5
CVSSv2

CVE-2003-0543

Published: 17/11/2003 Updated: 03/05/2018
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 505
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Summary

Integer overflow in OpenSSL 0.9.6 and 0.9.7 allows remote malicious users to cause a denial of service (crash) via an SSL client certificate with certain ASN.1 tag values.

Affected Products

Vendor Product Versions
OpensslOpenssl0.9.6, 0.9.7

Vendor Advisories

Dr Stephen Henson (steve@opensslorg), using a test suite provided by NISCC (wwwnisccgovuk/), discovered a number of errors in the OpenSSL ASN1 code Combined with an error that causes the OpenSSL code to parse client certificates even when it should not, these errors can cause a denial of service (DoS) condition on a system using the Op ...
Steve Henson of the OpenSSL core team identified and prepared fixes for a number of vulnerabilities in the OpenSSL ASN1 code that were discovered after running a test suite by British National Infrastructure Security Coordination Centre (NISCC) A bug in OpenSSLs SSL/TLS protocol was also identified which causes OpenSSL to parse a client certificat ...
On September 30, 2003, new vulnerabilities in the OpenSSL implementation for SSL were announced This is referred to as the "first" vulnerability in this document On November 4, 2003, another vulnerability in the OpenSSL implementation for SSL, version 096, was announced This is referred to as the "second" vulnerability in this ...

Exploits

/* Brute forcer for OpenSSL ASN1 parsing bugs (<=096j <=097b) * written by Bram Matthys (Syzop) on Oct 9 2003 * * This program sends corrupt client certificates to the SSL * server which will 1) crash it 2) create lots of error messages, * and/or 3) result in other "interresting" behavior * * I was able to crash my own ssl app i ...