Информационная безопасность
[RU] switch to English


Уязвимости безопасности в OpenSSL
Опубликовано:8 января 2014 г.
Источник:
SecurityVulns ID:13478
Тип:библиотека
Уровень опасности:
6/10
Описание:MitM атаки против TLS 1.2, проблемы с некоторыми PRNG генераторами, DoS.
Затронутые продукты:OPENSSL : OpenSSL 1.0
CVE:CVE-2013-6450 (The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service (application crash) by interfering with packet delivery, related to ssl/d1_both.c and ssl/t1_enc.c.)
 CVE-2013-6449 (The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorrect data structure, which allows remote attackers to cause a denial of service (daemon crash) via crafted traffic from a TLS 1.2 client.)
 CVE-2013-4353 (The ssl3_take_mac function in ssl/s3_both.c in OpenSSL 1.0.1 before 1.0.1f allows remote TLS servers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Next Protocol Negotiation record in a TLS handshake.)
Оригинальный текстdocumentDEBIAN, [SECURITY] [DSA 2833-1] openssl security update (08.01.2014)

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород