OpenSSL CVE-2013-0166 Remote Denial of Service Vulnerability

Bugtraq ID:	60268
Class:	Design Error
CVE:	CVE-2013-0166
Remote:	Yes
Local:	No
Published:	Feb 05 2013 12:00AM
Updated:	Apr 13 2015 10:23PM
Credit:	Adam Langley, Wolfgang Ettlingers, and Stephen Henson.
Vulnerable:	Xerox FreeFlow Print Server (FFPS) 93.E0.21C Xerox FreeFlow Print Server (FFPS) 91.D2.32 Xerox FreeFlow Print Server (FFPS) 82.D1.44 Xerox FreeFlow Print Server (FFPS) 81.D0.73 Xerox FreeFlow Print Server (FFPS) 73.D2.33 Xerox FreeFlow Print Server (FFPS) 73.C5.11 Xerox Docucolor DC260 0 Xerox Docucolor DC252 0 Xerox Docucolor DC242 0 VMWare ESXi 5.1 VMWare ESXi 5.0 VMWare ESXi 4.1 VMWare ESXi 4.0 VMWare ESX Server 4.1 VMWare ESX Server 4.0 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Sun Solaris 9 Stunnel Stunnel 4.54 Stunnel Stunnel 4.53 Stunnel Stunnel 4.52 Stunnel Stunnel 4.42 Stunnel Stunnel 4.41 Stunnel Stunnel 4.40 Stunnel Stunnel 4.35 Stunnel Stunnel 4.34 Stunnel Stunnel 4.33 Stunnel Stunnel 4.32 Stunnel Stunnel 4.31 Stunnel Stunnel 4.30 Stunnel Stunnel 4.24 Stunnel Stunnel 4.23 Stunnel Stunnel 4.22 Stunnel Stunnel 4.21 Splunk Splunk 5.0 Splunk Splunk 4.3.6 Splunk Splunk 4.3.5 Splunk Splunk 4.3.4 Splunk Splunk 4.3.3 Splunk Splunk 4.3.2 Splunk Splunk 4.3.1 Splunk Splunk 4.3 Splunk Splunk 4.2.5 Splunk Splunk 4.1.6 Splunk Splunk 4.1.3 Splunk Splunk 4.1.2 Splunk Splunk 4.1.1 Splunk Splunk 4.0.11 Splunk Splunk 4.0.10 Splunk Splunk 4.0.9 Splunk Splunk 4.0.8 Splunk Splunk 4.0.7 Splunk Splunk 4.0.6 Splunk Splunk 4.0.5 Splunk Splunk 4.0.4 Splunk Splunk 4.0.3 Splunk Splunk 4.0.2 Splunk Splunk 4.0.1 Splunk Splunk 4.0 Splunk Splunk 4.3 Splunk Splunk 4.2.4 Splunk Splunk 4.2.3 Splunk Splunk 4.2.2 Splunk Splunk 4.2 Splunk Splunk 4.1.5 Splunk Splunk 4.1.4 Splunk Splunk 4.1 Splunk Splunk 4 Redhat JBoss Enterprise Web Server 2.0.0 Redhat JBoss Enterprise Web Platform 5.2.0 Redhat JBoss Enterprise Application Platform 5.2 Redhat Enterprise Virtualization Hypervisor for RHEL 6 0 Redhat Enterprise Linux Workstation Optional 6 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server Optional 6 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node Optional 6 Redhat Enterprise Linux HPC Node 6 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux Desktop Optional 6 Redhat Enterprise Linux Desktop 6 Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux 5 Server Oracle Sun QFS Software 5.3 Oracle Sun QFS Software 5.2 Oracle Sun QFS Software 5.1 Oracle StorageTek Storage Archive Manager 5.3 Oracle StorageTek Storage Archive Manager 5.2 Oracle StorageTek Storage Archive Manager 5.1 Oracle Solaris 11.1 Oracle Solaris 10 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 OpenSSL Project OpenSSL 1.0.1c OpenSSL Project OpenSSL 1.0.0j OpenSSL Project OpenSSL 0.9.8X McAfee FireWall Enterprise 8.2.0 McAfee FireWall Enterprise 7.0.1.03 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Juniper SA700 SSL VPN 0 Juniper SA6500 SSL VPN 0 Juniper SA6500 FIPS 0 Juniper SA6000 SSL VPN 0 Juniper SA6000 FIPS 0 Juniper SA4500 SSL VPN 0 Juniper SA4500 FIPS 0 Juniper SA4000 SSL VPN 0 Juniper SA4000 FIPS 0 Juniper SA2500 SSL VPN 0 Juniper MAG6611 0 Juniper MAG6610 0 Juniper MAG4610 0 Juniper MAG2600 0 Juniper Junos Space Ja2500 Appliance - Juniper Junos Space Ja1500 Appliance - Juniper JUNOS Space 13.3 Juniper JUNOS Space 13.1P1.14 Juniper JUNOS Space 13.1 R1.8 Juniper JUNOS Space 13.1 Juniper JUNOS Space 0 Juniper Junos Pulse Secure Access Service 7.3 Juniper Junos Pulse Secure Access Service 7.2 Juniper Junos Pulse Secure Access Service 7.1 Juniper Junos Pulse Access Control Service (UAC) 4.4 Juniper Junos Pulse Access Control Service (UAC) 4.3 Juniper Junos Pulse Access Control Service (UAC) 4.2 Juniper Junos Pulse Access Control Service (UAC) 4.1 Juniper JUNOS 13.1 Juniper JUNOS 12.3 Juniper JUNOS 12.2 Juniper JUNOS 12.1 Juniper JUNOS 11.4 Juniper IC6500 FIPS 0 Juniper IC6500 0 Juniper IC6000 0 Juniper IC4500 0 Juniper IC4000 0 IBM Virtual I/O Server (VIOS) 2.2.1 4 IBM Virtual I/O Server (VIOS) 2.1 IBM Virtual I/O Server (VIOS) 2.2 IBM Virtual I/O Server (VIOS) 2.1 IBM Virtual I/O Server (VIOS) 2.0 IBM Tivoli Workload Scheduler for Applications 8.6 IBM Tivoli Workload Scheduler for Applications 8.5 FP01 IBM Tivoli Workload Scheduler for Applications 8.4 FP02 IBM Tivoli Workload Scheduler Distributed 8.5.1 FP04 IBM Tivoli Workload Scheduler Distributed 8.6 FP02 IBM Tivoli Workload Scheduler Distributed 8.5 FP03 IBM Tivoli Workload Scheduler Distributed 8.4 FP07 IBM Tivoli Storage Productivity Center 5.1.1 IBM Tivoli Storage Productivity Center 5.1 IBM Tivoli Storage Productivity Center 5.1.1.1 IBM Tivoli Storage Productivity Center 5.1.1.0 IBM Tivoli Storage Productivity Center 4.2.2 FP3 IBM Tivoli Storage Productivity Center 4.2.1 IBM Tivoli Storage Productivity Center 4.2.0 IBM Tivoli Storage Productivity Center 4.1 IBM Tivoli Remote Deployment Manager 4.40 IBM Tivoli Remote Control 5.1.2 IBM Tivoli Provisioning Manager for OS Deployment 5.1 .3 IBM Tivoli Provisioning Manager for OS Deployment 5.1 .116 IBM Tivoli Provisioning Manager for OS Deployment 7.1.1 IBM Tivoli Provisioning Manager for OS Deployment 5.1.0.2 IBM Tivoli Provisioning Manager for Images System x Edition 7.1.1.0 IBM Tivoli Provisioning Manager for Images 7.1.1.0 IBM Tivoli Network Manager 3.9 FP3 IBM Tivoli Network Manager 3.8 FP7 IBM Tivoli Netcool/System Service Monitor 4.0.1 IBM Tivoli Netcool/System Service Monitor 4.0.0 FP9 IBM Tivoli Netcool/System Service Monitor 4.0.0 FP8 IBM Tivoli Netcool/System Service Monitor 4.0.0 FP7 IBM Tivoli Netcool/System Service Monitor 4.0.0 FP6 IBM Tivoli Netcool/System Service Monitor 4.0.0 FP5 IBM Tivoli Netcool/System Service Monitor 4.0.0 FP4 IBM Tivoli Netcool/System Service Monitor 4.0.0 FP3 IBM Tivoli Netcool/System Service Monitor 4.0.0 FP2 IBM Tivoli Netcool/System Service Monitor 4.0.0 FP13 IBM Tivoli Netcool/System Service Monitor 4.0.0 FP12 IBM Tivoli Netcool/System Service Monitor 4.0.0 FP11 IBM Tivoli Netcool/System Service Monitor 4.0.0 FP10 IBM Tivoli Netcool/System Service Monitor 4.0.0 FP1 IBM Tivoli Netcool/System Service Monitor 4.0 IBM Tivoli Netcool/System Service Monitor 0 IBM Tivoli Netcool/OMNIbus 7.4 IBM Tivoli Netcool/OMNIbus 7.3.1 IBM Tivoli Netcool/OMNIbus 7.3 IBM Tivoli Netcool/OMNIbus 7.2.1 IBM Tivoli Netcool Portal 2.1.2 IBM Tivoli Management Framework 4.1.1 IBM Tivoli Endpoint Manager for Remote Control 8.2.1 IBM Tivoli Endpoint Manager 8.2.1310 IBM Tivoli Endpoint Manager 8.2 patch 3 IBM Tivoli Endpoint Manager 8.2 IBM Tivoli Composite Application Manager for Transactions 7.3.0.1 IBM Tivoli Composite Application Manager for Transactions 7.3.0 IBM Tivoli Composite Application Manager for Transactions 7.2.0.2 IBM Tivoli Composite Application Manager for Transactions 7.2.0.1 IBM Tivoli Composite Application Manager for Transactions 7.2.0 IBM Tivoli Composite Application Manager for Transactions 7.1.0.2 IBM Tivoli Composite Application Manager for Transactions 7.1.0.1 IBM Tivoli Composite Application Manager for Transactions 7.1.0 IBM Storwize V7000 Unified 1.4 1 IBM Storwize V7000 Unified 1.4 0 IBM Storwize V7000 Unified 1.3.2 3 IBM Storwize V7000 Unified 1.3.2 1 IBM Storwize V7000 Unified 1.3.2 0 IBM Storwize V7000 Unified 1.3.1.0 IBM Storwize V7000 Unified 1.3.0.5 IBM Storwize V7000 Unified 1.3.0.0 IBM Sterling Connect:Express for UNIX 1.5.0 IBM Sterling Connect:Express for UNIX 1.4.6 IBM Smart Analytics System 7710 0 IBM Smart Analytics System 7700 0 IBM Smart Analytics System 7600 9.7 IBM Smart Analytics System 7600 9.5 IBM Smart Analytics System 7600 10.0 IBM Smart Analytics System 5600 2 IBM Smart Analytics System 5600 1 IBM Smart Analytics System 2050 0 IBM Smart Analytics System 1050 0 IBM Service Delivery Manager 7.2.4 IBM Service Delivery Manager 7.2.2 IBM Service Delivery Manager 7.2.1 IBM Security Virtual Server Protection for VMware 1.1.1.0 IBM Security Virtual Server Protection for VMware 1.1.0.1 IBM Security Virtual Server Protection for VMware 1.1 IBM Security Virtual Server Protection for VMware 1.0 IBM Scale Out Network Attached Storage 1.3.2 1-21 IBM Scale Out Network Attached Storage 1.3.2 1-20 IBM Scale Out Network Attached Storage 1.3.2 IBM Scale Out Network Attached Storage 1.3.1 IBM Scale Out Network Attached Storage 1.3.2.3 IBM Scale Out Network Attached Storage 1.3.2.2 IBM Scale Out Network Attached Storage 1.3.0.5 IBM Scale Out Network Attached Storage 1.3.0.4 IBM Sametime Unified Telephony 8.5.2 IBM Rational ClearCase 8.0 3 IBM Rational ClearCase 8.0 2 IBM Rational ClearCase 7.1.2 8 IBM Rational ClearCase 7.1.2 7 IBM Rational ClearCase 7.1.2 6 IBM Rational ClearCase 7.1.2 5 IBM Rational ClearCase 7.1.2 4 IBM Rational ClearCase 7.1.2 3 IBM Rational ClearCase 7.1.2 10 IBM Rational ClearCase 7.1.2 1 IBM Rational ClearCase 7.1.2 IBM Rational ClearCase 8.0.0.6 IBM Rational ClearCase 8.0.0.5 IBM Rational ClearCase 8.0.0.4 IBM Rational ClearCase 8.0.0.03 IBM Rational ClearCase 8.0 IBM Rational ClearCase 7.1.2.9 IBM Rational ClearCase 7.1.2.2 IBM Initiate Master Data Service 9.7 IBM Initiate Master Data Service 9.5 IBM Infosphere Master Data Management 10.1 Standard Editio IBM Infosphere Master Data Management 10.0 Standard Editio IBM InfoSphere Balanced Warehouse D5100 IBM InfoSphere Balanced Warehouse C4000 IBM InfoSphere Balanced Warehouse C3000 IBM Informix Genero 2.41 IBM Informix Genero 2.40 IBM Informix Genero 2.32 IBM Cloudburst 2.1.1 IBM Cloudburst 2.1 IBM Cloudburst 1.2 IBM AIX 7.1 IBM AIX 6.1 IBM AIX 5.3 HP SSL for OpenVMS 1.4-467 HP HP-UX B.11.31 HP HP-UX B.11.11 Gentoo Linux EFI Fiery print controller 2.0 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 CentOS CentOS 5 Avaya Voice Portal 5.1.3 Avaya Voice Portal 5.1.2 Avaya Voice Portal 5.1.1 Avaya Voice Portal 5.1 SP3 Avaya Voice Portal 5.1 SP2 Avaya Voice Portal 5.1 SP1 Avaya Voice Portal 5.1 Avaya Voice Portal 5.0 SP2 Avaya Voice Portal 5.0 SP1 Avaya Voice Portal 5.0 Avaya Proactive Contact 5.1 Avaya Proactive Contact 5.0 Avaya one-X Client Enablement Services 6.0 Avaya Meeting Exchange 6.2 Avaya Meeting Exchange 6.0 Avaya IQ 5.2 Avaya IQ 5.1.1 Avaya IQ 5.1 Avaya IQ 5 Avaya IP Office Server Edition 8.1 Avaya IP Office Application Server 8.1 Avaya IP Office Application Server 8.0 Avaya Conferencing Standard Edition 6.0.1 Avaya Conferencing Standard Edition 6.0 SP1 Avaya Conferencing Standard Edition 6.0 Avaya Communication Server 1000M Signaling Server 7.5 Avaya Communication Server 1000M Signaling Server 7.0 Avaya Communication Server 1000M Signaling Server 6.0 Avaya Communication Server 1000M 7.5 Avaya Communication Server 1000M 7.0 Avaya Communication Server 1000M 6.0 Avaya Communication Server 1000E Signaling Server 7.5 Avaya Communication Server 1000E Signaling Server 7.0 Avaya Communication Server 1000E Signaling Server 6.0 Avaya Communication Server 1000E 7.5 Avaya Communication Server 1000E 7.0 Avaya Communication Server 1000E 6.0 Avaya Aura System Platform 6.2.1 Avaya Aura System Platform 6.0.2 Avaya Aura System Platform 6.0.1 Avaya Aura System Platform 6.2.1.0.9 Avaya Aura System Platform 6.2 SP1 Avaya Aura System Platform 6.2 Avaya Aura System Platform 6.0.3.9.3 Avaya Aura System Platform 6.0.3.8.3 Avaya Aura System Platform 6.0.3.0.3 Avaya Aura System Platform 6.0 SP3 Avaya Aura System Platform 6.0 SP2 Avaya Aura System Platform 6.0 Avaya Aura System Platform 1.0 Avaya Aura System Manager 6.3 Avaya Aura System Manager 6.2.3 Avaya Aura System Manager 6.2 SP3 Avaya Aura System Manager 6.2 Avaya Aura System Manager 6.1.5 Avaya Aura System Manager 6.1.3 Avaya Aura System Manager 6.1.2 Avaya Aura System Manager 6.1.1 Avaya Aura System Manager 6.1 SP2 Avaya Aura System Manager 6.1 Sp1 Avaya Aura System Manager 6.1 Avaya Aura System Manager 6.0 SP1 Avaya Aura System Manager 6.0 Avaya Aura System Manager 5.2 Avaya Aura Session Manager 6.2.1 Avaya Aura Session Manager 6.1.5 Avaya Aura Session Manager 6.1.3 Avaya Aura Session Manager 6.1.2 Avaya Aura Session Manager 6.1.1 Avaya Aura Session Manager 6.0.1 Avaya Aura Session Manager 6.3 Avaya Aura Session Manager 6.2.2 Avaya Aura Session Manager 6.2 SP1 Avaya Aura Session Manager 6.2 Avaya Aura Session Manager 6.1 SP2 Avaya Aura Session Manager 6.1 Sp1 Avaya Aura Session Manager 6.1 Avaya Aura Session Manager 6.0 SP1 Avaya Aura Session Manager 6.0 Avaya Aura Session Manager 5.2.1 Avaya Aura Session Manager 5.2 SP2 Avaya Aura Session Manager 5.2 SP1 Avaya Aura Session Manager 5.2 Avaya Aura Session Manager 1.1.1 Avaya Aura Session Manager 1.1 Avaya Aura Session Manager 1.0 Avaya Aura Presence Services 6.1.2 Avaya Aura Presence Services 6.1.1 Avaya Aura Presence Services 6.1 SP2 Avaya Aura Presence Services 6.1 SP1 Avaya Aura Presence Services 6.1 Avaya Aura Presence Services 6.0 Avaya Aura Messaging 6.1.1 Avaya Aura Messaging 6.2 Avaya Aura Messaging 6.1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Messaging 6.0.1 Avaya Aura Messaging 6.0 Avaya Aura Experience Portal 6.0.2 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0.1 Avaya Aura Experience Portal 6.0 SP2 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0 SP1 Avaya Aura Experience Portal 6.0 Avaya Aura Conferencing 7.0 Avaya Aura Communication Manager Utility Services 6.2.5.0.15 Avaya Aura Communication Manager Utility Services 6.2.4.0.15 Avaya Aura Communication Manager Utility Services 6.2 Avaya Aura Communication Manager Utility Services 6.1.0.9.8 Avaya Aura Communication Manager Utility Services 6.1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Communication Manager Utility Services 6.0 Avaya Aura Communication Manager 6.2 Avaya Aura Communication Manager 6.0.1 Avaya Aura Communication Manager 6.0 Avaya Aura Application Server 5300 SIP Core 3.0 PB3 Avaya Aura Application Server 5300 SIP Core 3.0 Avaya Aura Application Server 5300 SIP Core 2.1 Avaya Aura Application Server 5300 SIP Core 2.0 PB28 Avaya Aura Application Server 5300 SIP Core 2.0 PB26 Avaya Aura Application Server 5300 SIP Core 2.0 PB25 Avaya Aura Application Server 5300 SIP Core 2.0 PB23 Avaya Aura Application Server 5300 SIP Core 2.0 PB19 Avaya Aura Application Server 5300 SIP Core 2.0 PB16 Avaya Aura Application Server 5300 SIP Core 2.0 Avaya Aura Application Enablement Services 5.2.1 Avaya Aura Application Enablement Services 6.2 Avaya Aura Application Enablement Services 6.1.2 Avaya Aura Application Enablement Services 6.1.1 Avaya Aura Application Enablement Services 6.1 Avaya Aura Application Enablement Services 5.2.4 Avaya Aura Application Enablement Services 5.2.3 Avaya Aura Application Enablement Services 5.2.2 Avaya Aura Application Enablement Services 5.2 Avaya 96x1 IP Deskphones 6.2 Apple Mac OS X Server 10.7.5 Apple Mac OS X Server 10.6.8 Apple Mac OS X 10.8.4 Apple Mac OS X 10.8.2 Apple Mac OS X 10.8.1 Apple Mac OS X 10.7.5 Apple Mac OS X 10.8.3 Apple Mac OS X 10.8 Apple Mac OS X 10.6.8
Not Vulnerable:	Stunnel Stunnel 4.55 Splunk Splunk 5.0.3 Redhat JBoss Enterprise Web Server 2.0.1 Redhat JBoss Enterprise Application Platform 6.1 Oracle Solaris 11.1.7.5.0 OpenSSL Project OpenSSL 1.0.1d OpenSSL Project OpenSSL 1.0.0k OpenSSL Project OpenSSL 0.9.8y McAfee FireWall Enterprise 8.2.1 Juniper JUNOS Space 14.1R1 Juniper Junos Pulse Secure Access Service (IVE) 7.4r3 Juniper Junos Pulse Secure Access Service (IVE) 7.3r6 Juniper Junos Pulse Secure Access Service (IVE) 7.2r11 Juniper Junos Pulse Secure Access Service (IVE) 7.1r15 Juniper Junos Pulse Access Control Service (UAC) 4.4r3 Juniper Junos Pulse Access Control Service (UAC) 4.3r6 Juniper Junos Pulse Access Control Service (UAC) 4.2r5.1 Juniper Junos Pulse Access Control Service (UAC) 4.1r8.1 Juniper JUNOS 13.1R2 Juniper JUNOS 12.3R3 Juniper JUNOS 12.2R4 Juniper JUNOS 12.1R6 Juniper JUNOS 11.4R8 IBM Tivoli Storage Productivity Center 5.1.1.2 IBM Tivoli Storage Productivity Center 4.2.2.170 (FP4) IBM Tivoli Endpoint Manager 8.2.1372 IBM Storwize V7000 Unified 1.4.1.0 IBM Scale Out Network Attached Storage 1.4.1.0 IBM Rational ClearCase 8.0.1 IBM Rational ClearCase 8.0 7 IBM Rational ClearCase 7.1.2 11 HP SSL for OpenVMS 1.4-471 Apple Mac OS X 10.8.5

OpenSSL CVE-2013-0166 Remote Denial of Service Vulnerability

OpenSSL is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to crash the application using the affected library, denying service to legitimate users.

Note: This issue was previously discussed in BID 57755 (OpenSSL CVE-2012-2686 Remote Denial of Service Vulnerability), but has been given its own record to better document it.

OpenSSL versions 1.0.1c, 1.0.0j and 0.9.8x are vulnerable.

OpenSSL CVE-2013-0166 Remote Denial of Service Vulnerability

An attacker can use readily available network utilities.

OpenSSL CVE-2013-0166 Remote Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Apple Mac OS X 10.6.8

• Apple For Mac OS X 10.6.8 SecUpd2013-004.dmg
  http://www.apple.com/support/downloads/


• Apple For Mac OS X Server 10.6.8 SecUpdSrvr2013-004.dmg
  http://support.apple.com/downloads/

OpenSSL CVE-2013-0166 Remote Denial of Service Vulnerability

References:

• CVE-2013-0166 openssl: DoS due to improper handling of OCSP response verificatio (Red Hat Bugzilla)
  
• Fiery Homepage (EFI)
  
• Firewall Enterprise and Network User Behavior Analysis response to CVE-2013-0166 (McAfee)
  
• HPSBUX02856 SSRT101104 rev.1 - HP-UX Running OpenSSL, Remote Denial of Service ( (HP)
  
• Lucky Thirteen vulnerability in Solaris OpenSSL (Oracle)
  
• Lucky Thirteen vulnerability in Sun QFS and Sun Storage Archive Manager OpenSSL (Oracle)
  
• OpenSSL Project (OpenSSL Project)
  
• openssl security update (RHSA-2013-0587) (Avaya)
  
• Splunk 5.0.3 addresses multiple vulnerabilities - May 28, 2013 (Splunk)
  
• Stunnel Version 4.55 changelog (stunnel)
  
• 2013-07 Security Bulletin: Junos: Multiple security vulnerabilities in OpenSSL (Juniper Networks)
  
• 2014-11 Security Bulletin: Junos Space: Multiple vulnerabilities resolved by thi (Juniper)
  
• About the security content of OS X Mountain Lion v10.8.5 and Security Update 201 (Apple)
  
• GSKit Security Vulnerabilities addressed in IBM Tivoli Netcool OMNIbus (IBM)
  
• GSKit Security Vulnerabilities addressed in IBM Tivoli Network Manager 3.8 and 3 (IBM)
  
• HPSBOV02852 SSRT101108 rev.1 - HP SSL for OpenVMS, Remote Denial of Service (DoS (HP)
  
• HPSBUX02909 SSRT101289 rev.1 - HP-UX Apache Web Server, Remote Denial of Service (HP)
  
• IBM Informix Genero affected by multiple vulnerabilities in OpenSSL (IBM)
  
• IBM Netcool System Service Monitor SSM 4.0 Fix Pack 1 README Netcool/System Serv (IBM)
  
• IBM Netcool System Service Monitor SSM 4.0 Fix Pack 14 README Netcool/System Ser (IBM)
  
• IBM Tivoli Composite Application Manager for Transactions Internet Service Monit (IBM)
  
• IBM Tivoli Network Manager IP 3.8.0 Fix Pack 7, 3.8.0-TIV-ITNMIP-FP0007 (IBM)
  
• IBM Tivoli Network Manager IP 3.9.0 Fix Pack 3, 3.9.0-TIV-ITNMIP-FP0003 (IBM)
  
• Important: JBoss Enterprise Application Platform 6.1.0 update (Red Hat)
  
• Junos Pulse Secure Access Service (IVE) and Junos Pulse Access Control Service ( (Juniper Networks)
  
• Moderate: openssl security update (Red Hat)
  
• Moderate: openssl security update (Red Hat)
  
• Multiple OpenSSL vulnerabilities (IBM)
  
• OpenSSL Security Advisory [05 Feb 2013] (OpenSSL)
  
• Rational ClearCase Fix Pack 11 (7.1.2.11) for 7.1.2 (IBM)
  
• Rational ClearCase Fix Pack 7 (8.0.0.7) for 8.0 (IBM)
  
• Rational ClearQuest 8.0.1 (IBM)
  
• Security Bulletin: IBM Security Virtual Server Protection for VMware System can (IBM)
  
• Security Bulletin: IBM Smart Analytics System 1050, 2050, and 5600 and IBM InfoS (IBM)
  
• Security Bulletin: IBM Smart Analytics System 7600 is affected by vulnerabilitie (IBM)
  
• Security Bulletin: IBM Sterling Connect:Express for UNIX is affected by multiple (IBM)
  
• Security Bulletin: IBM Tivoli Composite Application Monitoring for Transactions (IBM)
  
• Security Bulletin: IBM Tivoli Netcool System Service Monitors/Application Servic (IBM)
  
• Security Bulletin: Multiple vulnerabilities exist in the OpenSSL component of IB (IBM)
  
• Security Bulletin: OpenSSL vulnerability issues for IBM Cloudburst (IBM)
  
• Security Bulletin: OpenSSL vulnerability issues for IBM Service Delivery Manager (IBM)
  
• Security Bulletin: SONAS Update Includes Fixes for Multiple Vendor Security Vuln (IBM)
  
• Security Bulletin: SSL TLS & DTLS Plaintext Recovery Attack (IBM)
  
• Security Bulletin: Storwize V7000 Unified Update Includes Fixes for Multiple Ven (IBM)
  
• Security Bulletin: Tivoli Endpoint Manager for Remote Control is affected by mul (IBM)
  
• Security Bulletin: Tivoli Endpoint Manager OCSP invalid key DoS issue (CVE-2013- (IBM)
  
• Security Bulletin: Tivoli Endpoint Manager TLS 1.1 and 1.2 AES-NI crash (CVE-201 (IBM)
  
• Security Bulletin: Tivoli Management Framework affected by vulnerabilities in Op (IBM)
  
• Security Bulletin: Tivoli Provisioning Manager for OS Deployment and Tivoli Prov (IBM)
  
• Security Bulletin: Tivoli Remote Control is affected by multiple OpenSSL vulnera (IBM)
  
• Tivoli Storage Productivity Center affected by vulnerabilities in OpenSSL (CVE-2 (IBM)
  
• Tivoli Workload Scheduler Openssl Multiple Vulnerabilities (IBM)
  
• VMSA-2013-0009 VMware ESX and ESXi updates to third party libraries (VMware)
  
• VU#737740: Fiery 2.0 print controllers use a vulnerable version of OpenSSL (US-CERT)
  
• Vulnerabilities in IBM Rational ClearCase OpenSSL Component (CVE-2013-0169, CVE- (IBM)
  
• Vulnerabilities in Sametime Unified Telephony CVE-2013-0169 CVE-2013-0166 CVE-20 (IBM)
  
• Wind River Linux openssl Security Update (WIND00404141) (Avaya)
  
• Wind River WIND00404141 (Wind River)
  
• Xerox Security Bulletin XRX13-007 (Xerox)