National Vulnerability Database (CVE-2006-3738)

National Cyber-Alert System Vulnerability Summary: CVE-2006-3738
Orirignal release date: 2006-09-28 Source: US-CERT/NIST ### Overview Buffer overflow in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions has unspecified impact and remote attack vectors involving a long list of ciphers. ### Impact CVSS Severity: 7.0 (High) Range: remote Authentication: input buffer="1" Impact Type: avail,conf,int,sec_prot user="1" ### Reference to Advisories, Solutions, and Tools External Source: SECUNIA Name: 22385 Hyperlink: http://secunia.com/advisories/22385 External Source: SECUNIA Name: 22460 Hyperlink: http://secunia.com/advisories/22460 External Source: NSO Name: http://www.openssl.org/news/secadv_20060928.txt Hyperlink: http://www.openssl.org/news/secadv_20060928.txt External Source: CERT-VN Name: VU#547300 Hyperlink: http://www.kb.cert.org/vuls/id/547300 External Source: BID Name: 20249 Hyperlink: http://www.securityfocus.com/bid/20249 External Source: FULLDISC Name: 20060928 [SECURITY] OpenSSL 0.9.8d and 0.9.7l released Hyperlink: http://lists.grok.org.uk/pipermail/full-disclosure/2006-September/049715.html External Source: NSO Name: https://issues.rpath.com/browse/RPL-613 Hyperlink: https://issues.rpath.com/browse/RPL-613 External Source: DEBIAN Name: DSA-1185 Hyperlink: http://www.debian.org/security/2006/dsa-1185 External Source: FREEBSD Name: FreeBSD-SA-06:23.openssl Hyperlink: http://security.freebsd.org/advisories/FreeBSD-SA-06:23.openssl.asc External Source: MANDRIVA Name: MDKSA-2006:172 Hyperlink: http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:172 External Source: MANDRIVA Name: MDKSA-2006:177 Hyperlink: http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:177 External Source: MANDRIVA Name: MDKSA-2006:178 Hyperlink: http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:178 External Source: REDHAT Name: RHSA-2006:0695 Hyperlink: http://www.redhat.com/support/errata/RHSA-2006-0695.html External Source: SLACKWARE Name: y=2006& Hyperlink: http://slackware.com/security/viewer.php?l=slackware-security& External Source: UBUNTU Name: USN-353-1 Hyperlink: http://www.ubuntu.com/usn/usn-353-1 External Source: FRSIRT Name: ADV-2006-3820 Hyperlink: http://www.frsirt.com/english/advisories/2006/3820 External Source: FRSIRT Name: ADV-2006-3860 Hyperlink: http://www.frsirt.com/english/advisories/2006/3860 External Source: SECUNIA Name: 22130 Hyperlink: http://secunia.com/advisories/22130 External Source: SECUNIA Name: 22094 Hyperlink: http://secunia.com/advisories/22094 External Source: SECUNIA Name: 22165 Hyperlink: http://secunia.com/advisories/22165 External Source: SECUNIA Name: 22186 Hyperlink: http://secunia.com/advisories/22186 External Source: SECUNIA Name: 22193 Hyperlink: http://secunia.com/advisories/22193 External Source: SECUNIA Name: 22207 Hyperlink: http://secunia.com/advisories/22207 External Source: SECUNIA Name: 22259 Hyperlink: http://secunia.com/advisories/22259 External Source: SECUNIA Name: 22260 Hyperlink: http://secunia.com/advisories/22260 External Source: XF Name: openssl-sslgetsharedciphers-bo(29237) Hyperlink: http://xforce.iss.net/xforce/xfdb/29237 External Source: NSO Name: http://kolab.org/security/kolab-vendor-notice-11.txt patch=1 Hyperlink: http://kolab.org/security/kolab-vendor-notice-11.txt patch=1 External Source: OPENPKG Name: OpenPKG-SA-2006.021 Hyperlink: http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.021-openssl.html External Source: SUSE Name: SUSE-SA:2006:058 Hyperlink: http://www.novell.com/linux/security/advisories/2006_58_openssl.html External Source: TRUSTIX Name: 2006-0054 Hyperlink: http://www.trustix.org/errata/2006/0054 External Source: FRSIRT Name: ADV-2006-3902 Hyperlink: http://www.frsirt.com/english/advisories/2006/3902 External Source: SECTRACK Name: 1016943 Hyperlink: http://securitytracker.com/id?1016943 External Source: SECUNIA Name: 22166 Hyperlink: http://secunia.com/advisories/22166 External Source: SECUNIA Name: 22172 Hyperlink: http://secunia.com/advisories/22172 External Source: SECUNIA Name: 22212 Hyperlink: http://secunia.com/advisories/22212 External Source: SECUNIA Name: 22240 Hyperlink: http://secunia.com/advisories/22240 External Source: SECUNIA Name: 22216 Hyperlink: http://secunia.com/advisories/22216 External Source: SECUNIA Name: 22116 Hyperlink: http://secunia.com/advisories/22116 External Source: SECUNIA Name: 22220 Hyperlink: http://secunia.com/advisories/22220 External Source: NSO Name: http://openvpn.net/changelog.html patch=1 Hyperlink: http://openvpn.net/changelog.html patch=1 External Source: NSO Name: http://www.serv-u.com/releasenotes/ patch=1 Hyperlink: http://www.serv-u.com/releasenotes/ patch=1 External Source: OPENBSD Name: [3.9] 20061007 013: SECURITY FIX: October 7 Hyperlink: http://openbsd.org/errata.html#openssl2 External Source: 2006 Name: Hyperlink: External Source: FRSIRT Name: ADV-2006-3869 Hyperlink: http://www.frsirt.com/english/advisories/2006/3869 External Source: FRSIRT Name: ADV-2006-3936 Hyperlink: http://www.frsirt.com/english/advisories/2006/3936 External Source: SECUNIA Name: 22284 Hyperlink: http://secunia.com/advisories/22284 External Source: SECUNIA Name: 22330 Hyperlink: http://secunia.com/advisories/22330 External Source: NSO Name: http://support.avaya.com/elmodocs2/security/ASA-2006-220.htm patch=1 Hyperlink: http://support.avaya.com/elmodocs2/security/ASA-2006-220.htm patch=1 External Source: DEBIAN Name: DSA-1195 Hyperlink: http://www.debian.org/security/2006/dsa-1195 External Source: SUNALERT Name: 102668 Hyperlink: http://sunsolve.sun.com/search/document.do?assetkey=1-26-102668-1 External Source: SUSE Name: SUSE-SR:2006:024 Hyperlink: http://www.novell.com/linux/security/advisories/2006_24_sr.html External Source: FRSIRT Name: ADV-2006-4036 Hyperlink: http://www.frsirt.com/english/advisories/2006/4036 External Source: OSVDB Name: 29262 Hyperlink: http://www.osvdb.org/29262 External Source: GENTOO Name: GLSA-200610-11 Hyperlink: http://security.gentoo.org/glsa/glsa-200610-11.xml External Source: SECUNIA Name: 22500 Hyperlink: http://secunia.com/advisories/22500 External Source: SECUNIA Name: 22544 Hyperlink: http://secunia.com/advisories/22544 External Source: NSO Name: DocumentOID=498093& Hyperlink: http://www130.nortelnetworks.com/go/main.jsp?cscat=BLTNDETAIL& External Source: SGI Name: 20061001-01-P Hyperlink: ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc External Source: FRSIRT Name: ADV-2006-4314 Hyperlink: http://www.frsirt.com/english/advisories/2006/4314 External Source: FRSIRT Name: ADV-2006-4264 Hyperlink: http://www.frsirt.com/english/advisories/2006/4264 External Source: SECUNIA Name: 22626 Hyperlink: http://secunia.com/advisories/22626 External Source: SECUNIA Name: 22633 Hyperlink: http://secunia.com/advisories/22633 External Source: SECUNIA Name: 22654 Hyperlink: http://secunia.com/advisories/22654 External Source: SECUNIA Name: 22487 Hyperlink: http://secunia.com/advisories/22487 External Source: NSO Name: group_id=69227 Hyperlink: http://sourceforge.net/project/shownotes.php?release_id=461863& External Source: CISCO Name: 20061108 Multiple Vulnerabilities in OpenSSL library Hyperlink: http://www.cisco.com/warp/public/707/cisco-sr-20061108-openssl.shtml External Source: CISCO Name: 20061108 Multiple Vulnerabilities in OpenSSL Library Hyperlink: http://www.cisco.com/en/US/products/hw/contnetw/ps4162/tsd_products_security_response09186a008077af1b.html External Source: SUNALERT Name: 102711 Hyperlink: http://sunsolve.sun.com/search/document.do?assetkey=1-26-102711-1 External Source: FRSIRT Name: ADV-2006-4417 Hyperlink: http://www.frsirt.com/english/advisories/2006/4417 External Source: FRSIRT Name: ADV-2006-4401 Hyperlink: http://www.frsirt.com/english/advisories/2006/4401 External Source: FRSIRT Name: ADV-2006-4443 Hyperlink: http://www.frsirt.com/english/advisories/2006/4443 External Source: SECUNIA Name: 22758 Hyperlink: http://secunia.com/advisories/22758 External Source: SECUNIA Name: 22799 Hyperlink: http://secunia.com/advisories/22799 External Source: SECUNIA Name: 22791 Hyperlink: http://secunia.com/advisories/22791 External Source: SECUNIA Name: 22772 Hyperlink: http://secunia.com/advisories/22772 External Source: SECUNIA Name: 23038 Hyperlink: http://secunia.com/advisories/23038 External Source: NSO Name: http://docs.info.apple.com/article.html?artnum=304829 Hyperlink: http://docs.info.apple.com/article.html?artnum=304829 External Source: APPLE Name: APPLE-SA-2006-11-28 Hyperlink: http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html External Source: CERT Name: TA06-333A Hyperlink: http://www.us-cert.gov/cas/techalerts/TA06-333A.html External Source: FRSIRT Name: ADV-2006-4750 Hyperlink: http://www.frsirt.com/english/advisories/2006/4750 External Source: SECUNIA Name: 23155 Hyperlink: http://secunia.com/advisories/23155 External Source: SECUNIA Name: 22298 Hyperlink: http://secunia.com/advisories/22298 External Source: NSO Name: http://support.avaya.com/elmodocs2/security/ASA-2006-260.htm Hyperlink: http://support.avaya.com/elmodocs2/security/ASA-2006-260.htm External Source: GENTOO Name: GLSA-200612-11 Hyperlink: http://www.gentoo.org/security/en/glsa/glsa-200612-11.xml External Source: HP Name: HPSBUX02174 Hyperlink: http://itrc.hp.com/service/cki/docDisplay.do?docId=c00805100 External Source: SECUNIA Name: 23309 Hyperlink: http://secunia.com/advisories/23309 External Source: SECUNIA Name: 23280 Hyperlink: http://secunia.com/advisories/23280 External Source: SECUNIA Name: 23340 Hyperlink: http://secunia.com/advisories/23340 External Source: NSO Name: http://www.vmware.com/support/esx2/doc/esx-202-200612-patch.html Hyperlink: http://www.vmware.com/support/esx2/doc/esx-202-200612-patch.html External Source: NSO Name: http://www.vmware.com/support/esx21/doc/esx-213-200612-patch.html Hyperlink: http://www.vmware.com/support/esx21/doc/esx-213-200612-patch.html External Source: NSO Name: http://www.vmware.com/support/esx25/doc/esx-253-200612-patch.html Hyperlink: http://www.vmware.com/support/esx25/doc/esx-253-200612-patch.html External Source: NSO Name: http://www.vmware.com/support/esx25/doc/esx-254-200612-patch.html Hyperlink: http://www.vmware.com/support/esx25/doc/esx-254-200612-patch.html External Source: NSO Name: http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html Hyperlink: http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html External Source: NSO Name: http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html Hyperlink: http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html External Source: SECUNIA Name: 23680 Hyperlink: http://secunia.com/advisories/23680 External Source: NSO Name: http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html Hyperlink: http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html External Source: SECUNIA Name: 23794 Hyperlink: http://secunia.com/advisories/23794 ### Vulnerable Software and Vendor OpenSSL (OpenSSL Project) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3738