CVE-2010-3864: Race Condition
A race condition flaw has been found in the OpenSSL TLS server extension code parsing, which on affected servers, could lead to arbitrary code execution.
All versions of OpenSSL supporting TLS extensions contain this vulnerability including OpenSSL 0.9.8j and later and 1.0.0, 1.0.0a releases.
Any OpenSSL based TLS server is vulnerable if it is multi-threaded and uses OpenSSL's internal caching mechanism. Servers that are multi-process and/or disable internal session caching are NOT affected.
Other sources
Multiple race conditions in ssl/t1lib.c in OpenSSL 0.9.8f through 0.9.8o, 1.0.0, and 1.0.0a, when multi-threading and internal caching are enabled on a TLS server, might allow remote attackers to execute arbitrary code via client data that triggers a heap-based buffer overflow, related to (1) the TLS server name extension and (2) elliptic curve cryptography.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3864?
CVE-2010-3864 is classified as a critical severity vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2010-3864?
To fix CVE-2010-3864, upgrade to a version of OpenSSL that is not affected, such as versions released after the security fix was applied.
Which versions of OpenSSL are affected by CVE-2010-3864?
All versions of OpenSSL that support TLS extensions prior to the security patch are affected, including 0.9.8j and later and 1.0.0 and 1.0.0a releases.
What kind of vulnerability is CVE-2010-3864?
CVE-2010-3864 is a race condition vulnerability found in the OpenSSL TLS server extension code parsing.
Can I exploit CVE-2010-3864 remotely?
Yes, CVE-2010-3864 can potentially be exploited remotely, allowing attackers to execute arbitrary code on affected servers.