CVE-2010-0740: Input Validation
The ssl3getrecord function in ssl/s3pkt.c in OpenSSL 0.9.8f through 0.9.8m allows remote attackers to cause a denial of service (crash) via a malformed record in a TLS connection that triggers a NULL pointer dereference, related to the minor version number. NOTE: some of these details are obtained from third party information.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0740?
CVE-2010-0740 is classified as a denial of service vulnerability due to the potential crash caused by a NULL pointer dereference in OpenSSL.
Which versions of OpenSSL are affected by CVE-2010-0740?
CVE-2010-0740 affects OpenSSL versions 0.9.8f through 0.9.8m.
How do I fix CVE-2010-0740?
To fix CVE-2010-0740, you should upgrade to a non-affected version of OpenSSL, ideally to 0.9.8n or later.
What causes CVE-2010-0740?
CVE-2010-0740 is caused by a malformed record in a TLS connection that triggers a NULL pointer dereference in the ssl3_get_record function.
Can CVE-2010-0740 be exploited remotely?
Yes, CVE-2010-0740 can be exploited remotely by an attacker sending a malformed TLS record.