National Cyber Awareness System

Vulnerability Summary for CVE-2010-3864

Overview

Multiple race conditions in ssl/t1_lib.c in OpenSSL 0.9.8f through 0.9.8o, 1.0.0, and 1.0.0a, when multi-threading and internal caching are enabled on a TLS server, might allow remote attackers to execute arbitrary code via client data that triggers a heap-based buffer overflow, related to (1) the TLS server name extension and (2) elliptic curve cryptography.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=649304

Type: Patch Information

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=649304

External Source: SECTRACK

Name: 1024743

Type: Patch Information

Hyperlink:http://securitytracker.com/id?1024743

External Source: CONFIRM

Name: http://openssl.org/news/secadv_20101116.txt

Type: Advisory; Patch Information

Hyperlink:http://openssl.org/news/secadv_20101116.txt

External Source: REDHAT

Name: RHSA-2010:0888

Hyperlink:https://rhn.redhat.com/errata/RHSA-2010-0888.html

External Source: MLIST

Name: [syslog-ng-announce] 20110110 syslog-ng Premium Edition 3.2.1a has been released

Hyperlink:https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.html

External Source: MLIST

Name: [syslog-ng-announce] 20110110 syslog-ng Premium Edition 3.0.6a has been released

Hyperlink:https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html

External Source: VUPEN

Name: ADV-2010-3121

Hyperlink:http://www.vupen.com/english/advisories/2010/3121

External Source: VUPEN

Name: ADV-2010-3097

Hyperlink:http://www.vupen.com/english/advisories/2010/3097

External Source: VUPEN

Name: ADV-2010-3077

Hyperlink:http://www.vupen.com/english/advisories/2010/3077

External Source: VUPEN

Name: ADV-2010-3041

Hyperlink:http://www.vupen.com/english/advisories/2010/3041

External Source: CONFIRM

Name: http://www.vmware.com/security/advisories/VMSA-2011-0003.html

Hyperlink:http://www.vmware.com/security/advisories/VMSA-2011-0003.html

External Source: BUGTRAQ

Name: 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/516397/100/0/threaded

External Source: DEBIAN

Name: DSA-2125

Hyperlink:http://www.debian.org/security/2010/dsa-2125

External Source: CONFIRM

Name: http://www.adobe.com/support/security/bulletins/apsb11-11.html

Hyperlink:http://www.adobe.com/support/security/bulletins/apsb11-11.html

External Source: CONFIRM

Name: http://support.apple.com/kb/HT4723

Hyperlink:http://support.apple.com/kb/HT4723

External Source: SLACKWARE

Name: SSA:2010-326-01

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.668793

External Source: FREEBSD

Name: FreeBSD-SA-10:10

Hyperlink:http://security.FreeBSD.org/advisories/FreeBSD-SA-10:10.openssl.asc

External Source: SECUNIA

Name: 44269

Hyperlink:http://secunia.com/advisories/44269

External Source: SECUNIA

Name: 43312

Hyperlink:http://secunia.com/advisories/43312

External Source: SECUNIA

Name: 42413

Hyperlink:http://secunia.com/advisories/42413

External Source: SECUNIA

Name: 42397

Hyperlink:http://secunia.com/advisories/42397

External Source: SECUNIA

Name: 42352

Hyperlink:http://secunia.com/advisories/42352

External Source: SECUNIA

Name: 42336

Hyperlink:http://secunia.com/advisories/42336

External Source: SECUNIA

Name: 42309

Hyperlink:http://secunia.com/advisories/42309

External Source: SECUNIA

Name: 42243

Type: Advisory

Hyperlink:http://secunia.com/advisories/42243

External Source: SECUNIA

Name: 42241

Hyperlink:http://secunia.com/advisories/42241

External Source: HP

Name: SSRT100741

Hyperlink:http://marc.info/?l=bugtraq&m=132828103218869&w=2

External Source: HP

Name: HPSBGN02740

Hyperlink:http://marc.info/?l=bugtraq&m=132828103218869&w=2

External Source: SUSE

Name: SUSE-SR:2010:022

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00006.html

External Source: FEDORA

Name: FEDORA-2010-17826

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051255.html

External Source: FEDORA

Name: FEDORA-2010-17847

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051237.html

External Source: FEDORA

Name: FEDORA-2010-17827

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051170.html

External Source: APPLE

Name: APPLE-SA-2011-06-23-1

Hyperlink:http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html

External Source: HP

Name: HPSBMA02658

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02794777

External Source: HP

Name: SSRT100413

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02794777

External Source: CONFIRM

Name: http://blogs.sun.com/security/entry/cve_2010_3864_race_condition

Hyperlink:http://blogs.sun.com/security/entry/cve_2010_3864_race_condition