The ASN1 library in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allows remote attackers to cause a denial of service via invalid encodings.

The remote host is running Oracle Application Server. It was not possible to determine its version, so the version of Oracle Application Server installed on the remote host could potentially be affected by multiple vulnerabilities :

  - CVE-2000-0169: Remote command execution in the web     listener component.

  - CVE-2000-1235: Information disclosure in the port     listener component and modplsql.

  - CVE-2000-1236: SQL injection in mod_sql.

  - CVE-2001-0326: Information disclosure in the Java     Virtual Machine.

  - CVE-2001-0419: Buffer overflow in ndwfn4.so.

  - CVE-2001-0591: Directory traversal.

  - CVE-2001-1216: Buffer overflow in the PL/SQL Apache module.

  - CVE-2001-1217: Directory traversal vulnerability in the     PL/SQL Apache module.

  - CVE-2001-1371: Improper access control in the SOAP     service.

  - CVE-2001-1372: Information disclosure.

  - CVE-2002-0386: Denial of service through the     administration module for Oracle Web Cache.

  - CVE-2002-0559: Buffer overflows in the PL/SQL module.

  - CVE-2002-0560: Information disclosure in the PL/SQL     module.

  - CVE-2002-0561: Authentication bypass in the PL/SQL     Gateway web administration interface.

  - CVE-2002-0562: Information disclosure through     globals.jsa.

  - CVE-2002-0563: Improper access control on several     services.

  - CVE-2002-0564: Authentication bypass in the PL/SQL     module.

  - CVE-2002-0565: Information disclosure through JSP files     in the _pages directory.

  - CVE-2002-0566: Denial of service in the PL/SQL module.

  - CVE-2002-0568: Improper access control on XSQLConfig.xml     and soapConfig.xml.

  - CVE-2002-0569: Authentication bypass through     XSQLServlet.

  - CVE-2002-0655: Denial of service in OpenSSL.

  - CVE-2002-0656: Buffer overflows in OpenSSL.

  - CVE-2002-0659: Denial of service in OpenSSL.

  - CVE-2002-0840: Cross-site scripting in the default error     page of Apache.

  - CVE-2002-0842: Format string vulnerability in mod_dav.

  - CVE-2002-0843: Buffer overflows in ApacheBench.

  - CVE-2002-0947: Buffer overflow in rwcgi60.

  - CVE-2002-1089: Information disclosure in rwcgi60.

  - CVE-2002-1630: Improper access control on sendmail.jsp.

  - CVE-2002-1631: SQL injection in query.xsql.

  - CVE-2002-1632: Information disclosure through several     JSP pages.

  - CVE-2002-1635: Information disclosure in Apache.

  - CVE-2002-1636: Cross-site scripting in the htp PL/SQL     package.

  - CVE-2002-1637: Default credentials in multiple     components.

  - CVE-2002-1858: Information disclosure through the     WEB-INF directory.

  - CVE-2002-2153: Format string vulnerability in the     administrative pages of the PL/SQL module.

  - CVE-2002-2345: Credential leakage in the web cache     administrator interface.

  - CVE-2002-2347: Cross-site scripting in several JSP     pages.

  - CVE-2004-1362: Authentication bypass in the PL/SQL     module.

  - CVE-2004-1363: Buffer overflow in extproc.

  - CVE-2004-1364: Directory traversal in extproc.

  - CVE-2004-1365: Command execution in extproc.

  - CVE-2004-1366: Improper access control on     emoms.properties.

  - CVE-2004-1367: Credential leakage in Database Server.

  - CVE-2004-1368: Arbitrary file execution in ISQL*Plus.

  - CVE-2004-1369: Denial of service in TNS Listener.

  - CVE-2004-1370: Multiple SQL injection vulnerabilities in     PL/SQL.

  - CVE-2004-1371: Stack-based buffer overflow.

  - CVE-2004-1707: Privilege escalation in dbsnmp and nmo.

  - CVE-2004-1774: Buffer overflow in the MD2 package.

  - CVE-2004-1877: Phishing vulnerability in Single Sign-On     component.

  - CVE-2004-2134: Weak cryptography for passwords in the     toplink mapping workBench.

  - CVE-2004-2244: Denial of service in the XML parser.

  - CVE-2005-1383: Authentication bypass in HTTP Server.

  - CVE-2005-1495: Detection bypass.

  - CVE-2005-1496: Privilege escalation in the     DBMS_Scheduler.

  - CVE-2005-2093: Web cache poisoning.

  - CVE-2005-3204: Cross-site scripting.

  - CVE-2005-3445: Multiple unspecified vulnerabilities in     HTTP Server.

  - CVE-2005-3446: Unspecified vulnerability in Internet     Directory.

  - CVE-2005-3447: Unspecified vulnerability in Single     Sign-On.

  - CVE-2005-3448: Unspecified vulnerability in the OC4J     module.

  - CVE-2005-3449: Multiple unspecified vulnerabilities in     multiple components.

  - CVE-2005-3450: Unspecified vulnerability in HTTP Server.

  - CVE-2005-3451: Unspecified vulnerability in     SQL*ReportWriter.

  - CVE-2005-3452: Unspecified vulnerability in Web Cache.

  - CVE-2005-3453: Multiple unspecified vulnerabilities in     Web Cache.

  - CVE-2006-0273: Unspecified vulnerability in the Portal     component.

  - CVE-2006-0274: Unspecified vulnerability in the Oracle     Reports Developer component.

  - CVE-2006-0275: Unspecified vulnerability in the Oracle     Reports Developer component.

  - CVE-2006-0282: Unspecified vulnerability.

  - CVE-2006-0283: Unspecified vulnerability.

  - CVE-2006-0284: Multiple unspecified vulnerabilities.

  - CVE-2006-0285: Unspecified vulnerability in the Java Net     component.

  - CVE-2006-0286: Unspecified vulnerability in HTTP Server.

  - CVE-2006-0287: Unspecified vulnerability in HTTP Server.

  - CVE-2006-0288: Multiple unspecified vulnerabilities in     the Oracle Reports Developer component.

  - CVE-2006-0289: Multiple unspecified vulnerabilities.

  - CVE-2006-0290: Unspecified vulnerability in the Oracle     Workflow Cartridge component.

  - CVE-2006-0291: Multiple unspecified vulnerabilities in     the Oracle Workflow Cartridge component.

  - CVE-2006-0435: Unspecified vulnerability in Oracle     PL/SQL.

  - CVE-2006-0552: Unspecified vulnerability in the Net     Listener component.

  - CVE-2006-0586: Multiple SQL injection vulnerabilities.

  - CVE-2006-1884: Unspecified vulnerability in the Oracle     Thesaurus Management System component.

  - CVE-2006-3706: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3707: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3708: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3709: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3710: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3711: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3712: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3713: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-3714: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-5353: Unspecified vulnerability in HTTP Server.

  - CVE-2006-5354: Unspecified vulnerability in HTTP Server.

  - CVE-2006-5355: Unspecified vulnerability in Single     Sign-On.

  - CVE-2006-5356: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-5357: Unspecified vulnerability in HTTP Server.

  - CVE-2006-5358: Unspecified vulnerability in the Oracle     Forms component.

  - CVE-2006-5359: Multiple unspecified vulnerabilities in     Oracle Reports Developer component.

  - CVE-2006-5360: Unspecified vulnerability in Oracle Forms     component.

  - CVE-2006-5361: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-5362: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-5363: Unspecified vulnerability in Single     Sign-On.

  - CVE-2006-5364: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2006-5365: Unspecified vulnerability in Oracle     Forms.

  - CVE-2006-5366: Multiple unspecified vulnerabilities.

  - CVE-2007-0222: Directory traversal vulnerability in     EmChartBean.

  - CVE-2007-0275: Cross-site scripting vulnerability in     Oracle Reports Web Cartridge (RWCGI60).

  - CVE-2007-0280: Buffer overflow in Oracle Notification     Service.

  - CVE-2007-0281: Multiple unspecified vulnerabilities in     HTTP Server.

  - CVE-2007-0282: Unspecified vulnerability in OPMN02.

  - CVE-2007-0283: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2007-0284: Multiple unspecified vulnerabilities in     Oracle Containers for J2EE.

  - CVE-2007-0285: Unspecified vulnerability in Oracle     Reports Developer.

  - CVE-2007-0286: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2007-0287: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2007-0288: Unspecified vulnerability in Oracle     Internet Directory.

  - CVE-2007-0289: Multiple unspecified vulnerabilities in     Oracle Containers for J2EE.

  - CVE-2007-1359: Improper access control in mod_security.

  - CVE-2007-1609: Cross-site scripting vulnerability in     servlet/Spy in Dynamic Monitoring Services (DMS).

  - CVE-2007-2119: Cross-site scripting vulnerability in the     Administration Front End for Oracle Enterprise (Ultra)     Search.

  - CVE-2007-2120: Denial of service in the Oracle     Discoverer servlet.

  - CVE-2007-2121: Unspecified vulnerability in the COREid     Access component.

  - CVE-2007-2122: Unspecified vulnerability in the Wireless     component.

  - CVE-2007-2123: Unspecified vulnerability in the Portal     component.

  - CVE-2007-2124: Unspecified vulnerability in the Portal     component.

  - CVE-2007-2130: Unspecified vulnerability in Workflow     Cartridge.

  - CVE-2007-3553: Cross-site scripting vulnerability in     Rapid Install Web Server.

  - CVE-2007-3854: Multiple unspecified vulnerabilities in     the Advanced Queuing component and the Spatial     component.

  - CVE-2007-3859: Unspecified vulnerability in the Oracle     Internet Directory component.

  - CVE-2007-3861: Unspecified vulnerability in Oracle     Jdeveloper.

  - CVE-2007-3862: Unspecified vulnerability in Single     Sign-On.

  - CVE-2007-3863: Unspecified vulnerability in Oracle     JDeveloper.

  - CVE-2007-5516: Unspecified vulnerability in the Oracle     Process Mgmt & Notification component.

  - CVE-2007-5517: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2007-5518: Unspecified vulnerability in HTTP Server.

  - CVE-2007-5519: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2007-5520: Unspecified vulnerability in the Oracle     Internet Directory component.

  - CVE-2007-5521: Unspecified vulnerability in Oracle     Containers for J2EE.

  - CVE-2007-5522: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2007-5523: Unspecified vulnerability in the Oracle     Internet Directory component.

  - CVE-2007-5524: Unspecified vulnerability in Single     Sign-On.

  - CVE-2007-5525: Unspecified vulnerability in Single     Sign-On.

  - CVE-2007-5526: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2007-5531: Unspecified vulnerability in Oracle Help     for Web.

  - CVE-2008-0340: Multiple unspecified vulnerabilities in     the Advanced Queuing component and Spatial component.

  - CVE-2008-0343: Unspecified vulnerability in the Oracle     Spatial component.

  - CVE-2008-0344: Unspecified vulnerability in the Oracle     Spatial component.

  - CVE-2008-0345: Unspecified vulnerability in the Core     RDBMS component.

  - CVE-2008-0346: Unspecified vulnerability in the Oracle     Jinitiator component.

  - CVE-2008-0347: Unspecified vulnerability in the Oracle     Ultra Search component.

  - CVE-2008-0348: Multiple unspecified vulnerabilities in     the PeopleTools component.

  - CVE-2008-0349: Unspecified vulnerability in the     PeopleTools component.

  - CVE-2008-1812: Unspecified vulnerability in the Oracle     Enterprise Manager component.

  - CVE-2008-1814: Unspecified vulnerability in the Oracle     Secure Enterprise Search or Ultrasearch component.

  - CVE-2008-1823: Unspecified vulnerability in the Oracle     Jinitiator component.

  - CVE-2008-1824: Unspecified vulnerability in the Oracle     Dynamic Monitoring Service component.

  - CVE-2008-1825: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-2583: Unspecified vulnerability in the sample     Discussion Forum Portlet for the Oracle Portal     component.

  - CVE-2008-2588: Unspecified vulnerability in the Oracle     JDeveloper component.

  - CVE-2008-2589: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-2593: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-2594: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-2595: Unspecified vulnerability in the Oracle     Internet Directory component.

  - CVE-2008-2609: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-2612: Unspecified vulnerability in the Hyperion     BI Plus component.

  - CVE-2008-2614: Unspecified vulnerability in HTTP Server.

  - CVE-2008-2619: Unspecified vulnerability in the Oracle     Reports Developer component.

  - CVE-2008-2623: Unspecified vulnerability in the Oracle     JDeveloper component.

  - CVE-2008-3975: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-3977: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-3986: Unspecified vulnerability in the Oracle     Discoverer Administrator component.

  - CVE-2008-3987: Unspecified vulnerability in the Oracle     Discoverer Desktop component.

  - CVE-2008-4014: Unspecified vulnerability in the Oracle     BPEL Process Manager component.

  - CVE-2008-4017: Unspecified vulnerability in the OC4J     component.

  - CVE-2008-5438: Unspecified vulnerability in the Oracle     Portal component.

  - CVE-2008-7233: Unspecified vulnerability in the Oracle     Jinitiator component.

  - CVE-2009-0217: Signature spoofing vulnerability in     multiple components.

  - CVE-2009-0989: Unspecified vulnerability in the BI     Publisher component.

  - CVE-2009-0990: Unspecified vulnerability in the BI     Publisher component.

  - CVE-2009-0994: Unspecified vulnerability in the BI     Publisher component.

  - CVE-2009-1008: Unspecified vulnerability in the Outside     In Technology component.

  - CVE-2009-1009: Unspecified vulnerability in the Outside     In Technology component.

  - CVE-2009-1010: Unspecified vulnerability in the Outside     In Technology component.

  - CVE-2009-1011: Unspecified vulnerability in the Outside     In Technology component.

  - CVE-2009-1017: Unspecified vulnerability in the BI     Publisher component.

  - CVE-2009-1976: Unspecified vulnerability in HTTP Server.

  - CVE-2009-1990: Unspecified vulnerability in the Business     Intelligence Enterprise Edition component.

  - CVE-2009-1999: Unspecified vulnerability in the Business     Intelligence Enterprise Edition component.

  - CVE-2009-3407: Unspecified vulnerability in the Portal     component.

  - CVE-2009-3412: Unspecified vulnerability in the Unzip     component.

  - CVE-2010-0066: Unspecified vulnerability in the Access     Manager Identity Server component.

  - CVE-2010-0067: Unspecified vulnerability in the Oracle     Containers for J2EE component.

  - CVE-2010-0070: Unspecified vulnerability in the Oracle     Containers for J2EE component.

  - CVE-2011-0789: Unspecified vulnerability in HTTP Server.

  - CVE-2011-0795: Unspecified vulnerability in Single     Sign-On.

  - CVE-2011-0884: Unspecified vulnerability in the Oracle     BPEL Process Manager component.

  - CVE-2011-2237: Unspecified vulnerability in the Oracle     Web Services Manager component.

  - CVE-2011-2314: Unspecified vulnerability in the Oracle     Containers for J2EE component.

  - CVE-2011-3523: Unspecified vulnerability in the Oracle     Web Services Manager component.

The version of OpenSSL installed on the remote host is prior to 0.9.6e. It is, therefore, affected by multiple vulnerabilities as referenced in the 0.9.6e advisory.

  - The ASN1 library in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allows remote attackers to     cause a denial of service via invalid encodings. (CVE-2002-0659)

  - Buffer overflows in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to     execute arbitrary code via (1) a large client master key in SSL2 or (2) a large session ID in SSL3.
    (CVE-2002-0656)

  - OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, does not properly handle ASCII representations of     integers on 64 bit platforms, which could allow attackers to cause a denial of service and possibly     execute arbitrary code. (CVE-2002-0655)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The OpenSSL development team has announced that a security audit by A.L. Digital Ltd and The Bunker, under the DARPA CHATS program, has revealed remotely exploitable buffer overflow conditions in the OpenSSL code. Additionally, the ASN1 parser in OpenSSL has a potential DoS attack independently discovered by Adi Stav and James Yonan.

CAN-2002-0655 references overflows in buffers used to hold ASCII representations of integers on 64 bit platforms. CAN-2002-0656 references buffer overflows in the SSL2 server implementation (by sending an invalid key to the server) and the SSL3 client implementation (by sending a large session id to the client). The SSL2 issue was also noticed by Neohapsis, who have privately demonstrated exploit code for this issue. CAN-2002-0659 references the ASN1 parser DoS issue.

These vulnerabilities have been addressed for Debian 3.0 (woody) in openssl094_0.9.4-6.woody.2, openssl095_0.9.5a-6.woody.1 and openssl_0.9.6c-2.woody.1.

These vulnerabilities are also present in Debian 2.2 (potato). Fixed packages are available in openssl094_0.9.4-6.potato.2 and openssl_0.9.6c-0.potato.4.

A worm is actively exploiting this issue on internet-attached hosts;
we recommend you upgrade your OpenSSL as soon as possible. Note that you must restart any daemons using SSL. (E.g., ssh or ssl-enabled apache.) If you are uncertain which programs are using SSL you may choose to reboot to ensure that all running daemons are using the new libraries.

Updated OpenSSL packages are available for Red Hat Linux Advanced Server. These updates fix multiple protocol parsing bugs, which may cause a denial of service (DoS) attack or cause SSL-enabled applications to crash.

[Updated 06 Jan 2003] Added fixed packages for the ia64 architecture.

[Updated 06 Feb 2003] Added fixed packages for Advanced Workstation 2.1

OpenSSL is a commercial-grade, full-featured, and open source toolkit which implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library.

Portions of the SSL protocol data stream, which include the lengths of structures which are being transferred, may not be properly validated.
This may allow a malicious server or client to cause an affected application to crash or enter an infinite loop, which can be used as a denial of service (DoS) attack if the application is a server. It has not been verified if this issue could lead to further consequences such as remote code execution.

These errata packages contain a patch to correct this vulnerability.
Please note that the original patch from the OpenSSL team had a mistake in it which could possibly still allow buffer overflows to occur. This bug is also fixed in these errata packages.

NOTE :

Please read the Solution section below as it contains instructions for making sure that all SSL-enabled processes are restarted after the update is applied.

Thanks go to the OpenSSL team for providing patches for these issues.

The remote service seems to be using a version of OpenSSL that is older than 0.9.6e or 0.9.7-beta3.

Such versions are affected by a buffer overflow that may allow an attacker to execute arbitrary commands on the remote host with the privileges of the application itself.

ID	Name	Product	Family	Severity
57619	Oracle Application Server Multiple Vulnerabilities	Nessus	Web Servers	critical
17746	OpenSSL 0.9.6 < 0.9.6e Multiple Vulnerabilities	Nessus	Web Servers	critical
14973	Debian DSA-136-1 : openssl - multiple remote exploits	Nessus	Debian Local Security Checks	high
12316	RHEL 2.1 : openssl (RHSA-2002:161)	Nessus	Red Hat Local Security Checks	medium
11060	OpenSSL < 0.9.6e / 0.9.7b3 Multiple Remote Vulnerabilities	Nessus	Gain a shell remotely	critical

Detections

Analytics

CVE-2002-0659

high

Tenable Plugins

critical

critical

high

medium

critical