL (oval:org.mitre.oval:def:871): http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:871
OVAL (oval:org.mitre.oval:def:902): http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:902
