CVE-2013-6449

OpenSSL < 1.0.2 - Denial of Service via TLS 1.2 Client Traffic

Title source: llm

Description

The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorrect data structure, which allows remote attackers to cause a denial of service (daemon crash) via crafted traffic from a TLS 1.2 client.

References (27)

Core 27

Core References

Vendor Advisory x_refsource_confirm

http://www.vmware.com/security/advisories/VMSA-2014-0012.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2014-01/msg00006.html

Various Sources x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=isg400001843

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2014-01/msg00012.html

Third Party Advisory vendor-advisory x_refsource_gentoo

http://security.gentoo.org/glsa/glsa-201412-39.xml

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2014/dsa-2833

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/534161/100/0/threaded

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html

Various Sources x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=isg400001841

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/64530

Vendor Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2014-01/msg00009.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2014-01/msg00031.html

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-2079-1

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124833.html

Vendor Advisory x_refsource_confirm

http://rt.openssl.org/Ticket/Display.html?id=3200&user=guest&pass=guest

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124854.html

Vendor Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2014-0015.html

Mailing List mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2014/Dec/23

Various Sources x_refsource_confirm

https://issues.apache.org/jira/browse/TS-2355

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1029548

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124858.html

Vendor Advisory x_refsource_confirm

http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=ca989269a2876bae79393bd54c3e72d49975fc75

Issue Tracking x_refsource_confirm

https://bugzilla.redhat.com/show_bug.cgi?id=1045363

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2014-0041.html

Scores

EPSS 0.4698

EPSS Percentile 97.7%

Details

CWE

CWE-310

Status published

Products (17)

openssl/openssl 1.0.0 (6 CPE variants)

openssl/openssl 1.0.0a

openssl/openssl 1.0.0b

openssl/openssl 1.0.0c

openssl/openssl 1.0.0d

openssl/openssl 1.0.0e

openssl/openssl 1.0.0f

openssl/openssl 1.0.0g

openssl/openssl 1.0.0h

openssl/openssl 1.0.0i

... and 7 more

Published Dec 23, 2013

Tracked Since Feb 18, 2026