Published: 28/09/2006 Updated: 17/10/2018

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 440

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

The get_server_hello function in the SSLv2 client code in OpenSSL 0.9.7 prior to 0.9.7l, 0.9.8 prior to 0.9.8d, and previous versions versions allows remote servers to cause a denial of service (client crash) via unknown vectors that trigger a null pointer dereference.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openssl openssl 0.9.7f
openssl openssl 0.9.7g
openssl openssl 0.9.8b
openssl openssl 0.9.8c
openssl openssl 0.9.7a
openssl openssl 0.9.7b
openssl openssl 0.9.7c
openssl openssl 0.9.7j
openssl openssl 0.9.7k
openssl openssl 0.9.7d
openssl openssl 0.9.7e
openssl openssl 0.9.8
openssl openssl 0.9.8a
openssl openssl 0.9.7
openssl openssl 0.9.7h
openssl openssl 0.9.7i
debian debian linux 3.1
canonical ubuntu linux 5.04
canonical ubuntu linux 5.10
canonical ubuntu linux 6.06

Debian Bug report logs - #389940 Security: OpenSSL Security Advisory [28th September 2006] Package: openssl; Maintainer for openssl is Debian OpenSSL Team <pkg-openssl-devel@listsaliothdebianorg>; Source for openssl is src:openssl (PTS, buildd, popcon) Reported by: "debian-bts@spamblocknetzgehirnde" <debian-bts@spamb ...

Dr Henson of the OpenSSL core team and Open Network Security discovered a mishandled error condition in the ASN1 parser By sending specially crafted packet data, a remote attacker could exploit this to trigger an infinite loop, which would render the service unusable and consume all available system memory (CVE-2006-2937) ...

Multiple vulnerabilities have been discovered in the OpenSSL cryptographic software package that could allow an attacker to launch a denial of service attack by exhausting system resources or crashing processes on a victim's computer CVE-2006-3738 Tavis Ormandy and Will Drewry of the Google Security Team discovered a buffer overfl ...

The fix used to correct CVE-2006-2940 introduced code that could lead to the use of uninitialized memory Such use is likely to cause the application using the openssl library to crash, and has the potential to allow an attacker to cause the execution of arbitrary code For reference please find below the original advisory text: Multiple vulnerabi ...

OpenSSL versions below 097l and 098d SSLv2 client crash exploit ...

source: wwwsecurityfocuscom/bid/20246/info OpenSSL is prone to a denial-of-service vulnerability A malicious server could cause a vulnerable client application to crash, effectively denying service #!/usr/bin/perl # Copyright(c) Beyond Security # Written by Noam Rathaus - based on beSTORM's SSL Server module # Exploits vulnerability C ...

#!/usr/bin/perl # Copyright(c) Beyond Security # Written by Noam Rathaus - based on beSTORM's SSL Server module # Exploits vulnerability CVE-2006-4343 - where the SSL client can be crashed by special SSL serverhello response use strict; use IO::Socket; my $sock = new IO::Socket::INET ( LocalPort => '443', Proto => 'tcp', Listen => 1, Reus ...

Get Started

CVE-2006-4343

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect