CVE-2010-0742

Published: Jun 3, 2010Modified: Apr 29, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

The Cryptographic Message Syntax (CMS) implementation in crypto/cms/cms_asn1.c in OpenSSL before 0.9.8o and 1.x before 1.0.0a does not properly handle structures that contain OriginatorInfo, which allows context-dependent attackers to modify invalid memory locations or conduct double-free attacks, and possibly execute arbitrary code, via unspecified vectors.

Affected (72)

Products: Openssl: Openssl

1 product

Configuration A

66 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Up to 0.9.8n
Openssl Openssl	Version 0.9.1c
Openssl Openssl	Version 0.9.2b
Openssl Openssl	Version 0.9.3
Openssl Openssl	Version 0.9.3a
Openssl Openssl	Version 0.9.4
Openssl Openssl	Version 0.9.5
Openssl Openssl	Version 0.9.5 beta1
Openssl Openssl	Version 0.9.5 beta2
Openssl Openssl	Version 0.9.5a
Openssl Openssl	Version 0.9.5a beta1
Openssl Openssl	Version 0.9.5a beta2
Openssl Openssl	Version 0.9.6
Openssl Openssl	Version 0.9.6 beta1
Openssl Openssl	Version 0.9.6 beta2
Openssl Openssl	Version 0.9.6 beta3
Openssl Openssl	Version 0.9.6a
Openssl Openssl	Version 0.9.6a beta1
Openssl Openssl	Version 0.9.6a beta2
Openssl Openssl	Version 0.9.6a beta3
Openssl Openssl	Version 0.9.6b
Openssl Openssl	Version 0.9.6c
Openssl Openssl	Version 0.9.6d
Openssl Openssl	Version 0.9.6e
Openssl Openssl	Version 0.9.6f
Openssl Openssl	Version 0.9.6g
Openssl Openssl	Version 0.9.6h
Openssl Openssl	Version 0.9.6i
Openssl Openssl	Version 0.9.6j
Openssl Openssl	Version 0.9.6k
Openssl Openssl	Version 0.9.6l
Openssl Openssl	Version 0.9.6m
Openssl Openssl	Version 0.9.7
Openssl Openssl	Version 0.9.7 beta1
Openssl Openssl	Version 0.9.7 beta2
Openssl Openssl	Version 0.9.7 beta3
Openssl Openssl	Version 0.9.7 beta4
Openssl Openssl	Version 0.9.7 beta5
Openssl Openssl	Version 0.9.7 beta6
Openssl Openssl	Version 0.9.7a
Openssl Openssl	Version 0.9.7b
Openssl Openssl	Version 0.9.7c
Openssl Openssl	Version 0.9.7d
Openssl Openssl	Version 0.9.7e
Openssl Openssl	Version 0.9.7f
Openssl Openssl	Version 0.9.7g
Openssl Openssl	Version 0.9.7h
Openssl Openssl	Version 0.9.7i
Openssl Openssl	Version 0.9.7j
Openssl Openssl	Version 0.9.7k
Openssl Openssl	Version 0.9.7l
Openssl Openssl	Version 0.9.7m
Openssl Openssl	Version 0.9.8
Openssl Openssl	Version 0.9.8a
Openssl Openssl	Version 0.9.8b
Openssl Openssl	Version 0.9.8c
Openssl Openssl	Version 0.9.8d
Openssl Openssl	Version 0.9.8e
Openssl Openssl	Version 0.9.8f
Openssl Openssl	Version 0.9.8g
Openssl Openssl	Version 0.9.8h
Openssl Openssl	Version 0.9.8i
Openssl Openssl	Version 0.9.8j
Openssl Openssl	Version 0.9.8k
Openssl Openssl	Version 0.9.8l
Openssl Openssl	Version 0.9.8m

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 1.0.0
Openssl Openssl	Version 1.0.0 beta1
Openssl Openssl	Version 1.0.0 beta2
Openssl Openssl	Version 1.0.0 beta3
Openssl Openssl	Version 1.0.0 beta4
Openssl Openssl	Version 1.0.0 beta5

Related CWEs

References (40)

http://cvs.openssl.org/chngview?cn=19693

Source: secalert@redhat.com

http://cvs.openssl.org/filediff?f=openssl/crypto/cms/cms_asn1.c&v1=1.8&v2=1.8.6.1

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=129138643405740&w=2

Source: secalert@redhat.com

http://rt.openssl.org/Ticket/Display.html?id=2211&user=guest&pass=guest

Source: secalert@redhat.com

http://secunia.com/advisories/40000

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/40024

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/42457

Source: secalert@redhat.com

http://secunia.com/advisories/42724

Source: secalert@redhat.com

http://secunia.com/advisories/42733

Source: secalert@redhat.com

http://secunia.com/advisories/57353

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564

Source: secalert@redhat.com

http://www.openssl.org/news/secadv_20100601.txt

Source: secalert@redhat.com

http://www.securityfocus.com/bid/40502

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2010/1313

Source: secalert@redhat.com

PatchVendor Advisory

http://www.vupen.com/english/advisories/2010/3105

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=598738

Source: secalert@redhat.com

https://kb.bluecoat.com/index?page=content&id=SA50

Source: secalert@redhat.com

https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html

Source: secalert@redhat.com

https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.html

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12395

Source: secalert@redhat.com

http://cvs.openssl.org/chngview?cn=19693

Source: af854a3a-2127-422b-91ae-364da2661108

http://cvs.openssl.org/filediff?f=openssl/crypto/cms/cms_asn1.c&v1=1.8&v2=1.8.6.1

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=129138643405740&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://rt.openssl.org/Ticket/Display.html?id=2211&user=guest&pass=guest

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/40000

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/40024

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/42457

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/42724

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/42733

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/57353

Source: af854a3a-2127-422b-91ae-364da2661108

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openssl.org/news/secadv_20100601.txt

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/40502

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/1313

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.vupen.com/english/advisories/2010/3105

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=598738

Source: af854a3a-2127-422b-91ae-364da2661108

https://kb.bluecoat.com/index?page=content&id=SA50

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12395

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.