SB2014010102 - Cryptographic issues in OpenSSL

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2014010102

SB2014010102 - Cryptographic issues in OpenSSL

Published: January 1, 2014 Updated: July 28, 2020

Security Bulletin ID SB2014010102
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Cryptographic issues (CVE-ID: CVE-2013-6450)

The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.

The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service (application crash) by interfering with packet delivery, related to ssl/d1_both.c and ssl/t1_enc.c.


Remediation

Install update from vendor's website.

References