CVE-2013-4353

Published: Jan 9, 2014Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The ssl3_take_mac function in ssl/s3_both.c in OpenSSL 1.0.1 before 1.0.1f allows remote TLS servers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Next Protocol Negotiation record in a TLS handshake.

Affected (9)

Products: Openssl: Openssl

1 product

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 1.0.1
Openssl Openssl	Version 1.0.1 beta1
Openssl Openssl	Version 1.0.1 beta2
Openssl Openssl	Version 1.0.1 beta3
Openssl Openssl	Version 1.0.1a
Openssl Openssl	Version 1.0.1b
Openssl Openssl	Version 1.0.1c
Openssl Openssl	Version 1.0.1d
Openssl Openssl	Version 1.0.1e

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (32)

http://git.openssl.org/gitweb/?p=openssl.git%3Ba=blob_plain%3Bf=CHANGES%3Bhb=refs/heads/OpenSSL_1_0_1-stable

Source: secalert@redhat.com

http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=197e0ea817ad64820789d86711d55ff50d71f631

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2014-01/msg00065.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2014-01/msg00067.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2014-01/msg00070.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-0015.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-0041.html

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=isg400001841

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=isg400001843

Source: secalert@redhat.com

http://www.debian.org/security/2014/dsa-2837

Source: secalert@redhat.com

http://www.openssl.org/news/vulnerabilities.html

Source: secalert@redhat.com

Vendor Advisory

http://www.splunk.com/view/SP-CAAAMB3

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2079-1

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1049058

Source: secalert@redhat.com

http://git.openssl.org/gitweb/?p=openssl.git%3Ba=blob_plain%3Bf=CHANGES%3Bhb=refs/heads/OpenSSL_1_0_1-stable

Source: af854a3a-2127-422b-91ae-364da2661108

http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=197e0ea817ad64820789d86711d55ff50d71f631

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2014-01/msg00065.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2014-01/msg00067.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2014-01/msg00070.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2014-0015.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2014-0041.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www-01.ibm.com/support/docview.wss?uid=isg400001841

Source: af854a3a-2127-422b-91ae-364da2661108

http://www-01.ibm.com/support/docview.wss?uid=isg400001843

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2014/dsa-2837

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openssl.org/news/vulnerabilities.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.splunk.com/view/SP-CAAAMB3

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-2079-1

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=1049058

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.