OpenSSL Multiple Vulnerabilities

Last Update Date: 6 Feb 2013 10:44 Release Date: 6 Feb 2013 5063 Views

RISK: Medium Risk

TYPE: Security software and application - Security Software & Appliance

Multiple vulnerabilities have been identified in OpenSSL. A remote user can cause denial of service conditions, and recover plaintext in certain cases.

A remote user can send specially crafted data to a system using AES-NI for TLS 1.2 or TLS 1.1 to cause denial of service conditions. Only version 1.0.1c is affected.
A remote user with the ability to conduct a man-in-the-middle attack against TLS or DTLS protected connections can recover the original plaintext when CBC-mode encryption is used. This attack is known as the 'Lucky Thirteen' attack.

Impact

Denial of Service
Information Disclosure

System / Technologies affected

Versions prior to 0.9.8y, 1.0.0k, 1.0.1d

Solutions

Before installation of the software, please visit the software manufacturer web-site for more details.

The vendor has issued a fix (0.9.8y, 1.0.0k, 1.0.1d).

Vulnerability Identifier

Source

SecurityTracker