A vulnerability has been reported in OpenSSL, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise an application using the library.

The vulnerability is caused due to a race condition within the TLS extension parsing code, which can be exploited to cause a heap-based buffer overflow.

Successful exploitation requires that the server is multi-threaded and uses the internal caching mechanism of OpenSSL. Multi-processed servers or servers with disabled internal caching session (e.g. Apache HTTP server, Stunnel) are not affected.

The vulnerability is reported in versions 0.9.8f through 0.9.8o and versions 1.0.0 and 1.0.0a.

Solution
Update to version 0.9.8p and 1.0.0c or apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
The vendor credits Rob Hulswit.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.openssl.org/news/secadv_20101116.txt
http://www.openssl.org/news/secadv_20101116-2.txt

Deep Links
Links available to Secunia VIM customers