OpenSSL Denial of Service Vulnerabilities
BID:9899
Info
OpenSSL Denial of Service Vulnerabilities
| Bugtraq ID: | 9899 |
| Class: | Unknown |
| CVE: |
CVE-2004-0079 CVE-2004-0112 CVE-2004-0081 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Mar 17 2004 12:00AM |
| Updated: | Mar 19 2015 08:20AM |
| Credit: | These issues were discovered by Stephen Henson and the OpenSSL Group. |
| Vulnerable: |
VMWare GSX Server 3.0 build 7592 VMWare GSX Server 2.5.1 build 5336 VMWare GSX Server 2.5.1 VMWare GSX Server 2.0.1 build 2129 VMWare GSX Server 2.0 Tarantella Enterprise 3 3.40 Tarantella Enterprise 3 3.30 Tarantella Enterprise 3 3.20 0 Symantec Clientless VPN Gateway 4400 Series 5.0 Sun Crypto Accelerator 4000 1.0 Stonesoft StoneGate VPN Client 2.0.9 Stonesoft StoneGate VPN Client 2.0.8 Stonesoft StoneGate VPN Client 2.0.7 Stonesoft StoneGate VPN Client 2.0 Stonesoft StoneGate VPN Client 1.7.2 Stonesoft StoneGate VPN Client 1.7 Stonesoft StoneGate 2.2.4 Stonesoft StoneGate 2.2.1 Stonesoft StoneGate 2.2 Stonesoft StoneGate 2.1 Stonesoft StoneGate 2.0.9 Stonesoft StoneGate 2.0.8 Stonesoft StoneGate 2.0.7 Stonesoft StoneGate 2.0.6 Stonesoft StoneGate 2.0.5 Stonesoft StoneGate 2.0.4 Stonesoft StoneGate 2.0.1 Stonesoft StoneGate 1.7.2 Stonesoft StoneGate 1.7.1 Stonesoft StoneGate 1.7 Stonesoft StoneGate 1.6.3 Stonesoft StoneGate 1.6.2 Stonesoft StoneGate 1.5.18 Stonesoft StoneGate 1.5.17 Stonesoft StoneBeat WebCluster 2.5 Stonesoft StoneBeat WebCluster 2.0 Stonesoft StoneBeat SecurityCluster 2.5 Stonesoft StoneBeat SecurityCluster 2.0 Stonesoft StoneBeat FullCluster for Raptor 2.5 Stonesoft StoneBeat FullCluster for Raptor 2.0 Stonesoft StoneBeat FullCluster for ISA Server 3.0 Stonesoft StoneBeat FullCluster for Gauntlet 2.0 Stonesoft StoneBeat FullCluster for Firewall-1 3.0 Stonesoft StoneBeat FullCluster for Firewall-1 2.0 Stonesoft ServerCluster 2.5.2 Stonesoft ServerCluster 2.5 SGI ProPack 3.0 SP6 SGI ProPack 3.0 SGI ProPack 2.4 SGI ProPack 2.3 SGI IRIX 6.5.24 m SGI IRIX 6.5.23 m SGI IRIX 6.5.22 m SGI IRIX 6.5.21 m SGI IRIX 6.5.21 f SGI IRIX 6.5.20 m SGI IRIX 6.5.20 f Secure Computing Sidewinder 5.2 .1.02 Secure Computing Sidewinder 5.2 .1 Secure Computing Sidewinder 5.2 .0.04 Secure Computing Sidewinder 5.2 .0.03 Secure Computing Sidewinder 5.2 .0.02 Secure Computing Sidewinder 5.2 .0.01 Secure Computing Sidewinder 5.2 SCO Unixware 7.1.3 SCO Unixware 7.1.1 SCO Open Server 5.0.7 SCO Open Server 5.0.6 RSA Security BSAFE SSL-J SDK 3.1 RSA Security BSAFE SSL-J SDK 3.0.1 RSA Security BSAFE SSL-J SDK 3.0 RedHat openssl096b-0.9.6b-3.i386.rpm RedHat openssl096-0.9.6-15.i386.rpm RedHat openssl-perl-0.9.7a-2.i386.rpm RedHat openssl-devel-0.9.7a-2.i386.rpm RedHat openssl-0.9.7a-2.i386.rpm RedHat Linux 8.0 RedHat Linux 7.3 i386 RedHat Linux 7.3 RedHat Linux 7.2 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux WS 3 RedHat Enterprise Linux ES 4 RedHat Enterprise Linux ES 3 RedHat Desktop 4.0 RedHat Desktop 3.0 Red Hat Fedora Core3 Red Hat Fedora Core2 Red Hat Fedora Core1 Red Hat Enterprise Linux AS 4 Red Hat Enterprise Linux AS 3 OpenSSL Project OpenSSL 0.9.7 c OpenSSL Project OpenSSL 0.9.7 beta3 OpenSSL Project OpenSSL 0.9.7 beta2 OpenSSL Project OpenSSL 0.9.7 beta1 OpenSSL Project OpenSSL 0.9.7 b OpenSSL Project OpenSSL 0.9.7 a OpenSSL Project OpenSSL 0.9.7 OpenSSL Project OpenSSL 0.9.6 k OpenSSL Project OpenSSL 0.9.6 j OpenSSL Project OpenSSL 0.9.6 i OpenSSL Project OpenSSL 0.9.6 h OpenSSL Project OpenSSL 0.9.6 g OpenSSL Project OpenSSL 0.9.6 f OpenSSL Project OpenSSL 0.9.6 e OpenSSL Project OpenSSL 0.9.6 d OpenSSL Project OpenSSL 0.9.6 c OpenBSD OpenBSD 3.4 OpenBSD OpenBSD 3.3 Novell iManager 2.0 Novell iManager 1.5 Novell eDirectory 8.7.1 SU1 Novell eDirectory 8.7.1 Novell eDirectory 8.7 Novell eDirectory 8.6.2 Novell eDirectory 8.5.27 Novell eDirectory 8.5.12 a Novell eDirectory 8.5 Novell eDirectory 8.0 NetScreen Instant Virtual Extranet 3.3.1 NetScreen Instant Virtual Extranet 3.3 NetScreen Instant Virtual Extranet 3.2 NetScreen Instant Virtual Extranet 3.1 NetScreen Instant Virtual Extranet 3.0 Lite Speed Technologies LiteSpeed Web Server 1.3.1 Lite Speed Technologies LiteSpeed Web Server 1.3 RC3 Lite Speed Technologies LiteSpeed Web Server 1.3 RC2 Lite Speed Technologies LiteSpeed Web Server 1.3 RC1 Lite Speed Technologies LiteSpeed Web Server 1.3 Lite Speed Technologies LiteSpeed Web Server 1.2.2 Lite Speed Technologies LiteSpeed Web Server 1.2.1 Lite Speed Technologies LiteSpeed Web Server 1.2 RC2 Lite Speed Technologies LiteSpeed Web Server 1.2 RC1 Lite Speed Technologies LiteSpeed Web Server 1.1.1 Lite Speed Technologies LiteSpeed Web Server 1.1 Lite Speed Technologies LiteSpeed Web Server 1.0.3 Lite Speed Technologies LiteSpeed Web Server 1.0.2 Lite Speed Technologies LiteSpeed Web Server 1.0.1 HP WBEM A.02.00.01 HP WBEM A.02.00.00 HP WBEM A.01.05.08 HP HP-UX 11.23 HP HP-UX 11.11 HP HP-UX 11.0 HP HP-UX 8.5 HP Apache-Based Web Server 2.0.43 .04 HP Apache-Based Web Server 2.0.43 .00 HP AAA Server FreeBSD FreeBSD 5.2 -RELEASE FreeBSD FreeBSD 5.2 FreeBSD FreeBSD 5.1 -RELENG FreeBSD FreeBSD 5.1 -RELEASE FreeBSD FreeBSD 5.1 FreeBSD FreeBSD 4.9 FreeBSD FreeBSD 4.8 -RELENG FreeBSD FreeBSD 4.8 Computer Associates eTrust Security Command Center 1.0 Citrix Secure Gateway for Solaris 1.13 Citrix Secure Gateway for Solaris 1.12 Citrix Secure Gateway for Solaris 1.1 Cisco WebNS 7.10 .0.06s Cisco WebNS 7.10 Cisco WebNS 7.2 0.0.03 Cisco WebNS 7.1 0.2.06 Cisco WebNS 7.1 0.1.02 Cisco WebNS 6.10 B4 Cisco WebNS 6.10 Cisco Threat Response Cisco Secure Content Accelerator 10000 Cisco PIX Firewall 6.3.2 Cisco PIX Firewall 6.3.1 Cisco PIX Firewall 6.3 (3.109) Cisco PIX Firewall 6.3 (3.102) Cisco PIX Firewall 6.3 (1) Cisco PIX Firewall 6.3 Cisco PIX Firewall 6.2.3 Cisco PIX Firewall 6.2.2 .111 Cisco PIX Firewall 6.2.2 Cisco PIX Firewall 6.2.1 Cisco PIX Firewall 6.2 (3.100) Cisco PIX Firewall 6.2 (3) Cisco PIX Firewall 6.2 (2) Cisco PIX Firewall 6.2 (1) Cisco PIX Firewall 6.2 Cisco PIX Firewall 6.1.5 Cisco PIX Firewall 6.1.4 Cisco PIX Firewall 6.1.3 Cisco PIX Firewall 6.1 (5) Cisco PIX Firewall 6.1 (4) Cisco PIX Firewall 6.1 (3) Cisco PIX Firewall 6.1 (2) Cisco PIX Firewall 6.1 (1) Cisco PIX Firewall 6.1 Cisco PIX Firewall 6.0.4 Cisco PIX Firewall 6.0.3 Cisco PIX Firewall 6.0 (4.101) Cisco PIX Firewall 6.0 (4) Cisco PIX Firewall 6.0 (2) Cisco PIX Firewall 6.0 (1) Cisco PIX Firewall 6.0 Cisco Okena Stormwatch 3.2 Cisco MDS 9000 Cisco IOS 12.2ZA Cisco IOS 12.2SY Cisco IOS 12.2(14)SY1 Cisco IOS 12.2(14)SY Cisco IOS 12.1(19)E1 Cisco IOS 12.1(13)E9 Cisco IOS 12.1(11b)E14 Cisco IOS 12.1(11b)E12 Cisco IOS 12.1(11b)E Cisco IOS 12.1(11)EC Cisco IOS 12.1(11)EA1 Cisco IOS 12.1(11)E Cisco GSS 4490 Global Site Selector 0 Cisco GSS 4480 Global Site Selector Cisco Firewall Services Module (FWSM) 2.1 (0.208) Cisco Firewall Services Module (FWSM) 1.1.3 Cisco Firewall Services Module (FWSM) 1.1.2 Cisco Firewall Services Module (FWSM) 1.1 (3.005) Cisco Firewall Services Module (FWSM) 0 Cisco CSS11500 Content Services Switch Cisco CSS11000 Content Services Switch Cisco CSS Secure Content Accelerator 2.0 Cisco CSS Secure Content Accelerator 1.0 Cisco CiscoWorks Common Services 2.2 Cisco CiscoWorks Common Management Foundation 2.1 Cisco Call Manager Cisco Application & Content Networking Software (ACNS) Cisco Access Registrar Check Point Software VPN-1 VSX NG with Application Intelligence Check Point Software VPN-1 Next Generation FP2 Check Point Software VPN-1 Next Generation FP1 Check Point Software VPN-1 Next Generation FP0 Check Point Software Providor-1 4.1 SP4 Check Point Software Providor-1 4.1 SP3 Check Point Software Providor-1 4.1 SP2 Check Point Software Providor-1 4.1 SP1 Check Point Software Providor-1 4.1 Check Point Software FireWall-1 VSX NG with Application Intelligence Check Point Software FireWall-1 Next Generation FP2 Check Point Software FireWall-1 Next Generation FP1 Check Point Software FireWall-1 Next Generation FP0 Check Point Software FireWall-1 GX 2.0 Blue Coat Systems ProxySG 0 Blue Coat Systems CacheOS CA/SA 4.1.12 Blue Coat Systems CacheOS CA/SA 4.1.10 Avaya VSU 7500 R2.0.1 Avaya VSU 5x 0 Avaya VSU 5000 R2.0.1 Avaya VSU 500 0 Avaya VSU 5 0 Avaya VSU 2000 R2.0.1 Avaya VSU 10000 R2.0.1 Avaya VSU 100 R2.0.1 Avaya SG5X 4.4 Avaya SG5X 4.3 Avaya SG5X 4.2 Avaya SG5 4.4 Avaya SG5 4.3 Avaya SG5 4.2 Avaya SG208 4.4 Avaya SG208 0 Avaya SG203 4.31.29 Avaya SG203 4.4 Avaya SG200 4.31.29 Avaya SG200 4.4 Avaya S8700 R2.0.1 Avaya S8700 R2.0.0 Avaya S8500 R2.0.1 Avaya S8500 R2.0.0 Avaya S8300 R2.0.1 Avaya S8300 R2.0.0 Avaya Intuity R5 R5.1.46 Avaya Intuity Audix R5 0 Avaya Intuity S3400 Avaya Intuity S3210 Avaya Intuity LX Avaya Converged Communications Server 2.0 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.3.9 Apple Mac OS X Server 10.3.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.3.9 Apple Mac OS X 10.3.3 4D WebSTAR 5.3.1 4D WebSTAR 5.3 4D WebSTAR 5.2.4 4D WebSTAR 5.2.3 4D WebSTAR 5.2.2 4D WebSTAR 5.2.1 4D WebSTAR 5.2 4D WebSTAR 4.0 |
| Not Vulnerable: |
VMWare GSX Server 2.5.2 Stonesoft StoneGate 2.2.12 SPARC Stonesoft StoneGate 2.2.5 x86 Stonesoft StoneGate 2.2.5 IBM zSeries Secure Computing Sidewinder 5.2.1 .10 RSA Security BSAFE SSL-J SDK 4.1 OpenSSL Project OpenSSL 0.9.7 d OpenSSL Project OpenSSL 0.9.6 m Lite Speed Technologies LiteSpeed Web Server 1.3.2 Lite Speed Technologies LiteSpeed Web Server 1.0.2 Citrix Secure Gateway for Solaris 1.14 Cisco Threat Response 2.0.3 Cisco MDS 9000 2.0 (0.86) Cisco MDS 9000 1.3 (3.33) Check Point Software VPN-1 4.1 SP6 Check Point Software VPN-1 4.1 SP5a Check Point Software VPN-1 4.1 SP5 Check Point Software VPN-1 4.1 SP4 Check Point Software VPN-1 4.1 SP3 Check Point Software VPN-1 4.1 SP2 Check Point Software VPN-1 4.1 SP1 Check Point Software VPN-1 4.1 Check Point Software Firewall-1 4.1 SP6 Check Point Software Firewall-1 4.1 SP5a Check Point Software Firewall-1 4.1 SP5 Check Point Software Firewall-1 4.1 SP4 Check Point Software Firewall-1 4.1 SP3 Check Point Software Firewall-1 4.1 SP2 Check Point Software Firewall-1 4.1 SP1 Check Point Software Firewall-1 4.1 4D WebSTAR 5.3.2 |
Discussion
OpenSSL Denial of Service Vulnerabilities
Three security vulnerabilities have been reported to affect OpenSSL. Each of these remotely exploitable issues may result in a denial of service in applications which use OpenSSL.
For the first issue, a NULL-pointer assignment can be triggered by attackers during SSL/TLS handshake exchanges. The CVE candidate name for this vulnerability is CAN-2004-0079. Versions 0.9.6c to 0.9.6k (inclusive) and from 0.9.7a to 0.9.7c (inclusive) are vulnerable.
The second issue is also exploited during the SSL/TLS handshake, but only when Kerberos ciphersuites are in use. The vendor has reported that this vulnerability may not be a threat to many, because it occurs only when Kerberos ciphersuites are in use, an uncommon configuration. The CVE candidate name for this vulnerability is CAN-2004-0112. Versions 0.9.7a, 0.9.7b, and 0.9.7c are affected.
This entry will be retired when individual BID records are created for each issue.
*Note: A third denial-of-service vulnerability included in the announcement was discovered affecting 0.9.6 and fixed in 0.9.6d. The CVE candidate name for this vulnerability is CAN-2004-0081.
Three security vulnerabilities have been reported to affect OpenSSL. Each of these remotely exploitable issues may result in a denial of service in applications which use OpenSSL.
For the first issue, a NULL-pointer assignment can be triggered by attackers during SSL/TLS handshake exchanges. The CVE candidate name for this vulnerability is CAN-2004-0079. Versions 0.9.6c to 0.9.6k (inclusive) and from 0.9.7a to 0.9.7c (inclusive) are vulnerable.
The second issue is also exploited during the SSL/TLS handshake, but only when Kerberos ciphersuites are in use. The vendor has reported that this vulnerability may not be a threat to many, because it occurs only when Kerberos ciphersuites are in use, an uncommon configuration. The CVE candidate name for this vulnerability is CAN-2004-0112. Versions 0.9.7a, 0.9.7b, and 0.9.7c are affected.
This entry will be retired when individual BID records are created for each issue.
*Note: A third denial-of-service vulnerability included in the announcement was discovered affecting 0.9.6 and fixed in 0.9.6d. The CVE candidate name for this vulnerability is CAN-2004-0081.
Exploit / POC
OpenSSL Denial of Service Vulnerabilities
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution / Fix
OpenSSL Denial of Service Vulnerabilities
Solution:
Please see the referenced advisories for more information.
Fixes are available:
Check Point Software FireWall-1 Next Generation FP1
Check Point Software FireWall-1 Next Generation FP2
Check Point Software VPN-1 VSX NG with Application Intelligence
OpenSSL Project OpenSSL 0.9.6 d
OpenSSL Project OpenSSL 0.9.6 i
OpenSSL Project OpenSSL 0.9.7 beta1
OpenSSL Project OpenSSL 0.9.7 a
Citrix Secure Gateway for Solaris 1.1
Lite Speed Technologies LiteSpeed Web Server 1.1.1
Lite Speed Technologies LiteSpeed Web Server 1.2.1
Lite Speed Technologies LiteSpeed Web Server 1.2.2
Apple Mac OS X Server 10.3.9
Apple Mac OS X 10.3.9
Apple Mac OS X 10.4.2
VMWare GSX Server 2.5.1 build 5336
Check Point Software Providor-1 4.1 SP1
FreeBSD FreeBSD 4.8
Symantec Clientless VPN Gateway 4400 Series 5.0
4D WebSTAR 5.2
Secure Computing Sidewinder 5.2 .1.02
SGI IRIX 6.5.20 f
SGI IRIX 6.5.20 m
SGI IRIX 6.5.21 m
SGI IRIX 6.5.22 m
SGI IRIX 6.5.23 m
SCO Unixware 7.1.1
Solution:
Please see the referenced advisories for more information.
Fixes are available:
Check Point Software FireWall-1 Next Generation FP1
-
Check Point Software R55 HFA-02 for IPSO
R55 Hotfix HFA-02
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp ?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application %20Intelligence&os_selected=IPSO%203.7&patchlevel_selected=R55%20-%20H otfixes -
Check Point Software R55 HFA-02 for Linux
R55 Hotfix HFA-02
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp ?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application %20Intelligence&os_selected=Linux&patchlevel_selected=R55%20-%20Hotfix es -
Check Point Software R55 HFA-02 for SecurePlatform
R55 Hotfix HFA-02
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp ?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application %20Intelligence&os_selected=SecurePlatform&patchlevel_selected=R55%20- %20Hotfixes -
Check Point Software R55 HFA-02 for Solaris
R55 Hotfix HFA-02
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp ?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application %20Intelligence&os_selected=Solaris%202.8&patchlevel_selected=R55%20-% 20Hotfixes -
Check Point Software R55 HFA-02 for Windows
R55 Hotfix HFA-02
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp ?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application %20Intelligence&os_selected=Windows%20NT&patchlevel_selected=R55%20-%2 0Hotfixes
Check Point Software FireWall-1 Next Generation FP2
-
Check Point Software R55 HFA-02 for IPSO
R55 Hotfix HFA-02
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp ?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application %20Intelligence&os_selected=IPSO%203.7&patchlevel_selected=R55%20-%20H otfixes -
Check Point Software R55 HFA-02 for Linux
R55 Hotfix HFA-02
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp ?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application %20Intelligence&os_selected=Linux&patchlevel_selected=R55%20-%20Hotfix es -
Check Point Software R55 HFA-02 for SecurePlatform
R55 Hotfix HFA-02
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp ?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application %20Intelligence&os_selected=SecurePlatform&patchlevel_selected=R55%20- %20Hotfixes -
Check Point Software R55 HFA-02 for Solaris
R55 Hotfix HFA-02
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp ?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application %20Intelligence&os_selected=Solaris%202.8&patchlevel_selected=R55%20-% 20Hotfixes -
Check Point Software R55 HFA-02 for Windows
R55 Hotfix HFA-02
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp ?the_product=VPN-1/FireWall-1&version_selected=NG%20with%20Application %20Intelligence&os_selected=Windows%20NT&patchlevel_selected=R55%20-%2 0Hotfixes
Check Point Software VPN-1 VSX NG with Application Intelligence
-
Check Point Software VPN-1/FireWall-1 VSX
VPN-1/FireWall-1 VSX NG with Application Intelligence
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp ?the_product=VPN-1/FireWall-1%20VSX&version_selected=VSX%20NG%20with%2 0Application%20Intelligence&os_selected=VSX%20NG%20with%20Application% 20Intelligence%20SingleCD&patchlevel_selected
OpenSSL Project OpenSSL 0.9.6 d
-
OpenSSL Project openssl-0.9.6m.tar.gz
http://www.openssl.org/source/openssl-0.9.6m.tar.gz
OpenSSL Project OpenSSL 0.9.6 i
-
Mandrake lib64openssl0.9.7-0.9.7b-4.2.92mdk.amd64.rpm
Mandrakelinux 9.2/AMD64:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake lib64openssl0.9.7-devel-0.9.7b-4.2.92mdk.amd64.rpm
Mandrakelinux 9.2/AMD64:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake lib64openssl0.9.7-static-devel-0.9.7b-4.2.92mdk.amd64.rpm
Mandrakelinux 9.2/AMD64:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0-0.9.6i-1.3.91mdk.i586.rpm
Mandrakelinux 9.1:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0-0.9.6i-1.3.91mdk.ppc.rpm
Mandrakelinux 9.1/PPC:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0-0.9.6i-1.6.M82mdk.i586.rpm
Multi Network Firewall 8.2:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0-0.9.6i-1.7.90mdk.i586.rpm
Mandrakelinux 9.0:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0-0.9.6i-1.7.C21mdk.i586.rpm
Corporate Server 2.1:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0-0.9.6i-1.7.C21mdk.x86_64.rpm
Corporate Server 2.1/x86_64:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0-devel-0.9.6i-1.7.90mdk.i586.rpm
Mandrakelinux 9.0:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0-devel-0.9.6i-1.7.C21mdk.i586.rpm
Corporate Server 2.1:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0-devel-0.9.6i-1.7.C21mdk.x86_64.rpm
Corporate Server 2.1/x86_64:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0-static-devel-0.9.6i-1.7.90mdk.i586.rpm
Mandrakelinux 9.0:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0-static-devel-0.9.6i-1.7.C21mdk.i586.rpm
Corporate Server 2.1:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0-static-devel-0.9.6i-1.7.C21mdk.x86_64.rpm
Corporate Server 2.1/x86_64:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0.9.7-0.9.7a-1.3.91mdk.i586.rpm
Mandrakelinux 9.1:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0.9.7-0.9.7a-1.3.91mdk.ppc.rpm
Mandrakelinux 9.1/PPC:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0.9.7-0.9.7b-4.2.92mdk.i586.rpm
Mandrakelinux 9.2:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0.9.7-devel-0.9.7a-1.3.91mdk.i586.rpm
Mandrakelinux 9.1:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0.9.7-devel-0.9.7a-1.3.91mdk.ppc.rpm
Mandrakelinux 9.1/PPC:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0.9.7-devel-0.9.7b-4.2.92mdk.i586.rpm
Mandrakelinux 9.2:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0.9.7-static-devel-0.9.7a-1.3.91mdk.i586.rpm
Mandrakelinux 9.1:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0.9.7-static-devel-0.9.7a-1.3.91mdk.ppc.rpm
Mandrakelinux 9.1/PPC:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0.9.7-static-devel-0.9.7b-4.2.92mdk.i586.rpm
Mandrakelinux 9.2:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake openssl-0.9.6i-1.6.M82mdk.i586.rpm
Multi Network Firewall 8.2:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake openssl-0.9.6i-1.7.90mdk.i586.rpm
Mandrakelinux 9.0:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake openssl-0.9.6i-1.7.C21mdk.i586.rpm
Corporate Server 2.1:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake openssl-0.9.6i-1.7.C21mdk.x86_64.rpm
Corporate Server 2.1/x86_64:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake openssl-0.9.7a-1.3.91mdk.i586.rpm
Mandrakelinux 9.1:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake openssl-0.9.7a-1.3.91mdk.ppc.rpm
Mandrakelinux 9.1/PPC:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake openssl-0.9.7b-4.2.92mdk.amd64.rpm
Mandrakelinux 9.2/AMD64:
http://www.mandrakesecure.net/en/ftp.php -
Mandrake openssl-0.9.7b-4.2.92mdk.i586.rpm
Mandrakelinux 9.2:
http://www.mandrakesecure.net/en/ftp.php -
OpenSSL Project openssl-0.9.6m.tar.gz
http://www.openssl.org/source/openssl-0.9.6m.tar.gz -
SuSE openssl-0.9.6i-21.i586.patch.rpm
ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/openssl-0.9.6i-21 .i586.patch.rpm -
SuSE openssl-0.9.6i-21.i586.rpm
ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/openssl-0.9.6i-21 .i586.rpm -
SuSE openssl-devel-0.9.6i-21.i586.patch.rpm
ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/openssl-devel-0.9 .6i-21.i586.patch.rpm -
SuSE openssl-devel-0.9.6i-21.i586.rpm
ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/openssl-devel-0.9 .6i-21.i586.rpm
OpenSSL Project OpenSSL 0.9.7 beta1
-
OpenSSL Project openssl-0.9.7d.tar.gz
http://www.openssl.org/source/openssl-0.9.7d.tar.gz
OpenSSL Project OpenSSL 0.9.7 a
-
Conectiva openssl-devel-0.9.7a-28910U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/openssl-devel-0.9.7a-28910U 90_2cl.i386.rpm -
Conectiva openssl-devel-static-0.9.7a-28910U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/openssl-devel-static-0.9.7a -28910U90_2cl.i386.rpm -
Conectiva openssl-doc-0.9.7a-28910U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/openssl-doc-0.9.7a-28910U90 _2cl.i386.rpm -
Conectiva openssl-progs-0.9.7a-28910U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/openssl-progs-0.9.7a-28910U 90_2cl.i386.rpm -
Conectiva openssl0.9.7-0.9.7a-28910U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/openssl0.9.7-0.9.7a-28910U9 0_2cl.i386.rpm -
Fedora openssl-0.9.7a-33.10.i386.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/i386 /openssl-0.9.7a-33.10.i386.rpm -
Fedora openssl-0.9.7a-33.10.i686.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/i386 /openssl-0.9.7a-33.10.i686.rpm -
Fedora openssl-0.9.7a-33.10.x86_64.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/x86_ 64/openssl-0.9.7a-33.10.x86_64.rpm -
Fedora openssl-debuginfo-0.9.7a-33.10.i386.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/i386 /debug/openssl-debuginfo-0.9.7a-33.10.i386.rpm -
Fedora openssl-debuginfo-0.9.7a-33.10.i686.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/i386 /debug/openssl-debuginfo-0.9.7a-33.10.i686.rpm -
Fedora openssl-debuginfo-0.9.7a-33.10.x86_64.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/x86_ 64/debug/openssl-debuginfo-0.9.7a-33.10.x86_64.rpm -
Fedora openssl-devel-0.9.7a-33.10.i386.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/i386 /openssl-devel-0.9.7a-33.10.i386.rpm -
Fedora openssl-devel-0.9.7a-33.10.x86_64.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/x86_ 64/openssl-devel-0.9.7a-33.10.x86_64.rpm -
Fedora openssl-perl-0.9.7a-33.10.i386.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/i386 /openssl-perl-0.9.7a-33.10.i386.rpm -
Fedora openssl-perl-0.9.7a-33.10.x86_64.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/x86_ 64/openssl-perl-0.9.7a-33.10.x86_64.rpm -
Fedora Legacy openssl-0.9.7a-20.6.legacy.i386.rpm
Red Hat Linux 9:
http://download.fedoralegacy.org/redhat/9/updates/i386/openssl-0.9.7a- 20.6.legacy.i386.rpm -
Fedora Legacy openssl-0.9.7a-33.13.legacy.i386.rpm
Fedora Core 1:
http://download.fedoralegacy.org/fedora/1/updates/i386/openssl-0.9.7a- 33.13.legacy.i386.rpm -
Fedora Legacy openssl-0.9.7a-35.2.legacy.i386.rpm
Fedora Core 2:
http://download.fedoralegacy.org/fedora/2/updates/i386/openssl-0.9.7a- 35.2.legacy.i386.rpm -
Fedora Legacy openssl-devel-0.9.7a-33.13.legacy.i386.rpm
Fedora Core 1:
http://download.fedoralegacy.org/fedora/1/updates/i386/openssl-devel-0 .9.7a-33.13.legacy.i386.rpm -
Fedora Legacy openssl-devel-0.9.7a-35.2.legacy.i386.rpm
Fedora Core 2:
http://download.fedoralegacy.org/fedora/2/updates/i386/openssl-devel-0 .9.7a-35.2.legacy.i386.rpm -
Fedora Legacy openssl-perl-0.9.7a-20.6.legacy.i386.rpm
Red Hat Linux 9:
http://download.fedoralegacy.org/redhat/9/updates/i386/openssl-perl-0. 9.7a-20.6.legacy.i386.rpm -
Fedora Legacy openssl-perl-0.9.7a-35.2.legacy.i386.rpm
Fedora Core 2:
http://download.fedoralegacy.org/fedora/2/updates/i386/openssl-perl-0. 9.7a-35.2.legacy.i386.rpm -
Fedora Legacy openssl096-0.9.6-25.12.legacy.i386.rpm
Red Hat Linux 9:
http://download.fedoralegacy.org/redhat/9/updates/i386/openssl096-0.9. 6-25.12.legacy.i386.rpm -
Fedora Legacy openssl096-0.9.6-26.3.legacy.i386.rpm
Fedora Core 1:
http://download.fedoralegacy.org/fedora/1/updates/i386/openssl096-0.9. 6-26.3.legacy.i386.rpm -
Fedora Legacy openssl096b-0.9.6b-15.3.legacy.i386.rpm
Red Hat Linux 9:
http://download.fedoralegacy.org/redhat/9/updates/i386/openssl096b-0.9 .6b-15.3.legacy.i386.rpm -
Fedora Legacy openssl096b-0.9.6b-18.3.legacy.i386.rpm
Fedora Core 1:
http://download.fedoralegacy.org/fedora/1/updates/i386/openssl096b-0.9 .6b-18.3.legacy.i386.rpm -
OpenSSL Project openssl-0.9.7d.tar.gz
http://www.openssl.org/source/openssl-0.9.7d.tar.gz
Citrix Secure Gateway for Solaris 1.1
-
Citrix Secure Gateway for Solaris 1.14
https://secureportal.citrix.com/MyCitrix/Portal/login.aspx
Lite Speed Technologies LiteSpeed Web Server 1.1.1
-
Lite Speed Technologies LiteSpeed Web Server 1.3.2
http://www.litespeedtech.com/download.html
Lite Speed Technologies LiteSpeed Web Server 1.2.1
-
Lite Speed Technologies LiteSpeed Web Server 1.3.2
http://www.litespeedtech.com/download.html
Lite Speed Technologies LiteSpeed Web Server 1.2.2
-
Lite Speed Technologies LiteSpeed Web Server 1.3.2
http://www.litespeedtech.com/download.html
Apple Mac OS X Server 10.3.9
-
Apple SecUpdSrvr2005-007Pan.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=07796&plat form=osx&method=sa/SecUpdSrvr2005-007Pan.dmg
Apple Mac OS X 10.3.9
-
Apple SecUpd2005-007Pan.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=07801&plat form=osx&method=sa/SecUpd2005-007Pan.dmg
Apple Mac OS X 10.4.2
-
Apple SecUpd2005-007Ti.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=07794&plat form=osx&method=sa/SecUpd2005-007Ti.dmg
VMWare GSX Server 2.5.1 build 5336
-
VMWare GSX Server 2.5.2
http://www.vmware.com/support/kb/enduser/std_adp.php?p_faqid=1256
Check Point Software Providor-1 4.1 SP1
-
Check Point Software Provider-1 R55 OpenSSL Hotfix for Linux
Provider-1 NG with Application Intelligence R55 OpenSSL Hotfix
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp ?the_product=Provider-1&version_selected=NG%20with%20Application%20Int elligence&os_selected=Linux&patchlevel_selected=R55%20OpenSSL%20Hotfix -
Check Point Software Provider-1 R55 OpenSSL Hotfix for SecurePlatform
Provider-1 NG with Application Intelligence R55 OpenSSL Hotfix
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp ?the_product=Provider-1&version_selected=NG%20with%20Application%20Int elligence&os_selected=SecurePlatform&patchlevel_selected=R55%20OpenSSL %20Hotfix -
Check Point Software Provider-1 R55 OpenSSL Hotfix for Solaris
Provider-1 NG with Application Intelligence R55 OpenSSL Hotfix
http://www.checkpoint.com/techsupport/downloadApp/displayDownloads.jsp ?the_product=Provider-1&version_selected=NG%20with%20Application%20Int elligence&os_selected=Solaris%202.9&patchlevel_selected=R55%20OpenSSL% 20Hotfix
FreeBSD FreeBSD 4.8
-
FreeBSD openssl.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:05/openssl.patch
Symantec Clientless VPN Gateway 4400 Series 5.0
-
Symantec SCVG5-20040326-00.tgz
ftp://ftp.symantec.com/public/english_us_canada/products/sym_clientles s_vpn/sym_clientless_vpn_5/updates/SCVG5-20040326-00.tgz
4D WebSTAR 5.2
-
4D WebSTAR 5.3.2
Mac OS platform.
ftp://ftp.4d.com/products/webstar/current/4d_webstar_v/4d_webstar_v.si t
Secure Computing Sidewinder 5.2 .1.02
-
Secure Computing Patch 52110
ftp://ftp.activations.securecomputing.com/packages/sidewinder/5.2.1/52 110
SGI IRIX 6.5.20 f
SGI IRIX 6.5.20 m
SGI IRIX 6.5.21 m
-
SGI patch5533.tar
ftp://patches.sgi.com/support/free/security/patches/6.5.22/patch5533.t ar -
SGI patch5536.tar
ftp://patches.sgi.com/support/free/security/patches/6.5.21/patch5536.t ar
SGI IRIX 6.5.22 m
SGI IRIX 6.5.23 m
SCO Unixware 7.1.1
-
SCO SCOSA-2005.7
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.7
References
OpenSSL Denial of Service Vulnerabilities
References:
References:
- 4D WebSTAR Product Page (4D Inc.)
- Avaya Security Advisory Home Page (Avaya)
- Cisco Security Advisory: Cisco OpenSSL Implementation Vulnerability (Cisco)
- CLSA-2004:827 OpenSSL (Conectiva)
- CLSA-2004:834 - openssl (Conectiva)
- Hotfix: SCVG5-20040326-00 (Symantec)
- Installing OpenSSL Patch to Correct CERT Vulnerabilities in VMware GSX Server 2. (VMWare)
- Installing OpenSSL Patch to Correct CERT Vulnerabilities in VMware GSX Server 3. (VMWare)
- NetScreen Advisory 58466 (NetScreen)
- OpenSSL Denial-of-Service Vulnerabilities (Stonesoft)
- openssl security update (RHSA-2005-829) (Avaya)
- OpenSSL Vulnerability (Check Point Software)
- RHSA-2004:119-04 - Updated OpenSSL packages fix vulnerabilities (RedHat)
- RHSA-2004:119-04 Updated OpenSSL packages fix vulnerabilities (Red Hat)
- RHSA-2004:120-12 - Updated OpenSSL packages fix vulnerabilities (RedHat)
- RHSA-2004:139-05 - Stronghold 4: New release fixes OpenSSL and Apache issues (RedHat)
- RHSA-2005:830-4 - openssl096b security update (RedHat)
- Security Advisory: OpenSSL Vulnerability CAN-2004-0079 (Blue Coat Systems)
- Security Update 2004-04-05 (10.3.3) (Apple)
- Security Update 4 - TID2968981 (Novell)
- Side Winder 5.2 Patch 5.2.1.10 Release Notes (Secure Computing)
- Sun Alert ID: 57524 (Sun)
- Sun Alert ID: 57524 - Potential SSL Vulnerabilities in Sun Products (Sun)
- Sun Alert ID: 57571 - Sun Crypto Accelerator 4000 v.1.0 Software DoS (Sun)
- Tarantella Security Bulletin #10 (Tarantella)
- Two OpenSSL vulnerabilities fixed (Adiscon)
- UNIRAS ALERT - 12/04 - Denial of Service Vulnerabilities in OpenSSL (UNIRAS)
- Vendor Homepage (LiteSpeed Technologies)
- New OpenSSL releases fix denial of service attacks [17 March 2004] (Mark J Cox