CVE-2011-3210

Description

The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages from clients, which allows remote attackers to cause a denial of service (daemon crash) via out-of-order messages that violate the TLS protocol.

References

https://bugzilla.redhat.com/show_bug.cgi?id=736079

http://www.securitytracker.com/id?1026012

http://www.mandriva.com/security/advisories?name=MDVSA-2011:137

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564

http://support.apple.com/kb/HT5784

http://secunia.com/advisories/57353

http://openssl.org/news/secadv_20110906.txt

http://marc.info/?l=bugtraq&m=133226187115472&w=2

http://marc.info/?l=bugtraq&m=132750648501816&w=2

http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html

http://cvs.openssl.org/chngview?cn=21337

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3