CVE-2010-2939
Published: 17 August 2010
Double free vulnerability in the ssl3_get_key_exchange function in the OpenSSL client (ssl/s3_clnt.c) in OpenSSL 1.0.0a, 0.9.8, 0.9.7, and possibly other versions, when using ECDH, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted private key with an invalid prime. NOTE: some sources refer to this as a use-after-free issue.
Notes
| Author | Note |
|---|---|
| sbeattie | possibly stopped by glibc's double-free heap protection, CVE asserts that it's needed in 0.9.7, though the referenced email from solar designer claims that it's not needed in 0.9.7 as ECDH hadn't been introduced yet as of openssl 0.9.7m. |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
openssl Launchpad, Ubuntu, Debian |
dapper |
Released
(0.9.8a-7ubuntu0.13)
|
| hardy |
Released
(0.9.8g-4ubuntu3.11)
|
|
| jaunty |
Released
(0.9.8g-15ubuntu3.6)
|
|
| karmic |
Released
(0.9.8g-16ubuntu3.3)
|
|
| lucid |
Released
(0.9.8k-7ubuntu8.3)
|
|
| upstream |
Needs triage
|
|
|
Patches: upstream: http://www.mail-archive.com/openssl-dev@openssl.org/msg28049.html |
||
| This vulnerability is mitigated in part by the use of GNU C Library heap protector in Ubuntu. | ||
|
openssl097 Launchpad, Ubuntu, Debian |
dapper |
Ignored
(reached end-of-life)
|
| hardy |
Does not exist
|
|
| jaunty |
Does not exist
|
|
| karmic |
Does not exist
|
|
| lucid |
Does not exist
|
|
| upstream |
Needs triage
|
|