CVE-2003-0544
CVE-2003-0544
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OpenSSL 0.9.6 and 0.9.7 does not properly track the number of characters in certain ASN.1 inputs, which allows remote attackers to cause a denial of service (crash) via an SSL client certificate that causes OpenSSL to read past the end of a buffer when the long form is used.
EPSS 6.9% · Fix available
- Published
- Updated
Affected products and versions
Original sources
- http://www.redhat.com/support/errata/RHSA-2003-292.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4574
- http://www.kb.cert.org/vuls/id/380864
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43041
- http://www.vupen.com/english/advisories/2006/3900
- http://www.debian.org/security/2003/dsa-393
- http://www-1.ibm.com/support/docview.wss?uid=swg21247112
- http://www.uniras.gov.uk/vuls/2003/006489/openssl.htm
- http://www.debian.org/security/2003/dsa-394
- http://www.redhat.com/support/errata/RHSA-2003-291.html
- http://www.cert.org/advisories/CA-2003-26.html
- http://secunia.com/advisories/22249
- http://www.securityfocus.com/bid/8732
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-201029-1
- http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=104893
- http://www.linuxsecurity.com/advisories/engarde_advisory-3693.html
- https://nvd.nist.gov/vuln/detail/CVE-2003-0544