Description: Three vulnerabilities have been discovered in OpenSSL, which can be exploited by malicious people to cause a DoS (Denial-of-Service).
1) A NULL-pointer assignment in the "do_change_cipher_spec()" function used during the SSL/TLS handshake can be exploited to cause OpenSSL to crash via a specially crafted SSL/TLS handshake.
This vulnerability affects all versions of OpenSSL 0.9.6c through 0.9.6k and 0.9.7a through 0.9.7c.
2) An unspecified error in a fix added to OpenSSL 0.9.6d some time ago can result in a DoS caused by an infinite loop.
This vulnerability only affects older 0.9.6 versions with backported security patches.
3) An out-of-bounds read error exists in a routine used during the SSL/TLS handshake when using Kerberos ciphersuites. This can be exploited to crash OpenSSL via a specially crafted SSL/TLS handshake.
This vulnerability affects versions 0.9.7a, 0.9.7b, and 0.9.7c.
Solution: Update to version 0.9.7d or 0.9.6m. Recompile any OpenSSL applications statically linked to OpenSSL libraries.
Provided and/or discovered by: 1) Discovered by vendor using the Codenomicon TLS Test Tool.
2) Discovered by vendor using the Codenomicon TLS Test Tool.
3) Dr. Stephen Henson
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
