12 Mar 2012
13 Mar 2012
DoS (Denial of Service)
This includes vulnerabilities ranging from excessive resource consumption (e.g. causing a system to use a lot of memory) to crashing an application or an entire system.
This covers vulnerabilities or security issues where malicious users or people can bypass certain security mechanisms of the application.
The actual impact varies significantly depending on the design and purpose of the affected application.
Two vulnerabilities have been reported in OpenSSL, which can be exploited by malicious people to bypass certain security restrictions and cause a DoS (Denial of Service) in an application using the library.
1) An error in the CMS and PKCS #7 decryption code can be exploited via a so-called "Million Message Attack" against CMS, PKCS #7, or S/MIME decryption operations.
Successful exploitation of this vulnerability requires sending on average 2^20 messages, affecting only automated systems in practise.
2) A NULL-pointer dereference error in the "mime_param_cmp()" function (crypto/asn1/asn_mime.c) when parsing certain MIME headers can be exploited to cause a crash.
Update to version 1.0.0h or 0.9.8u.
1) The vendor credits Ivan Nestlerode.