CVE-2013-0166: Null Pointer Dereference

Q: What is the severity of CVE-2013-0166?

CVE-2013-0166 is considered a denial of service vulnerability that can impact the availability of affected systems.

Q: How do I fix CVE-2013-0166?

To fix CVE-2013-0166, update OpenSSL to version 1.0.1d, 1.0.0k, or 0.9.8y or later.

Q: Which versions of OpenSSL are affected by CVE-2013-0166?

All versions of OpenSSL prior to 1.0.1d, 1.0.0k, and 0.9.8y are affected by CVE-2013-0166.

Q: What kind of attack can exploit CVE-2013-0166?

CVE-2013-0166 can be exploited to conduct denial of service attacks against systems using vulnerable versions of OpenSSL.

Q: Are there any external references for CVE-2013-0166?

Yes, external references for CVE-2013-0166 can include official OpenSSL advisories and bug reports related to the issue.

Published Feb 5, 2013

Updated

A flaw was found in the way that OpenSSL handled OCSP response verification, which could be exploited to conduct a denial of service attack. This flaw affects all versions of OpenSSL and is fixed in versions 1.0.1d, 1.0.0k, and 0.9.8y.

External References:

http://www.openssl.org/news/secadv20130205.txt

Other sources

OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause a denial of service (NULL pointer dereference and application crash) via an invalid key.

— MITRE

Affected Software

97 affected componentsFixes available

redhat/openssl<1.0.1

1.0.1

redhat/openssl<0.9.8

0.9.8

OpenSSL OpenSSL=0.9.1c

OpenSSL OpenSSL=0.9.2b

OpenSSL OpenSSL=0.9.3

OpenSSL OpenSSL=0.9.3a

OpenSSL OpenSSL=0.9.4

OpenSSL OpenSSL=0.9.5

OpenSSL OpenSSL=0.9.5-beta1

OpenSSL OpenSSL=0.9.5-beta2

OpenSSL OpenSSL=0.9.5a

OpenSSL OpenSSL=0.9.5a-beta1

OpenSSL OpenSSL=0.9.5a-beta2

OpenSSL OpenSSL=0.9.6

OpenSSL OpenSSL=0.9.6-beta1

OpenSSL OpenSSL=0.9.6-beta2

OpenSSL OpenSSL=0.9.6-beta3

OpenSSL OpenSSL=0.9.6a

OpenSSL OpenSSL=0.9.6a-beta1

OpenSSL OpenSSL=0.9.6a-beta2

OpenSSL OpenSSL=0.9.6a-beta3

OpenSSL OpenSSL=0.9.6b

OpenSSL OpenSSL=0.9.6c

OpenSSL OpenSSL=0.9.6d

OpenSSL OpenSSL=0.9.6e

OpenSSL OpenSSL=0.9.6f

OpenSSL OpenSSL=0.9.6g

OpenSSL OpenSSL=0.9.6h

OpenSSL OpenSSL=0.9.6i

OpenSSL OpenSSL=0.9.6j

OpenSSL OpenSSL=0.9.6k

OpenSSL OpenSSL=0.9.6l

OpenSSL OpenSSL=0.9.6m

OpenSSL OpenSSL=0.9.7

OpenSSL OpenSSL=0.9.7-beta1

OpenSSL OpenSSL=0.9.7-beta2

OpenSSL OpenSSL=0.9.7-beta3

OpenSSL OpenSSL=0.9.7-beta4

OpenSSL OpenSSL=0.9.7-beta5

OpenSSL OpenSSL=0.9.7-beta6

OpenSSL OpenSSL=0.9.7a

OpenSSL OpenSSL=0.9.7b

OpenSSL OpenSSL=0.9.7c

OpenSSL OpenSSL=0.9.7d

OpenSSL OpenSSL=0.9.7e

OpenSSL OpenSSL=0.9.7f

OpenSSL OpenSSL=0.9.7g

OpenSSL OpenSSL=0.9.7h

OpenSSL OpenSSL=0.9.7i

OpenSSL OpenSSL=0.9.7j

OpenSSL OpenSSL=0.9.7k

OpenSSL OpenSSL=0.9.7l

OpenSSL OpenSSL=0.9.7m

OpenSSL OpenSSL=0.9.8

OpenSSL OpenSSL=0.9.8a

OpenSSL OpenSSL=0.9.8b

OpenSSL OpenSSL=0.9.8c

OpenSSL OpenSSL=0.9.8d

OpenSSL OpenSSL=0.9.8e

OpenSSL OpenSSL=0.9.8f

OpenSSL OpenSSL=0.9.8g

OpenSSL OpenSSL=0.9.8h

OpenSSL OpenSSL=0.9.8i

OpenSSL OpenSSL=0.9.8j

OpenSSL OpenSSL=0.9.8k

OpenSSL OpenSSL=0.9.8l

OpenSSL OpenSSL=0.9.8m

OpenSSL OpenSSL=0.9.8m-beta1

OpenSSL OpenSSL=0.9.8n

OpenSSL OpenSSL=0.9.8o

OpenSSL OpenSSL=0.9.8p

OpenSSL OpenSSL=0.9.8q

OpenSSL OpenSSL=0.9.8r

OpenSSL OpenSSL=0.9.8s

OpenSSL OpenSSL=0.9.8t

OpenSSL OpenSSL=0.9.8u

OpenSSL OpenSSL=0.9.8v

OpenSSL OpenSSL=0.9.8w

OpenSSL OpenSSL=0.9.8x

OpenSSL OpenSSL=1.0.0

OpenSSL OpenSSL=1.0.0a

OpenSSL OpenSSL=1.0.0b

OpenSSL OpenSSL=1.0.0c

OpenSSL OpenSSL=1.0.0d

OpenSSL OpenSSL=1.0.0e

OpenSSL OpenSSL=1.0.0f

OpenSSL OpenSSL=1.0.0g

OpenSSL OpenSSL=1.0.0h

OpenSSL OpenSSL=1.0.0i

OpenSSL OpenSSL=1.0.0j

OpenSSL OpenSSL=1.0.1

OpenSSL OpenSSL=1.0.1a

OpenSSL OpenSSL=1.0.1b

OpenSSL OpenSSL=1.0.1c

redhat Openssl=0.9.6-15

redhat Openssl=0.9.6b-3

redhat Openssl=0.9.7a-2

Event History

Feb 8, 2013

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2013-0166?

CVE-2013-0166 is considered a denial of service vulnerability that can impact the availability of affected systems.

How do I fix CVE-2013-0166?