ISS X-Force Database: openssl-sslv2-client-dos(29240): OpenSSL SSLv2 client get_server

OpenSSL SSLv2 client get_server_hello() denial of service

openssl-sslv2-client-dos (29240)

Low Risk

Description:

OpenSSL is vulnerable to a denial of service caused by an error in the SSLv2 client get_server_hello() function. A remote attacker could exploit this vulnerability to cause a victim's OpenSSL client to crash, if the attacker could persuade the victim to connect to a malicious server.

Platforms Affected:

Apple, Mac OS X 10.3.9
Apple, Mac OS X 10.4.8
Apple, Mac OS X Server 10.3.9
Apple, Mac OS X Server 10.4.8
Canonical, Ubuntu 5.04
Canonical, Ubuntu 5.10
Canonical, Ubuntu 6.06 LTS
Cisco, Access Registrar
Cisco, Application and Content Networking Software
Cisco, Application Control Engine Module
Cisco, CallManager Express
Cisco, CiscoWorks Common Management Foundation
Cisco, CiscoWorks Common Services
Cisco, Content Services Switch 11500 7.50
Cisco, Content Services Switch 11500 8.10
Cisco, CS-MARS 4.2.2
Cisco, GSS 4480 Global Site Selector
Cisco, GSS 4490 Global Site Selector
Cisco, GSS 4491 Global Site Selector
Cisco, GSS 4492 Global Site Selector
Cisco, IDS
Cisco, MDS 9500
Cisco, ONS 15454
Cisco, Secure Access Control Server
Cisco, Security Agent 5.1
Cisco, SIP Proxy Server
Cisco, Unified CallManager 4.1
Cisco, Unified Presence Server
Cisco, Wide Area Application Services
Cisco, Wide Area File Services Software
Cisco, Wireless LAN Controller 4.0
Debian, Debian Linux 3.1
FreeBSD, FreeBSD
Gentoo, Linux
HP, System Management Homepage prior to 2.1.7
Kolab, Kolab Server 2.0.4 and prior
Kolab, Kolab Server 2.1 beta 2 and prior
MandrakeSoft, Mandrake Linux 2006 X86_64
MandrakeSoft, Mandrake Linux 2006
MandrakeSoft, Mandrake Linux 2007
MandrakeSoft, Mandrake Linux 2007 X86_64
MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
MandrakeSoft, Mandrake Linux Corporate Server 3.0
MandrakeSoft, Mandrake Linux Corporate Server 4.0 X86_64
MandrakeSoft, Mandrake Linux Corporate Server 4.0
MandrakeSoft, Mandrake Multi Network Firewall 2.0
Novell, Linux Desktop 9
Novell, Linux POS 9
Novell, Open Enterprise Server
Novell, Open Enterprise Server
Novell, UnitedLinux 1.0
OpenPKG, OpenPKG 2-STABLE
OpenPKG, OpenPKG 2.5
OpenPKG, OpenPKG CURRENT
OpenSSL, OpenSSL 0.9.7 Beta1
OpenSSL, OpenSSL 0.9.7 Beta3
OpenSSL, OpenSSL 0.9.7 Beta2
OpenSSL, OpenSSL 0.9.7 Beta5
OpenSSL, OpenSSL 0.9.7
OpenSSL, OpenSSL 0.9.7 Beta6
OpenSSL, OpenSSL 0.9.7 Beta4
OpenSSL, OpenSSL 0.9.7a
OpenSSL, OpenSSL 0.9.7b
OpenSSL, OpenSSL 0.9.7c
OpenSSL, OpenSSL 0.9.7d
OpenSSL, OpenSSL 0.9.7e
OpenSSL, OpenSSL 0.9.7f
OpenSSL, OpenSSL 0.9.7g
OpenSSL, OpenSSL 0.9.7h
OpenSSL, OpenSSL 0.9.7i
OpenSSL, OpenSSL 0.9.7j
OpenSSL, OpenSSL 0.9.7k
OpenSSL, OpenSSL 0.9.8
OpenSSL, OpenSSL 0.9.8a
OpenSSL, OpenSSL 0.9.8b
OpenSSL, OpenSSL 0.9.8c
OpenVPN, OpenVPN 2.0.9
RedHat, Enterprise Linux 2.1 AS
RedHat, Enterprise Linux 2.1 ES
RedHat, Enterprise Linux 2.1 WS
RedHat, Enterprise Linux 3 WS
RedHat, Enterprise Linux 3 ES
RedHat, Enterprise Linux 3 AS
RedHat, Enterprise Linux 3 Desktop
RedHat, Enterprise Linux 4 AS
RedHat, Enterprise Linux 4 WS
RedHat, Enterprise Linux 4 ES
RedHat, Enterprise Linux 4 Desktop
RedHat, Enterprise Linux ES
RedHat, Enterprise Linux WS
RedHat, Enterprise Linux AS
RedHat, Linux Advanced Workstation 2.1 Itanium
RedHat, Network Satellite Server 4.2
RedHat, Network Satellite Server 5.0
RedHat, Network Satellite Server 5.1
Slackware, Slackware Linux 10.0
Slackware, Slackware Linux 9.0
Slackware, Slackware Linux 9.1
Sun, Solaris 10 x86
Sun, Solaris 10 SPARC
Sun, Solaris 9.0 x86
Sun, Solaris 9.0 SPARC
SuSE, SuSE Linux 10.0
SuSE, SuSE Linux 10.1
SuSE, SuSE Linux 9.2
SuSE, SuSE Linux 9.3
SuSE, SuSE Linux Desktop 1.0
SuSE, SuSE Linux Enterprise Server 8.0
SuSE, SuSE Linux OpenExchange Server 4
SuSE, SuSE Linux Retail Solution 8
SuSE, SuSE Linux School Server
SuSE, SuSE Linux Standard Server 8
SuSE, SuSE SLED 10
SuSE, SuSE SLES 10
SuSE, SuSE SLES 9
Turbolinux, Turbolinux 10 Desktop
Turbolinux, Turbolinux 10 F...
Turbolinux, Turbolinux 10 Server
Turbolinux, Turbolinux 10 Server x64 Ed
Turbolinux, Turbolinux 7 Server
Turbolinux, Turbolinux 8 Server
Turbolinux, Turbolinux FUJI
Turbolinux, Turbolinux Home
Turbolinux, Turbolinux Multimedia
Turbolinux, Turbolinux Personal
Turbolinux, Turbolinux Appliance Server 1.0 Hosting Ed
Turbolinux, Turbolinux Appliance Server 1.0 Workgroup Ed
Turbolinux, Turbolinux Appliance Server 2.0
VMware, Server prior to 1.0.5
VMware, Workstation 6.0.2 and prior
Xerox, WorkCentre 232
Xerox, WorkCentre 238
Xerox, WorkCentre 245
Xerox, WorkCentre 255
Xerox, WorkCentre 265
Xerox, WorkCentre 275
Xerox, WorkCentre 7655
Xerox, WorkCentre 7665

Remedy:

Apply Apple Security Update 2006-007, available from the Apple Web site. See References.

Upgrade to the latest version of OpenSSL (0.9.7l or 0.9.8d or later), as listed in OpenSSL Security Advisory [28th September 2006]. See References.

For Ubuntu Linux:
Refer to USN-353-1 for patch, upgrade, or workaround information. See References.

For FreeBSD:
Refer to FreeBSD-SA-06:23.openssl for patch, upgrade, or workaround information. See References.

For Debian GNU/Linux:
Refer to DSA-1185-1 for patch, upgrade, or suggested workaround information. See References.

For Debian GNU/Linux (openssl096):
Refer to DSA-1195-1 for patch, upgrade, or suggested workaround information. See References.

For Red Hat Linux:
Refer to RHSA-2006:0695-12 for patch, upgrade, or suggested workaround information. See References.

For Kolab Server:
Refer to Kolab Security Issue 11 20061002 for patch, upgrade, or suggested workaround information. See References.

For Mandriva Linux:
Refer to MDKSA-2006:172-1 for patch, upgrade, or suggested workaround information. See References.

For OpenVPN:
Refer to OpenVPNT 2.0.x Change Log for patch, upgrade, or suggested workaround information. See References.

For Gentoo Linux:
Refer to Gentoo Linux Security Announcement GLSA 200610-11 for patch, upgrade, or suggested workaround information. See References.

For Gentoo Linux AMD64 x86:
Refer to Gentoo Linux Security Announcement GLSA 200612-11 for patch, upgrade, or suggested workaround information. See References.

For Cisco:
Refer to cisco-sr-20061108-openssl for upgrade information. See References.

For VMware Workstation:
Upgrade to the latest version of VMware Workstation (6.0.3 or later), available from the VMware Workstation Web site. See References.

For VMware Server:
Upgrade to the latest version of VMware Server (1.0.5 or later), available from the VMware Server Web site. See References.

For SUSE Linux:
Refer to SUSE-SA:2006:058 for patch, upgrade, or suggested workaround information. See References.

For Sun Solaris:
Refer to Sun Alert ID: 102711 for patch, upgrade, or suggested workaround information. See References.

For Xerox:
Refer to XEROX SECURITY BULLETIN XRX07-001 for patch, upgrade, or suggested workaround information. See References.

For HP System Management Homepage:
Refer to HPSBMA02250 SSRT061275 rev.1 for patch, upgrade, or suggested workaround information. See References.

For other distributions:
Apply the appropriate update for your system. See References.

Consequences:

Denial of Service

References:

Apple Security Update 2006-007, About the security content of Security Update 2006-007 at http://docs.info.apple.com/article.html?artnum=304829.
cisco-sr-20061108-openssl, Cisco Security Response: Multiple Vulnerabilities in OpenSSL Library at http://www.cisco.com/warp/public/707/cisco-sr-20061108-openssl.shtml.
FreeBSD-SA-06:23.openssl , Multiple problems in crypto(3) at http://security.FreeBSD.org/advisories/FreeBSD-SA-06:23.openssl.asc.
Full-Disclosure Mailing List, Mon Jan 08 2007 - 20:17:36 CST, VMware ESX server security updates at http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0170.html.
Full-Disclosure Mailing List, Thu Sep 28 2006 - 07:44:23 CDT, [SECURITY] OpenSSL 0.9.8d and 0.9.7l released at http://archives.neohapsis.com/archives/fulldisclosure/2006-09/0508.html.
HPSBMA02250 SSRT061275 rev.1 , HP System Management Homepage (SMH) for Linux and Windows, Remote Execution of Arbitrary Code and Denial of Service (DoS) at http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01118771&jumpid=reg_R1002_USEN.
IBM Systems Support Web site, Support for HMC at https://www14.software.ibm.com/webapp/set2/sas/f/hmc/power5/install/v61.Readme.html#MH01110.
Kolab Security Issue 11 20061002, openssl at http://kolab.org/security/kolab-vendor-notice-11.txt.
OpenSSL Security Advisory [28th September 2006], New OpenSSL releases are now available to correct four security issues. at http://www.openssl.org/news/secadv_20060928.txt.
OpenSSL Web site, OpenSSL:The Open Source toolkit for SSL/TLS at http://www.openssl.org/.
OpenVPN Web site, OpenVPNT 2.0.x Change Log at http://openvpn.net/changelog.html.
Sun Alert ID: 102711, Security Vulnerabilities in OpenSSL May Lead to a Denial of Service (DoS) to Applications or Execution of Arbitrary Code With Elevated Privileges at http://sunsolve.sun.com/search/document.do?assetkey=1-26-102711-1.
VMware Server Web site, Key Features in VMware Server, What's New in Version 1.0.5 at http://www.vmware.com/support/server/doc/releasenotes_server.html#resolved.
Vmware Workstation Web site, VMware Workstation 6.0 Release Notes, New in Version 6.0.3 at http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html#603.
Xerox Web Site, XEROX SECURITY BULLETIN XRX07-001 at http://www.xerox.com/downloads/usa/en/c/cert_ESSNetwork_XRX07001_v1.pdf.
ASA-2006-220: openssl security update (RHSA-2006-0695)
ASA-2006-260: HP-UX OpenSSL Denial of Service (DoS) Increase Privilege (HPSBUX02174)
ASA-2007-006: Sun Alert Notifications from Sun Weekly Report dated Nov 11 2006
BID-20246: OpenSSL SSLv2 Null Pointer Dereference Client Denial of Service Vulnerability
BID-22083: Oracle January 2007 Security Update Multiple Vulnerabilities
BID-28276: VMware Server 1.0.5 and Workstation 6.0.3 Multiple Vulnerabilities
CVE-2006-4343: The get_server_hello function in the SSLv2 client code in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows remote servers to cause a denial of service (client crash) via unknown vectors that trigger a null pointer dereference.
DSA-1185: openssl -- denial of service
DSA-1195: openssl096 -- denial of service (multiple)
FrSIRT/ADV-2006-3820: OpenSSL Multiple Remote Denial of Service and Buffer Overflow Vulnerabilities
FrSIRT/ADV-2006-3860: FileZilla Security Update Fixes OpenSSL Remote Denial of Service Vulnerabilities
FrSIRT/ADV-2006-3869: OpenVPN Security Update Fixes OpenSSL Remote Denial of Service Vulnerabilities
FrSIRT/ADV-2006-3902: Kolab Server Security Update Fixes OpenSSL Denial of Service Vulnerabilities
FrSIRT/ADV-2006-3936: Rhino Software Serv-U FTP Security Update Fixes OpenSSL DoS Vulnerabilities
FrSIRT/ADV-2006-4036: Sun Grid Engine Multiple OpenSSL Remote Denial of Service Vulnerabilities
FrSIRT/ADV-2006-4264: SnapGear Security Update Fixes Multiple OpenSSL and ClamAV Vulnerabilities
FrSIRT/ADV-2006-4401: cwRsync Security Update Fixes Multiple OpenSSH and OpenSSL Vulnerabilities
FrSIRT/ADV-2006-4417: Cisco Products OpenSSL Library Security Bypass and Denial of Service Issues
FrSIRT/ADV-2006-4443: Sun Solaris OpenSSL Remote Denial of Service and Code Execution Vulnerabilities
FrSIRT/ADV-2006-4750: Apple Mac OS X Multiple Command Execution and Denial of Service Vulnerabilities
FrSIRT/ADV-2007-0343: HP-UX Security Update Fixes Apache Denial of Service and Security Bypass Issues
FrSIRT/ADV-2007-1401: HP Tru64 UNIX Security Update Fixes SSL and BIND Denial of Service Vulnerabilities
FrSIRT/ADV-2007-1973: Ingate Firewall and SIParator Information Disclosure and Authentication Bypass Issues
FrSIRT/ADV-2007-2783: HP System Management Homepage Code Execution and Denial of Service Issues
FrSIRT/ADV-2008-0905: VMware Security Update Fixes Multiple Security Bypass Vulnerabilities
GLSA-200610-11: OpenSSL: Multiple vulnerabilities
GLSA-200612-11: AMD64 x86 emulation base libraries: OpenSSL multiple vulnerabilities
MDKSA-2006:172: Updated openssl packages fix vulnerabilities
MDKSA-2006:172-1: Updated openssl packages fix vulnerabilities
OpenPKG-SA-2006.021: OpenSSL
OSVDB ID: 29263: OpenSSL SSLv2 get_server_hello Function Remote DoS
RHSA-2006-0695: openssl security update
RHSA-2008-0264: Moderate: Red Hat Network Satellite Server Solaris client security update
RHSA-2008-0525: Moderate: Red Hat Network Satellite Server Solaris client security update
RHSA-2008-0629: Moderate: Red Hat Network Satellite Server Solaris client security update
SA22094: FileZilla / FileZilla Server Multiple Vulnerabilities
SA22130: OpenSSL Multiple Vulnerabilities
SA22216: Kolab Server Multiple Vulnerabilities
SA22284: Serv-U FTP Server OpenSSL Multiple Vulnerabilities
SA22385: Avaya Products OpenSSL Multiple Vulnerabilities
SA22460: Sun Grid Engine Multiple OpenSSL Vulnerabilities
SA22626: SnapGear Multiple Vulnerabilities
SA22758: Cisco Products OpenSSL Vulnerabilities
SA22772: cwRsync OpenSSL Vulnerabilities and OpenSSH Weakness
SA22791: Sun Solaris OpenSSL Vulnerabilities
SA22799: Cisco Products OpenSSL Vulnerabilities
SA23038: IBM HMC OpenSSH / OpenSSL Vulnerabilities
SA23155: Mac OS X Security Update Fixes Multiple Vulnerabilities
SA23340: Avaya PDS HP-UX Secure Shell / OpenSSL Multiple Vulnerabilities
SA23680: VMWare ESX Server Multiple Vulnerabilities
SA23794: Oracle Products Multiple Vulnerabilities
SA24950: HP Insight Management Agents SSL Vulnerabilities
SA25420: Ingate Firewall and SIParator Multiple Vulnerabilities
SA25889: Xerox ESS/ Network Controller OpenSSL Vulnerabilities
SA26329: HP System Management Homepage Apache and OpenSSL Vulnerabilities
SA29412: VMware Server Multiple Vulnerabilities
SECTRACK ID: 1016943: OpenSSL ASN.1 Bugs, SSL_get_shared_ciphers() Buffer Overflow, and SSLv2 Client Error Lets Remote Users Denial of Service or Execute Arbitrary Code
SECTRACK ID: 1017522: Oracle Database and Other Products Have 52 Unspecified Vulnerabilities With Unspecified Impact
SUSE-SA:2006:058: openssl security problems
SUSE-SR:2006:024: SUSE Security Summary Report

Reported:

Sep 28, 2006

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page