Multiple vulnerabilities in OpenSSL

Описание

Multiple serious vulnerabilities have been found in OpenSSL. Malicious users can exploit these vulnerabilities to caused denial of service or bypass security restrictions.

Below is a complete list of vulnerabilities

1. An unknown vulnerability can be exploited remotely via a specially designed message, certificate key or RSA PSS parameters;
2. Integer underflow can be exploited remotely via a specially designed base64 data;
3. Improper handling IO cases can be exploited remotely via an unknown vectors;
4. Improper handling of ContentInfo can be exploited remotely via a specailly designed data;
5. Improper handling of data structures and boolean-type comparisons can be exploited via an unknown vectors related to ASN.1 structure;
6. Lack of PRNG restrictions can be exploited remotely via a specially designed private-key;
7. Improper isolation of state information can be exploited remotely via a specially designed DTLS traffic.

Первичный источник обнаружения

• OpenSSL bulletin
  

Связанные продукты

• OpenSSl

Список CVE

• CVE-2015-0207
  critical
• CVE-2015-0208
  warning
• CVE-2015-0209
  high
• CVE-2015-0288
  critical
• CVE-2015-0287
  critical
• CVE-2015-0290
  critical
• CVE-2015-0289
  critical
• CVE-2015-0292
  critical
• CVE-2015-0291
  critical
• CVE-2015-0293
  critical
• CVE-2015-1787
  warning
• CVE-2015-0286
  critical
• CVE-2015-0285
  warning

Смотрите также

Узнай статистику распространения уязвимостей в своем регионе statistics.securelist.com