OpenSSL 1.0.0 < 1.0.0j DTLS CBC Denial of Service

NASLDB: OpenSSL 1.0.0 < 1.0.0j DTLS CBC Denial of Service

General

ID: 59077
Name: OpenSSL 1.0.0 < 1.0.0j DTLS CBC Denial of Service

Summary: Does a banner check

Credits: Tenable Network Security, Inc.

Classification

Risk: –

CVSS: –
CVSS Base Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Port: –
Family: Web Servers
Type: Remote

Description

According to its banner, the remote web server is running a version
of OpenSSL 1.0.0 earlier than 1.0.0j. As such, the OpenSSL library
itself is reportedly affected by a denial of service vulnerability.

An integer underflow error exists in the file ‘ssl/d1_enc.c’ in the
function ‘dtls1_enc’. When in CBC mode, DTLS record length values and
explicit initialization vector length values related to DTLS packets
are not handled properly, which can lead to memory corruption and
application crashes.