CVE-2013-0166

Published: Feb 8, 2013Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause a denial of service (NULL pointer dereference and application crash) via an invalid key.

Affected (95)

Products: Openssl: Openssl · Redhat: Openssl

1 product

1 product

Configuration A

95 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 0.9.1c
Openssl Openssl	Version 0.9.2b
Openssl Openssl	Version 0.9.3
Openssl Openssl	Version 0.9.3a
Openssl Openssl	Version 0.9.4
Openssl Openssl	Version 0.9.5
Openssl Openssl	Version 0.9.5 beta1
Openssl Openssl	Version 0.9.5 beta2
Openssl Openssl	Version 0.9.5a
Openssl Openssl	Version 0.9.5a beta1
Openssl Openssl	Version 0.9.5a beta2
Openssl Openssl	Version 0.9.6
Openssl Openssl	Version 0.9.6 beta1
Openssl Openssl	Version 0.9.6 beta2
Openssl Openssl	Version 0.9.6 beta3
Openssl Openssl	Version 0.9.6a
Openssl Openssl	Version 0.9.6a beta1
Openssl Openssl	Version 0.9.6a beta2
Openssl Openssl	Version 0.9.6a beta3
Openssl Openssl	Version 0.9.6b
Openssl Openssl	Version 0.9.6c
Openssl Openssl	Version 0.9.6d
Openssl Openssl	Version 0.9.6e
Openssl Openssl	Version 0.9.6f
Openssl Openssl	Version 0.9.6g
Openssl Openssl	Version 0.9.6h
Openssl Openssl	Version 0.9.6i
Openssl Openssl	Version 0.9.6j
Openssl Openssl	Version 0.9.6k
Openssl Openssl	Version 0.9.6l
Openssl Openssl	Version 0.9.6m
Openssl Openssl	Version 0.9.7
Openssl Openssl	Version 0.9.7 beta1
Openssl Openssl	Version 0.9.7 beta2
Openssl Openssl	Version 0.9.7 beta3
Openssl Openssl	Version 0.9.7 beta4
Openssl Openssl	Version 0.9.7 beta5
Openssl Openssl	Version 0.9.7 beta6
Openssl Openssl	Version 0.9.7a
Openssl Openssl	Version 0.9.7b
Openssl Openssl	Version 0.9.7c
Openssl Openssl	Version 0.9.7d
Openssl Openssl	Version 0.9.7e
Openssl Openssl	Version 0.9.7f
Openssl Openssl	Version 0.9.7g
Openssl Openssl	Version 0.9.7h
Openssl Openssl	Version 0.9.7i
Openssl Openssl	Version 0.9.7j
Openssl Openssl	Version 0.9.7k
Openssl Openssl	Version 0.9.7l
Openssl Openssl	Version 0.9.7m
Openssl Openssl	Version 0.9.8
Openssl Openssl	Version 0.9.8a
Openssl Openssl	Version 0.9.8b
Openssl Openssl	Version 0.9.8c
Openssl Openssl	Version 0.9.8d
Openssl Openssl	Version 0.9.8e
Openssl Openssl	Version 0.9.8f
Openssl Openssl	Version 0.9.8g
Openssl Openssl	Version 0.9.8h
Openssl Openssl	Version 0.9.8i
Openssl Openssl	Version 0.9.8j
Openssl Openssl	Version 0.9.8k
Openssl Openssl	Version 0.9.8l
Openssl Openssl	Version 0.9.8m
Openssl Openssl	Version 0.9.8m beta1
Openssl Openssl	Version 0.9.8n
Openssl Openssl	Version 0.9.8o
Openssl Openssl	Version 0.9.8p
Openssl Openssl	Version 0.9.8q
Openssl Openssl	Version 0.9.8r
Openssl Openssl	Version 0.9.8s
Openssl Openssl	Version 0.9.8t
Openssl Openssl	Version 0.9.8u
Openssl Openssl	Version 0.9.8v
Openssl Openssl	Version 0.9.8w
Openssl Openssl	Version 0.9.8x
Openssl Openssl	Version 1.0.0
Openssl Openssl	Version 1.0.0a
Openssl Openssl	Version 1.0.0b
Openssl Openssl	Version 1.0.0c
Openssl Openssl	Version 1.0.0d
Openssl Openssl	Version 1.0.0e
Openssl Openssl	Version 1.0.0f
Openssl Openssl	Version 1.0.0g
Openssl Openssl	Version 1.0.0h
Openssl Openssl	Version 1.0.0i
Openssl Openssl	Version 1.0.0j
Openssl Openssl	Version 1.0.1
Openssl Openssl	Version 1.0.1a
Openssl Openssl	Version 1.0.1b
Openssl Openssl	Version 1.0.1c
Redhat Openssl	Version 0.9.6-15
Redhat Openssl	Version 0.9.6b-3
Redhat Openssl	Version 0.9.7a-2

Related CWEs

CWE-310

References (54)

http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=62e4506a7d4cec1c8e1ff687f6b220f6a62a57c7

Source: secalert@redhat.com

http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=66e8211c0b1347970096e04b18aa52567c325200

Source: secalert@redhat.com

http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=ebc71865f0506a293242bd4aec97cdc7a8ef24b0

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=136396549913849&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=136432043316835&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=137545771702053&w=2

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-0587.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-0782.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-0783.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-0833.html

Source: secalert@redhat.com

http://secunia.com/advisories/53623

Source: secalert@redhat.com

http://secunia.com/advisories/55108

Source: secalert@redhat.com

http://secunia.com/advisories/55139

Source: secalert@redhat.com

http://support.apple.com/kb/HT5880

Source: secalert@redhat.com

http://www.debian.org/security/2013/dsa-2621

Source: secalert@redhat.com

http://www.kb.cert.org/vuls/id/737740

Source: secalert@redhat.com

US Government Resource

http://www.openssl.org/news/secadv_20130204.txt

Source: secalert@redhat.com

Vendor Advisory

http://www.splunk.com/view/SP-CAAAHXG

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=908052

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18754

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19081

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19360

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19487

Source: secalert@redhat.com

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c03883001

Source: secalert@redhat.com

http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=62e4506a7d4cec1c8e1ff687f6b220f6a62a57c7