OpenSSL ECDH Ciphersuites Remote Denial of Service Vulnerability

Bugtraq ID:	49471
Class:	Design Error
CVE:	CVE-2011-3210
Remote:	Yes
Local:	No
Published:	Sep 06 2011 12:00AM
Updated:	Mar 19 2015 08:33AM
Credit:	Adam Langley
Vulnerable:	Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 OpenSSL Project OpenSSL 0.9.8 k OpenSSL Project OpenSSL 0.9.8 j OpenSSL Project OpenSSL 0.9.8 i OpenSSL Project OpenSSL 0.9.8 h OpenSSL Project OpenSSL 0.9.8 e OpenSSL Project OpenSSL 0.9.8 d OpenSSL Project OpenSSL 0.9.8 c OpenSSL Project OpenSSL 0.9.8 b OpenSSL Project OpenSSL 0.9.8 a OpenSSL Project OpenSSL 0.9.8 + Gentoo Linux OpenSSL Project OpenSSL 1.0.0d OpenSSL Project OpenSSL 1.0.0c OpenSSL Project OpenSSL 1.0.0b OpenSSL Project OpenSSL 1.0.0a OpenSSL Project OpenSSL 0.9.8s OpenSSL Project OpenSSL 0.9.8R OpenSSL Project OpenSSL 0.9.8Q OpenSSL Project OpenSSL 0.9.8p OpenSSL Project OpenSSL 0.9.8O OpenSSL Project OpenSSL 0.9.8n OpenSSL Project OpenSSL 0.9.8m OpenSSL Project OpenSSL 0.9.8l OpenSSL Project OpenSSL 0.9.8g OpenSSL Project OpenSSL 0.9.8 f Mandriva Linux Mandrake 2011 x86_64 Mandriva Linux Mandrake 2011 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 Kolab Kolab Groupware Server 2.2.4 Kolab Kolab Groupware Server 2.3.2 Kolab Kolab Groupware Server 2.3.1 IBM Tivoli Netcool/OMNIbus 7.3 HP System Management Homepage 6.2.2 7 HP System Management Homepage 6.0 .96 HP System Management Homepage 3.0.2 .77 HP System Management Homepage 3.0.1 .73 HP System Management Homepage 3.0 .68 HP System Management Homepage 3.0 .64 HP System Management Homepage 6.3 HP System Management Homepage 6.2.0-12 HP System Management Homepage 6.2 HP System Management Homepage 6.2 HP System Management Homepage 6.1.0.103 HP System Management Homepage 6.1.0.102 HP System Management Homepage 6.1.0-103 HP System Management Homepage 6.1 HP System Management Homepage 6.0.0.95 HP System Management Homepage 6.0.0-95 HP System Management Homepage 6.0 HP System Management Homepage 3.0.2.77 B HP System Management Homepage 3.0.2-77 HP System Management Homepage 3.0.1-73 HP System Management Homepage 3.0.0-68 HP System Management Homepage 0 HP Insight Control for Linux (IC-Linux) 7.0 HP HP-UX B.11.31 HP HP-UX B.11.11 Avaya 96x1 IP Deskphone 6 Apple Mac Os X 10.7.4 Apple Mac Os X 10.7.3 Apple Mac Os X 10.7.2 Apple Mac Os X 10.7.1
Not Vulnerable:	OpenSSL Project OpenSSL 1.0.0e Kolab Kolab Groupware Server 2.3.3 HP System Management Homepage 7.0

OpenSSL ECDH Ciphersuites Remote Denial of Service Vulnerability

OpenSSL is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.

OpenSSL 0.9.8 through 0.9.8e and OpenSSL 1.0.0 through 1.0.0d are vulnerable.

OpenSSL ECDH Ciphersuites Remote Denial of Service Vulnerability

An attacker can use readily available network utilities.

OpenSSL ECDH Ciphersuites Remote Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.


Apple Mac OS X 10.6.8

• Apple SecUpdSrvr2013-002.dmg
  For Mac OS X Server v10.6.8
  http://www.apple.com/support/downloads/

Mandriva Linux Mandrake 2011

• Mandriva libopenssl-devel-1.0.0d-2.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libopenssl-engines1.0.0-1.0.0d-2.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libopenssl-static-devel-1.0.0d-2.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libopenssl1.0.0-1.0.0d-2.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva openssl-1.0.0d-2.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/

OpenSSL ECDH Ciphersuites Remote Denial of Service Vulnerability

References:

• [Kolab-announce] Announcing the Kolab Server 2.3.3 (Kolab)
  
• IBM Netcool System Service Monitor SSM 4.0 Fix Pack 1 README Netcool/System Serv (IBM)
  
• IBM Netcool System Service Monitor SSM 4.0 Fix Pack 14 README Netcool/System Ser (IBM)
  
• IBM Product Security Incident Response Blog (IBM)
  
• OpenSSL Project (OpenSSL Project)
  
• OpenSSL Security Advisory [6 September 2011] (OpenSSL)
  
• Security Bulletin: IBM Tivoli Netcool System Service Monitors/Application Servic (IBM)
  
• Security Bulletin: IBM Tivoli Netcool System Service Monitors/Application Servic (IBM)
  
• Wind River Linux OpenSSL Security Update (WIND00311488 WIND00311487) (Avaya)
  
• About the security content of OS X Mountain Lion v10.8.4 and Security Update 201 (APPLE)
  
• GSKit Security Vulnerabilities addressed in IBM Tivoli Netcool OMNIbus (IBM)
  
• GSKit Security Vulnerabilities addressed in IBM Tivoli Network Manager 3.8 and 3 (IBM)
  
• HMC OpenSSL Upgrade to Address Cryptographic Vulnerabilities (IBM)
  
• IBM Security Advisore swg21619837 (IBM)
  
• IBM Tivoli Composite Application Manager for Transactions Internet Service Monit (IBM)
  
• IBM Tivoli Network Manager IP 3.8.0 Fix Pack 7, 3.8.0-TIV-ITNMIP-FP0007 (IBM)
  
• IBM Tivoli Network Manager IP 3.9.0 Fix Pack 3, 3.9.0-TIV-ITNMIP-FP0003 (IBM)
  
• IBM XIV Storage System Gen3 (CVE-2011-4619, CVE-2011-4576, CVE-2011-3210, CVE-20 (IBM)
  
• Security Bulletin: IBM Endpoint Manager for Remote Control is affected by multip (IBM)
  
• Security Bulletin: IBM Sterling Connect:Enterprise for UNIX is affected by multi (IBM)
  
• Security Bulletin: IBM Sterling Connect:Express for UNIX is affected by multiple (IBM)
  
• Security Bulletin: IBM Tivoli Composite Application Monitoring for Transactions (IBM)
  
• Security Bulletin: OpenSSL vulnerability issues for IBM Cloudburst (IBM)
  
• Security Bulletin: OpenSSL vulnerability issues for IBM Service Delivery Manager (IBM)
  
• Security Bulletin: Tivoli Endpoint Manager for Remote Control is affected by mul (IBM)
  
• Security Bulletin: Tivoli Remote Control is affected by multiple OpenSSL vulnera (IBM)
  
• Storage HMC OpenSSL upgrade to address cryptographic vulnerabilities (IBM)
  
• Tivoli Workload Scheduler Openssl Multiple Vulnerabilities (IBM)