CVE-2008-1672: Null Pointer Dereference
Published May 29, 2008
·Updated
OpenSSL 0.9.8f and 0.9.8g allows remote attackers to cause a denial of service (crash) via a TLS handshake that omits the Server Key Exchange message and uses "particular cipher suites," which triggers a NULL pointer dereference.
Affected Software
3 affected components
OpenSSL OpenSSL=0.9.8g
OpenSSL OpenSSL=0.9.8f
Ubuntu=8.04
Remediation
Patch Available
Event History
May 29, 2008
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-1672?
CVE-2008-1672 is classified as a critical vulnerability due to its potential to cause a remote denial of service.
2
How do I fix CVE-2008-1672?
To fix CVE-2008-1672, you should upgrade OpenSSL to a version later than 0.9.8g.
3
Which systems are affected by CVE-2008-1672?
CVE-2008-1672 affects OpenSSL versions 0.9.8f and 0.9.8g, as well as systems using these versions.
4
What type of attack can exploit CVE-2008-1672?
CVE-2008-1672 can be exploited by attackers through a crafted TLS handshake that omits the Server Key Exchange message.
5
What is the impact of CVE-2008-1672?
The impact of CVE-2008-1672 is the potential crash of the OpenSSL service, leading to a denial of service.