CVE-2002-1568
OpenSSL 0.9.6e uses assertions when detecting buffer overflow attacks instead of less severe mechanisms, which allows remote attackers to cause a denial of service (crash) via certain messages that cause OpenSSL to abort from a failed assertion, as demonstrated using SSLv2 CLIENT_MASTER_KEY messages, which are not properly handled in s2_srvr.c.
- Score
- CVSS 2.0 5.0 Medium
- Status
- Modified - cve@mitre.org
- Published
- 2003-11-17
- Last modified
- 2024-08-08
Affected products
References
- http://cvs.openssl.org/chngview?cn=7659
- http://marc.info/?l=bugtraq&m=106511018214983
- http://www.ebitech.sk/patrik/SA/SA-20031002.txt
