REDHAT-BUG-649304: Race Condition

Published Nov 3, 2010

Updated

A race condition flaw has been found in the OpenSSL TLS server extension code parsing, which on affected servers, could lead to arbitrary code execution.

All versions of OpenSSL supporting TLS extensions contain this vulnerability including OpenSSL 0.9.8j and later and 1.0.0, 1.0.0a releases.

Any OpenSSL based TLS server is vulnerable if it is multi-threaded and uses OpenSSL's internal caching mechanism. Servers that are multi-process and/or disable internal session caching are NOT affected.

Affected Software

1 affected component

OpenSSL OpenSSL>=0.9.8j

Event History

Nov 3, 2010

Data Sourced

via Red Hat·02:00 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are affected?

An OpenSSL-based TLS server is affected if it is multi-threaded and uses OpenSSL's internal session caching mechanism. Multi-process servers and servers with internal session caching disabled are not affected.

What could an attacker achieve?

The race condition in TLS server extension parsing could lead to arbitrary code execution on an affected server.

Are older OpenSSL releases in scope?

All OpenSSL versions supporting TLS extensions are affected, including OpenSSL 0.9.8j and later, plus 1.0.0 and 1.0.0a.

What mitigation is available if a fix cannot be applied immediately?

Use a multi-process server model or disable OpenSSL's internal session caching mechanism, as those configurations are described as not affected.