OpenSSL TLS Handshake Null Pointer Dereference Denial Of Service Vulnerability

Bugtraq ID:	64691
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2013-4353
Remote:	Yes
Local:	No
Published:	Jan 06 2014 12:00AM
Updated:	Apr 13 2015 09:27PM
Credit:	Anton Johansson
Vulnerable:	Red Hat Enterprise Virtualization Hypervisor for RHEL 6 0 Red Hat Enterprise Linux Workstation Optional 6 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server Optional 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop Optional 6 Red Hat Enterprise Linux Desktop 6 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 OpenSSL Project OpenSSL 1.0.1c OpenSSL Project OpenSSL 1.0.1a OpenSSL Project OpenSSL 1.0.1 IBM Virtual I/O Server (VIOS) 2.1 IBM Virtual I/O Server (VIOS) 2.2 IBM Virtual I/O Server (VIOS) 2.1 IBM Virtual I/O Server (VIOS) 2.0 IBM Tivoli Storage Productivity Center 4.2.1.185 IBM Tivoli Storage Productivity Center 4.2.1 Fix Pack 4 IBM Tivoli Storage Productivity Center 4.2.1 IBM Tivoli Management Framework 4.1.1 IBM Storwize V7000 Unified 1.3.1.0 IBM Storwize V7000 Unified 1.3.0.5 IBM Storwize V7000 Unified 1.3.0.0 IBM Scale Out Network Attached Storage 1.3.0.5 IBM Scale Out Network Attached Storage 1.3.0.4 IBM Rational ClearCase 7.1.2.2 IBM Rational ClearCase 7.1.1.5 IBM Rational ClearCase 7.1.1.4 IBM AIX 7.1 IBM AIX 6.1 IBM AIX 5.3 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 CentOS CentOS 6 Avaya Aura Session Manager 6.2.1 Avaya Aura Session Manager 6.1.3 Avaya Aura Session Manager 6.1.2 Avaya Aura Session Manager 6.1.1 Avaya Aura Session Manager 6.2 Avaya Aura Session Manager 6.1 SP2 Avaya Aura Session Manager 6.1 Sp1 Avaya Aura Session Manager 6.1 Avaya Aura Session Manager 6.0 SP1 Avaya Aura Session Manager 6.0 Avaya Aura Session Manager 5.2 SP2 Avaya Aura Session Manager 5.2 SP1 Avaya Aura Session Manager 5.2 Avaya Aura Experience Portal 6.0 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Attachmate Reflection X 14.1 Attachmate Reflection X 14.0 Attachmate Reflection 14.1 SP1 Attachmate Reflection 14.1 Attachmate Reflection 14.0 SP1 Attachmate Reflection 14.0
Not Vulnerable:

OpenSSL TLS Handshake Null Pointer Dereference Denial Of Service Vulnerability

OpenSSL is prone to a remote denial-of-service vulnerability because it fails to properly process certain maliciously crafted S/MIME messages.

An attacker can exploit this issue to crash a connecting client and cause denial-of-service conditions.

OpenSSL 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a and 1.0.1 are vulnerable.

OpenSSL TLS Handshake Null Pointer Dereference Denial Of Service Vulnerability

Attackers can use readily available tools to exploit this issue.

OpenSSL TLS Handshake Null Pointer Dereference Denial Of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

OpenSSL TLS Handshake Null Pointer Dereference Denial Of Service Vulnerability

References:

• Multiple vulnerabilities in OpenSSL (Oracle)
  
• 2.1.1 New Features and Changes (Electric Sheep Fencing LLC)
  
• Attachmate Security Update for OpenSSL 'Heartbleed' Vulnerability CVE-2014-0160 (Attachmate)
  
• Fix for TLS record tampering bug CVE-2013-4353 (Dr. Stephen Henson)
  
• Multiple vulnerabilities in OpenSSL (Oracle)
  
• OpenSSL Homepage (OpenSSL)
  
• OpenSSL security vulnerability issues on IBM SONAS (IBM)
  
• OpenSSL vulnerabilities Changelog (OpenSSL)
  
• Proventia Network Security Controller is affected by multiple OpenSSL vulnerabil (IBM)
  
• Reflection 14.1 SP3 Update 1 Release Notes (Attachmate)
  
• Security Bulletin: IBM Flex System Manager (FSM) and compatible IBM Systems Dire (IBM)
  
• Security Bulletin: Vulnerabilities in ClearCase OpenSSL Component (CVE-2013-4353 (IBM)
  
• Security Updates and Reflection 2011 or Reflection 2008 (Attachmate)
  
• SOL15180: OpenSSL vulnerability CVE-2013-4353 (F5 Networks)
  
• Splunk 6.0.3 addresses two vulnerabilities - April 10, 2014 (Splunk )
  
• Synology DiskStation Manager Version: 5.0-4458 Update 1 Change Log (Synology )
  
• Technical Note 1708 Security Updates and Reflection (Attachmate)
  
• IBM Initiate Master Data Service, IBM InfoSphere Master Data Management Standar (IBM)
  
• IBM Security Network Intrusion Prevention System can be affected by vulnerabili (IBM)
  
• HPSBMU02998 rev.1 - HP System Management Homepage (SMH) running OpenSSL on Linux (HP)
  
• IBM Endpoint Manager for Remote Control Interim Fix 9.0.0-TIV-IEMRC900-IF0003 (IBM)
  
• IBM Endpoint Manager for Remote Control Interim Fix 9.0.1-TIV-IEMRC901-IF0001 (IBM)
  
• IBM InfoSphere Balanced Warehouse C3000, C4000, and D5100 are affected by vulner (IBM)
  
• IBM Smart Analytics System 1050, 2050, 5600, 5710, 7600, 7700 and 7710 are affec (IBM)
  
• IBM Sterling B2B Integrator and IBM Sterling File Gateway are affected by vulner (IBM)
  
• IBM Tivoli Composite Application Manager for Transactions is affected by vulnera (IBM)
  
• IBM Tivoli Netcool System Service Monitors/Application Service Monitors (IBM)
  
• IV53964: SECURITY APAR,MULTIPLE OPENSSL VULNERABILITIES IN IBM ENDPOINT MANAGER (IBM)
  
• McAfee Security Bulletin �?? OpenSSL Heartbleed vulnerability patched in McAfee pr (McAfee)
  
• Multiple OpenSSL vulnerabilities (IBM)
  
• openssl security update (RHSA-2014-0015) (Avaya)
  
• OpenSSL security vulnerability issues on IBM Storwize V7000 Unified system (CVE- (IBM)
  
• Power System Firmware is affected by openssl vulnerabilities (IBM)
  
• Security Bulletin: IBM Security Proventia Network Active Bypass is affected by v (IBM)
  
• Security Bulletin: Multiple Java security vulnerabilities addressed in IBM Endpo (IBM)
  
• Security Bulletin: Multiple OpenSSL vulnerabilities in IBM Endpoint Manager for (IBM)
  
• Security Bulletin: Multiple OpenSSL vulnerabilities in Tivoli Endpoint Manager f (IBM)
  
• Tivoli Management Framework affected by vulnerability in OpenSSL versions prior (IBM)
  
• Tivoli Storage Productivity Center is affected by the following OpenSSL vulnerab (IBM)