National Vulnerability Database (CVE-2003-0545)

National Cyber-Alert System Vulnerability Summary: CVE-2003-0545
Orirignal release date: 2003-11-17 Source: US-CERT/NIST ### Overview Double-free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an SSL client certificate with a certain invalid ASN.1 encoding. ### Impact CVSS Severity: 8 (High) Range: remote Authentication: input Impact Type: avail,sec_prot other="1" ### Reference to Advisories, Solutions, and Tools External Source: Red Hat Name: RHSA-2003:292 Hyperlink: http://www.redhat.com/support/errata/RHSA-2003-292.html External Source: Uniras Name: Vulnerability Issues in OpenSSL Hyperlink: http://www.uniras.gov.uk/vuls/2003/006489/openssl.htm External Source: DEBIAN Name: DSA-394 Hyperlink: http://www.debian.org/security/2003/dsa-394 External Source: OVAL Name: OVAL2590 Hyperlink: http://oval.mitre.org/oval/definitions/data/oval2590.html External Source: CERT Name: CA-2003-26 Hyperlink: http://www.cert.org/advisories/CA-2003-26.html External Source: CERT-VN Name: VU#935264 Hyperlink: http://www.kb.cert.org/vuls/id/935264 ### Vulnerable Software and Vendor OpenSSL (OpenSSL Project) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0545