CVE-2013-4353: Input Validation
A flaw was found in the way OpenSSL handled TLS handshakes. A carefully crafted invalid TLS handshake could crash OpenSSL with a NULL pointer exception.
This flaw only affects OpenSSL versions 1.0.1 through 1.0.1e; earlier versions are not affected and this is corrected in upstream version 1.0.1f [1],[2].
[1] http://www.openssl.org/news/vulnerabilities.html#2013-4353 [2] http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=197e0ea817ad64820789d86711d55ff50d71f631
Other sources
The ssl3takemac function in ssl/s3both.c in OpenSSL 1.0.1 before 1.0.1f allows remote TLS servers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Next Protocol Negotiation record in a TLS handshake.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4353?
CVE-2013-4353 is categorized as a medium severity vulnerability due to the potential for denial of service caused by a NULL pointer exception during TLS handshakes.
How do I fix CVE-2013-4353?
To fix CVE-2013-4353, upgrade OpenSSL to version 1.0.1f or later.
Which versions of OpenSSL are affected by CVE-2013-4353?
CVE-2013-4353 affects OpenSSL versions 1.0.1 through 1.0.1e.
What type of vulnerability is CVE-2013-4353?
CVE-2013-4353 is a denial of service vulnerability associated with improper handling during TLS handshakes.
Is there a workaround for CVE-2013-4353?
There are no effective workarounds for CVE-2013-4353; upgrading to the fixed version is recommended.