Vulnerability Details : CVE-2008-1672
OpenSSL 0.9.8f and 0.9.8g allows remote attackers to cause a denial of service (crash) via a TLS handshake that omits the Server Key Exchange message and uses "particular cipher suites," which triggers a NULL pointer dereference.
Vulnerability category: Memory CorruptionDenial of service
Products affected by CVE-2008-1672
- cpe:2.3:a:openssl:openssl:0.9.8f:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:0.9.8g:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2008-1672
21.26%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 95 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2008-1672
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:N/A:P |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2008-1672
-
The product dereferences a pointer that it expects to be valid but is NULL.Assigned by: nvd@nist.gov (Primary)
Vendor statements for CVE-2008-1672
-
Red Hat 2008-05-30Not vulnerable. This issue did not affect the versions of OpenSSL as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.
References for CVE-2008-1672
-
http://cert.fi/haavoittuvuudet/2008/advisory-openssl.html
Traficomin Kyberturvallisuuskeskus | KyberturvallisuuskeskusThird Party Advisory
-
https://www.redhat.com/archives/fedora-package-announce/2008-May/msg01029.html
[SECURITY] Fedora 9 Update: openssl-0.9.8g-9.fc9Third Party Advisory
-
http://www.securityfocus.com/archive/1/492932/100/0/threaded
Third Party Advisory;VDB Entry
-
http://www.vupen.com/english/advisories/2008/1680
Site en constructionPermissions Required;Third Party Advisory
-
http://www.ubuntu.com/usn/usn-620-1
USN-620-1: OpenSSL vulnerabilities | Ubuntu security notices | UbuntuThird Party Advisory
-
http://secunia.com/advisories/30868
About Secunia Research | FlexeraThird Party Advisory
-
http://www.kb.cert.org/vuls/id/520586
VU#520586 - OpenSSL TLS handshake Denial of ServiceThird Party Advisory;US Government Resource
-
http://www.securitytracker.com/id?1020122
GoDaddy Domain Name SearchThird Party Advisory;VDB Entry
-
http://sourceforge.net/project/shownotes.php?release_id=615606
Page not found - SourceForge.netThird Party Advisory
-
http://secunia.com/advisories/30852
About Secunia Research | FlexeraThird Party Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/42667
OpenSSL Server Key exchange message denial of service CVE-2008-1672 Vulnerability ReportThird Party Advisory;VDB Entry
-
http://secunia.com/advisories/30825
About Secunia Research | FlexeraThird Party Advisory
-
http://secunia.com/advisories/31228
About Secunia Research | FlexeraThird Party Advisory
-
http://secunia.com/advisories/31288
About Secunia Research | FlexeraThird Party Advisory
-
http://secunia.com/advisories/30460
About Secunia Research | FlexeraThird Party Advisory
-
http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=738400
Third Party Advisory
-
http://security.gentoo.org/glsa/glsa-200806-08.xml
OpenSSL: Denial of service (GLSA 200806-08) — Gentoo securityThird Party Advisory
-
http://www.mandriva.com/security/advisories?name=MDVSA-2008:107
MandrivaThird Party Advisory
-
http://www.securityfocus.com/bid/29405
Patch;Third Party Advisory;VDB Entry
-
http://secunia.com/advisories/30405
About Secunia Research | FlexeraThird Party Advisory
-
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.562004
The Slackware Linux Project: Slackware Security AdvisoriesThird Party Advisory
-
http://www.openssl.org/news/secadv_20080528.txt
404 Page not found | LibraryVendor Advisory
-
http://www.vupen.com/english/advisories/2008/1937/references
Site en constructionPermissions Required;Third Party Advisory
Jump to