CVE-2006-4343

OpenSSL 0.9.7-0.9.7k and 0.9.8-0.9.8c - Denial of Service via Null Pointer Dereference in SSLv2 Client

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2006-4343. PoCs published by Noam Rathaus.

AI-analyzed exploit summary This exploit targets CVE-2006-4343 by crafting a malformed SSLv2 ServerHello packet to crash SSL clients. It listens on port 443 and sends a specially crafted packet with an invalid length field to trigger a denial-of-service condition.

Description

The get_server_hello function in the SSLv2 client code in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows remote servers to cause a denial of service (client crash) via unknown vectors that trigger a null pointer dereference.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Noam Rathaus · perldosmultiple
https://www.exploit-db.com/exploits/4773

This exploit targets CVE-2006-4343 by crafting a malformed SSLv2 ServerHello packet to crash SSL clients. It listens on port 443 and sends a specially crafted packet with an invalid length field to trigger a denial-of-service condition.

Classification
Working Poc 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: SSL clients vulnerable to CVE-2006-4343
No auth needed
Prerequisites: Network access to the target · Target must initiate an SSL connection to the attacker's server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Noam Rathaus · perldosmultiple
https://www.exploit-db.com/exploits/28726

This exploit targets CVE-2006-4343, a denial-of-service vulnerability in OpenSSL. It crafts a malformed SSLv2 server hello packet to crash vulnerable client applications.

Classification
Working Poc 90%
Attack Type
Dos
Complexity
Moderate
Reliability
Reliable
Target: OpenSSL (versions affected by CVE-2006-4343)
No auth needed
Prerequisites: Network access to the target · Vulnerable OpenSSL client
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (131)

Core 131
Core References
Permissions Required, Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/4750
Third Party Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2006:172
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22212
Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/4773
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23915
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1016943
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23038
Broken Link vendor-advisory x_refsource_trustix
http://www.trustix.org/errata/2006/0054
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/29240
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2006/dsa-1195
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23309
Third Party Advisory x_refsource_confirm
http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html
Permissions Required, Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/4401
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-353-1
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22116
Broken Link vendor-advisory x_refsource_hp
https://www2.itrc.hp.com/service/cki/docDisplay.do?docId=c00967144
Third Party Advisory x_refsource_confirm
http://support.avaya.com/elmodocs2/security/ASA-2006-260.htm
Third Party Advisory vendor-advisory x_refsource_gentoo
http://www.gentoo.org/security/en/glsa/glsa-200612-11.xml
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22166
Third Party Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2006-0695.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23340
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22385
Broken Link vendor-advisory x_refsource_suse
http://www.novell.com/linux/security/advisories/2006_24_sr.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22758
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22487
Broken Link vendor-advisory x_refsource_suse
http://www.novell.com/linux/security/advisories/2006_58_openssl.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22772
Broken Link vendor-advisory x_refsource_hp
http://itrc.hp.com/service/cki/docDisplay.do?docId=c00849540
Third Party Advisory vendor-advisory x_refsource_freebsd
http://security.freebsd.org/advisories/FreeBSD-SA-06:23.openssl.asc
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22165
Third Party Advisory x_refsource_confirm
http://docs.info.apple.com/article.html?artnum=304829
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://lists.grok.org.uk/pipermail/full-disclosure/2006-September/049715.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23794
Mailing List, Third Party Advisory vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=130497311408250&w=2
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22220
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23680
Third Party Advisory x_refsource_confirm
http://openvpn.net/changelog.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/25889
Permissions Required, Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/4036
Third Party Advisory vendor-advisory x_refsource_openbsd
http://openbsd.org/errata.html#openssl2
Third Party Advisory x_refsource_confirm
http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30124
Broken Link x_refsource_confirm
http://www.ingate.com/relnote-452.php
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22626
Broken Link vdb-entry x_refsource_osvdb
http://www.osvdb.org/29263
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/22083
Broken Link vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2006:178
Permissions Required, Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/3869
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22544
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22298
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22130
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/25420
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31492
Permissions Required, Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/1973
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22284
Third Party Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2008-0629.html
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-200610-11.xml
Broken Link x_refsource_confirm
http://issues.rpath.com/browse/RPL-613
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/26329
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22260
Permissions Required, Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/0343
Permissions Required, Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/3860
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23280
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/447318/100/0/threaded
Third Party Advisory x_refsource_confirm
http://support.avaya.com/elmodocs2/security/ASA-2006-220.htm
Permissions Required, Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/4264
Third Party Advisory x_refsource_confirm
http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22193
Third Party Advisory x_refsource_confirm
http://www.vmware.com/support/esx2/doc/esx-202-200612-patch.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23155
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22799
Mailing List, Third Party Advisory vendor-advisory x_refsource_slackware
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.676946
Permissions Required, Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/4417
Patch, Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/386964
Third Party Advisory x_refsource_confirm
http://www.serv-u.com/releasenotes/
Permissions Required, Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/4443
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22094
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22186
Patch, Third Party Advisory x_refsource_confirm
http://www.openssl.org/news/secadv_20060928.txt
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22500
Mailing List, Third Party Advisory vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA06-333A.html
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/489739/100/0/threaded
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22216
Permissions Required, Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/3820
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://lists.vmware.com/pipermail/security-announce/2008/000008.html
Broken Link vendor-advisory x_refsource_hp
http://itrc.hp.com/service/cki/docDisplay.do?docId=c00805100
Third Party Advisory vendor-advisory x_refsource_openpkg
http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.021-openssl.html
Third Party Advisory x_refsource_confirm
http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html
Permissions Required, Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/0905/references
Permissions Required, Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/1401
Broken Link vendor-advisory x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102711-1
Third Party Advisory vendor-advisory x_refsource_netbsd
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-007.txt.asc
Third Party Advisory x_refsource_confirm
http://www.vmware.com/security/advisories/VMSA-2008-0005.html
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/456546/100/200/threaded
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/447393/100/0/threaded
Permissions Required, Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/3936
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22240
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22330
Third Party Advisory x_refsource_confirm
http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2006/dsa-1185
Third Party Advisory vendor-advisory x_refsource_sgi
ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22207
Third Party Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2006:177
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1017522
Permissions Required, Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/3902
Permissions Required, Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/2783
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22259
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22460
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22791
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22172
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/28276
Broken Link vendor-advisory x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102668-1
Patch, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/20246
Third Party Advisory vendor-advisory x_refsource_cisco
http://www.cisco.com/warp/public/707/cisco-sr-20061108-openssl.shtml
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/24950
Broken Link vendor-advisory x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-66-201531-1

Scores

EPSS 0.1699
EPSS Percentile 96.7%

Details

CWE
CWE-476
Status published
Products (20)
canonical/ubuntu_linux 5.04
canonical/ubuntu_linux 5.10
canonical/ubuntu_linux 6.06
debian/debian_linux 3.1
openssl/openssl 0.9.7
openssl/openssl 0.9.7a
openssl/openssl 0.9.7b
openssl/openssl 0.9.7c
openssl/openssl 0.9.7d
openssl/openssl 0.9.7e
... and 10 more
Published Sep 28, 2006
Tracked Since Feb 18, 2026