CVE-2013-6449: Medium severity OpenSSL OpenSSL vulnerability
A flaw was reported for OpenSSL 1.0.1e, that can cause application using OpenSSL to crash when using TLS version 1.2. Issue was reported via the following OpenSSL upstream ticket:
http://rt.openssl.org/Ticket/Display.html?id=3200&user=guest&pass=guest
and also as bug for Apache Traffic Server:
https://issues.apache.org/jira/browse/TS-2355
Fix is now committed in upstream git:
http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ca98926
Related to the above ticket, upstream also added this fix to improve error checks in OpenSSL:
http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0294b2b
Other sources
The sslgetalgorithm2 function in ssl/s3lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorrect data structure, which allows remote attackers to cause a denial of service (daemon crash) via crafted traffic from a TLS 1.2 client.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/opensslto a version that resolves this vulnerability.Fixed in 1.0.1
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6449?
CVE-2013-6449 has a moderate severity level as it can cause application crashes when using affected OpenSSL versions.
How do I fix CVE-2013-6449?
To fix CVE-2013-6449, upgrade OpenSSL to version 1.0.1g or higher.
Which versions of OpenSSL are affected by CVE-2013-6449?
CVE-2013-6449 affects OpenSSL versions up to and including 1.0.1e.
What are the symptoms of CVE-2013-6449?
The main symptom of CVE-2013-6449 is that applications using OpenSSL may crash when utilizing TLS version 1.2.
Is CVE-2013-6449 exploitable remotely?
CVE-2013-6449 is not directly exploitable for remote attacks, but it can lead to denial of service through application crashes.