National Cyber-Alert System

Vulnerability Summary for CVE-2006-3738

Overview

Buffer overflow in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions has unspecified impact and remote attack vectors involving a long list of ciphers.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Solution

Failed exploit attempts may crash applications, denying service to legitimate users.}

Vendor Statments (disclaimer)

Official Statement from Red Hat (03/14/2007)

Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#547300

Name: VU#547300

Hyperlink:http://www.kb.cert.org/vuls/id/547300

US-CERT Technical Alert: TA06-333A

Name: TA06-333A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA06-333A.html

External Source: XF

Name: openssl-sslgetsharedciphers-bo(29237)

Type: Patch Information

Hyperlink:http://xforce.iss.net/xforce/xfdb/29237

External Source: UBUNTU

Name: USN-353-1

Type: Patch Information

Hyperlink:http://www.ubuntu.com/usn/usn-353-1

External Source: TRUSTIX

Name: 2006-0054

Type: Patch Information

Hyperlink:http://www.trustix.org/errata/2006/0054

External Source: CONFIRM

Name: http://www.serv-u.com/releasenotes/

Type: Patch Information

Hyperlink:http://www.serv-u.com/releasenotes/

External Source: BID

Name: 20249

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/20249

External Source: REDHAT

Name: RHSA-2006:0695

Type: Patch Information

Hyperlink:http://www.redhat.com/support/errata/RHSA-2006-0695.html

External Source: OSVDB

Name: 29262

Type: Patch Information

Hyperlink:http://www.osvdb.org/29262

External Source: OPENPKG

Name: OpenPKG-SA-2006.021

Type: Advisory; Patch Information

Hyperlink:http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.021-openssl.html

External Source: SUSE

Name: SUSE-SA:2006:058

Type: Advisory; Patch Information

Hyperlink:http://www.novell.com/linux/security/advisories/2006_58_openssl.html

External Source: SUSE

Name: SUSE-SR:2006:024

Type: Advisory; Patch Information

Hyperlink:http://www.novell.com/linux/security/advisories/2006_24_sr.html

External Source: VUPEN

Name: ADV-2006-4036

Type: Advisory; Patch Information

Hyperlink:http://www.frsirt.com/english/advisories/2006/4036

External Source: VUPEN

Name: ADV-2006-3936

Type: Advisory; Patch Information

Hyperlink:http://www.frsirt.com/english/advisories/2006/3936

External Source: VUPEN

Name: ADV-2006-3902

Type: Advisory; Patch Information

Hyperlink:http://www.frsirt.com/english/advisories/2006/3902

External Source: VUPEN

Name: ADV-2006-3869

Type: Advisory; Patch Information

Hyperlink:http://www.frsirt.com/english/advisories/2006/3869

External Source: VUPEN

Name: ADV-2006-3860

Type: Advisory; Patch Information

Hyperlink:http://www.frsirt.com/english/advisories/2006/3860

External Source: VUPEN

Name: ADV-2006-3820

Type: Advisory; Patch Information

Hyperlink:http://www.frsirt.com/english/advisories/2006/3820

External Source: DEBIAN

Name: DSA-1195

Type: Advisory; Patch Information

Hyperlink:http://www.debian.org/security/2006/dsa-1195

External Source: DEBIAN

Name: DSA-1185

Type: Patch Information

Hyperlink:http://www.debian.org/security/2006/dsa-1185

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2006-220.htm

Type: Patch Information

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2006-220.htm

External Source: SUNALERT

Name: 102668

Type: Patch Information

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102668-1

External Source: SLACKWARE

Name: SSA:2006-272-01

Type: Patch Information

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.676946

External Source: SECTRACK

Name: 1016943

Type: Patch Information

Hyperlink:http://securitytracker.com/id?1016943

External Source: FREEBSD

Name: FreeBSD-SA-06:23

Type: Advisory; Patch Information

Hyperlink:http://security.freebsd.org/advisories/FreeBSD-SA-06:23.openssl.asc

External Source: SECUNIA

Name: 22330

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/22330

External Source: SECUNIA

Name: 22284

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/22284

External Source: SECUNIA

Name: 22260

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/22260

External Source: SECUNIA

Name: 22259

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/22259

External Source: SECUNIA

Name: 22240

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/22240

External Source: SECUNIA

Name: 22220

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/22220

External Source: SECUNIA

Name: 22216

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/22216

External Source: SECUNIA

Name: 22212

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/22212

External Source: SECUNIA

Name: 22207

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/22207

External Source: SECUNIA

Name: 22193

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/22193

External Source: SECUNIA

Name: 22186

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/22186

External Source: SECUNIA

Name: 22172

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/22172

External Source: SECUNIA

Name: 22166

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/22166

External Source: SECUNIA

Name: 22165

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/22165

External Source: SECUNIA

Name: 22130

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/22130

External Source: SECUNIA

Name: 22116

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/22116

External Source: SECUNIA

Name: 22094

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/22094

External Source: CONFIRM

Name: http://openvpn.net/changelog.html

Type: Patch Information

Hyperlink:http://openvpn.net/changelog.html

External Source: OPENBSD

Name: [3.9] 20061007 013: SECURITY FIX: October 7, 2006

Type: Patch Information

Hyperlink:http://openbsd.org/errata.html#openssl2

External Source: FULLDISC

Name: 20060928 [SECURITY] OpenSSL 0.9.8d and 0.9.7l released

Type: Patch Information

Hyperlink:http://lists.grok.org.uk/pipermail/full-disclosure/2006-September/049715.html

External Source: CONFIRM

Name: http://kolab.org/security/kolab-vendor-notice-11.txt

Type: Patch Information

Hyperlink:http://kolab.org/security/kolab-vendor-notice-11.txt

External Source: MANDRIVA

Name: MDKSA-2006:178

Type: Advisory; Patch Information

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:178

External Source: MANDRIVA

Name: MDKSA-2006:177

Type: Advisory; Patch Information

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:177

External Source: MANDRIVA

Name: MDKSA-2006:172

Type: Advisory; Patch Information

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:172

External Source: REDHAT

Name: RHSA-2008:0629

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0629.html

External Source: CONFIRM

Name: http://www.openssl.org/news/secadv_20060928.txt

Hyperlink:http://www.openssl.org/news/secadv_20060928.txt

External Source: SECUNIA

Name: 31492

Hyperlink:http://secunia.com/advisories/31492

External Source: HP

Name: SSRT071304

Hyperlink:https://www2.itrc.hp.com/service/cki/docDisplay.do?docId=c00967144

External Source: CONFIRM

Name: http://www130.nortelnetworks.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=498093&RenditionID=&poid=8881

Hyperlink:http://www130.nortelnetworks.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=498093&RenditionID=&poid=8881

External Source: CONFIRM

Name: http://www.xerox.com/downloads/usa/en/c/cert_ESSNetwork_XRX07001_v1.pdf

Hyperlink:http://www.xerox.com/downloads/usa/en/c/cert_ESSNetwork_XRX07001_v1.pdf

External Source: CONFIRM

Name: http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html

Hyperlink:http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html

External Source: CONFIRM

Name: http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html

Hyperlink:http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html

External Source: CONFIRM

Name: http://www.vmware.com/support/esx25/doc/esx-254-200612-patch.html

Hyperlink:http://www.vmware.com/support/esx25/doc/esx-254-200612-patch.html

External Source: CONFIRM

Name: http://www.vmware.com/support/esx25/doc/esx-253-200612-patch.html

Hyperlink:http://www.vmware.com/support/esx25/doc/esx-253-200612-patch.html

External Source: CONFIRM

Name: http://www.vmware.com/support/esx21/doc/esx-213-200612-patch.html

Hyperlink:http://www.vmware.com/support/esx21/doc/esx-213-200612-patch.html

External Source: CONFIRM

Name: http://www.vmware.com/support/esx2/doc/esx-202-200612-patch.html

Hyperlink:http://www.vmware.com/support/esx2/doc/esx-202-200612-patch.html

External Source: BID

Name: 22083

Hyperlink:http://www.securityfocus.com/bid/22083

External Source: BUGTRAQ

Name: 20070602 Recent OpenSSL exploits

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/470460/100/0/threaded

External Source: BUGTRAQ

Name: 20070110 VMware ESX server security updates

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/456546/100/200/threaded

External Source: BUGTRAQ

Name: 20060929 rPSA-2006-0175-2 openssl openssl-scripts

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/447393/100/0/threaded

External Source: BUGTRAQ

Name: 20060928 rPSA-2006-0175-1 openssl openssl-scripts

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/447318/100/0/threaded

External Source: CONFIRM

Name: http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html

Hyperlink:http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html

External Source: MANDRIVA

Name: MDKSA-2006:178

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:178

External Source: MANDRIVA

Name: MDKSA-2006:177

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:177

External Source: MANDRIVA

Name: MDKSA-2006:172

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:172

External Source: GENTOO

Name: GLSA-200805-07

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200805-07.xml

External Source: GENTOO

Name: GLSA-200612-11

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200612-11.xml

External Source: VUPEN

Name: ADV-2007-2783

Hyperlink:http://www.frsirt.com/english/advisories/2007/2783

External Source: VUPEN

Name: ADV-2007-2315

Hyperlink:http://www.frsirt.com/english/advisories/2007/2315

External Source: VUPEN

Name: ADV-2007-1401

Hyperlink:http://www.frsirt.com/english/advisories/2007/1401

External Source: VUPEN

Name: ADV-2007-0343

Hyperlink:http://www.frsirt.com/english/advisories/2007/0343

External Source: VUPEN

Name: ADV-2006-4750

Hyperlink:http://www.frsirt.com/english/advisories/2006/4750

External Source: VUPEN

Name: ADV-2006-4443

Hyperlink:http://www.frsirt.com/english/advisories/2006/4443

External Source: VUPEN

Name: ADV-2006-4417

Hyperlink:http://www.frsirt.com/english/advisories/2006/4417

External Source: VUPEN

Name: ADV-2006-4401

Hyperlink:http://www.frsirt.com/english/advisories/2006/4401

External Source: VUPEN

Name: ADV-2006-4314

Hyperlink:http://www.frsirt.com/english/advisories/2006/4314

External Source: VUPEN

Name: ADV-2006-4264

Hyperlink:http://www.frsirt.com/english/advisories/2006/4264

External Source: CISCO

Name: 20061108 Multiple Vulnerabilities in OpenSSL library

Hyperlink:http://www.cisco.com/warp/public/707/cisco-sr-20061108-openssl.shtml

External Source: CISCO

Name: 20061108 Multiple Vulnerabilities in OpenSSL Library

Hyperlink:http://www.cisco.com/en/US/products/hw/contnetw/ps4162/tsd_products_security_response09186a008077af1b.html

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2006-260.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2006-260.htm

External Source: SUNALERT

Name: 201531

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-66-201531-1

External Source: SUNALERT

Name: 102711

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102711-1

External Source: CONFIRM

Name: http://sourceforge.net/project/shownotes.php?release_id=461863&group_id=69227

Hyperlink:http://sourceforge.net/project/shownotes.php?release_id=461863&group_id=69227

External Source: SECTRACK

Name: 1017522

Hyperlink:http://securitytracker.com/id?1017522

External Source: GENTOO

Name: GLSA-200610-11

Hyperlink:http://security.gentoo.org/glsa/glsa-200610-11.xml

External Source: SECUNIA

Name: 30161

Hyperlink:http://secunia.com/advisories/30161

External Source: SECUNIA

Name: 30124

Hyperlink:http://secunia.com/advisories/30124

External Source: SECUNIA

Name: 26329

Hyperlink:http://secunia.com/advisories/26329

External Source: SECUNIA

Name: 25889

Hyperlink:http://secunia.com/advisories/25889

External Source: SECUNIA

Name: 24950

Hyperlink:http://secunia.com/advisories/24950

External Source: SECUNIA

Name: 24930

Hyperlink:http://secunia.com/advisories/24930

External Source: SECUNIA

Name: 23915

Hyperlink:http://secunia.com/advisories/23915

External Source: SECUNIA

Name: 23794

Hyperlink:http://secunia.com/advisories/23794

External Source: SECUNIA

Name: 23680

Hyperlink:http://secunia.com/advisories/23680

External Source: SECUNIA

Name: 23340

Hyperlink:http://secunia.com/advisories/23340

External Source: SECUNIA

Name: 23309

Hyperlink:http://secunia.com/advisories/23309

External Source: SECUNIA

Name: 23280

Hyperlink:http://secunia.com/advisories/23280

External Source: SECUNIA

Name: 23155

Hyperlink:http://secunia.com/advisories/23155

External Source: SECUNIA

Name: 23038

Hyperlink:http://secunia.com/advisories/23038

External Source: SECUNIA

Name: 22799

Hyperlink:http://secunia.com/advisories/22799

External Source: SECUNIA

Name: 22791

Hyperlink:http://secunia.com/advisories/22791

External Source: SECUNIA

Name: 22772

Hyperlink:http://secunia.com/advisories/22772

External Source: SECUNIA

Name: 22758

Hyperlink:http://secunia.com/advisories/22758

External Source: SECUNIA

Name: 22654

Hyperlink:http://secunia.com/advisories/22654

External Source: SECUNIA

Name: 22633

Hyperlink:http://secunia.com/advisories/22633

External Source: SECUNIA

Name: 22626

Hyperlink:http://secunia.com/advisories/22626

External Source: SECUNIA

Name: 22544

Hyperlink:http://secunia.com/advisories/22544

External Source: SECUNIA

Name: 22500

Hyperlink:http://secunia.com/advisories/22500

External Source: SECUNIA

Name: 22487

Hyperlink:http://secunia.com/advisories/22487

External Source: SECUNIA

Name: 22460

Hyperlink:http://secunia.com/advisories/22460

External Source: SECUNIA

Name: 22385

Hyperlink:http://secunia.com/advisories/22385

External Source: SECUNIA

Name: 22298

Hyperlink:http://secunia.com/advisories/22298

External Source: APPLE

Name: APPLE-SA-2006-11-28

Hyperlink:http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html

External Source: HP

Name: SSRT071299

Hyperlink:http://itrc.hp.com/service/cki/docDisplay.do?docId=c00849540

External Source: HP

Name: HPSBUX02174

Hyperlink:http://itrc.hp.com/service/cki/docDisplay.do?docId=c00805100

External Source: CONFIRM

Name: http://issues.rpath.com/browse/RPL-613

Hyperlink:http://issues.rpath.com/browse/RPL-613

External Source: HP

Name: SSRT061275

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01118771

External Source: CONFIRM

Name: http://docs.info.apple.com/article.html?artnum=304829

Hyperlink:http://docs.info.apple.com/article.html?artnum=304829

External Source: SGI

Name: 20061001-01-P

Hyperlink:ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc

External Source: NETBSD

Name: NetBSD-SA2008-007

Hyperlink:ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-007.txt.asc

US Government Resource: oval:org.mitre.oval:def:4256

Name: oval:org.mitre.oval:def:4256

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:4256