CVE-2004-0079

CWE-476 — NULL Pointer DereferenceCWE-39913 documents9 sources
Severity
7.5HIGH
EPSS
2.3%
top 15.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
55
4D WebstarApple MAC OS XApple MAC OS X Server+52 more
Timeline
PublishedNov 23
Latest updateMay 3

Description

The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages54 packages

▶Debianopenssl< 0.9.7d-1+3
▶NVDredhat/openssl0.9.6-15, 0.9.6b-3, 0.9.7a-2+2
▶NVDopenssl/openssl13 versions+12

Also affects: Freebsd 4.8, 4.9, 5.1, 5.2, 5.2.1, Enterprise Linux 3.0

🔴Vulnerability Details

3
GHSA
GHSA-xcj5-xcx2-vvvv: The do_change_cipher_spec function in OpenSSL 0↗2022-05-03
▶
OSV
CVE-2004-0079: The do_change_cipher_spec function in OpenSSL 0↗2004-11-23
▶
CVEList
CVE-2004-0079: The do_change_cipher_spec function in OpenSSL 0↗2004-03-18
▶

📋Vendor Advisories

4
Red Hat
security flaw↗2004-03-17
▶
Cisco
Cisco OpenSSL Implementation Vulnerability↗2004-03-17
▶
Debian
CVE-2004-0079: openssl - The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0....↗2004
▶
Red Hat
CVE-2005-1730: Multiple vulnerabilities in the OpenSSL ASN↗
▶

💬Community

3
Bugzilla
CVE-2004-0079 security flaw↗2018-08-16
▶
Bugzilla
CVE-2004-0079 OpenSSL remote DoS↗2005-10-31
▶
Bugzilla
CVE-2004-0079 OpenSSL remote DoS↗2005-10-31
▶