CVE-2015-0293: Input Validation
A malicious client can trigger an OPENSSLassert (i.e., an abort) in servers that both support SSLv2 and enable export cipher suites by sending a specially crafted SSLv2 CLIENT-MASTER-KEY message.
This issue affects OpenSSL versions: 1.0.2, 1.0.1, 1.0.0, and 0.9.8. This issue is fixed in versions: 1.0.2a, 1.0.1m, 1.0.0r, and 0.9.8zf.
Acknowledgements:
Name: the OpenSSL project Upstream: Sean Burford (Google), Emilia Käsper (the OpenSSL development team)
Other sources
The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2lib.c assertion failure and daemon exit) via a crafted CLIENT-MASTER-KEY message.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0293?
CVE-2015-0293 is considered a high severity vulnerability due to the potential for denial of service.
How do I fix CVE-2015-0293?
To fix CVE-2015-0293, upgrade your OpenSSL version to 1.0.2 or later.
Which OpenSSL versions are affected by CVE-2015-0293?
CVE-2015-0293 affects OpenSSL versions 1.0.2, 1.0.1, 1.0.0, and 0.9.8.
What type of attack can exploit CVE-2015-0293?
CVE-2015-0293 can be exploited by a malicious client sending a crafted SSLv2 CLIENT-MASTER-KEY message.
Is CVE-2015-0293 present in OpenSSL 1.0.3?
No, CVE-2015-0293 is not present in OpenSSL 1.0.3 and later versions.