CVE-2010-2939

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Double free vulnerability in the ssl3_get_key_exchange function in the OpenSSL client (ssl/s3_clnt.c) in OpenSSL 1.0.0a, 0.9.8, 0.9.7, and possibly other versions, when using ECDH, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted private key with an invalid prime. NOTE: some sources refer to this as a use-after-free issue.

References

http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00005.html

http://marc.info/?l=bugtraq&m=130331363227777&w=2

http://seclists.org/fulldisclosure/2010/Aug/84

http://secunia.com/advisories/40906

http://secunia.com/advisories/41105

http://secunia.com/advisories/42309

http://secunia.com/advisories/42413

http://secunia.com/advisories/43312

http://security.FreeBSD.org/advisories/FreeBSD-SA-10:10.openssl.asc

http://securitytracker.com/id?1024296

http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.668793

http://www.debian.org/security/2010/dsa-2100

http://www.mail-archive.com/[email protected]/msg28043.html

http://www.mail-archive.com/[email protected]/msg28045.html

http://www.mail-archive.com/[email protected]/msg28049.html

http://www.openwall.com/lists/oss-security/2010/08/11/6

http://www.securityfocus.com/archive/1/516397/100/0/threaded

http://www.ubuntu.com/usn/USN-1003-1

http://www.vmware.com/security/advisories/VMSA-2011-0003.html

http://www.vupen.com/english/advisories/2010/2038

http://www.vupen.com/english/advisories/2010/2229

http://www.vupen.com/english/advisories/2010/3077

Details

Source: MITRE

Published: 2010-08-17

Updated: 2018-10-10

Type: CWE-399

Risk Information

CVSS v2

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

Tenable Plugins

View all (14 total)

IDNameProductFamilySeverity
89674VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0003) (remote check)NessusMisc.
critical
75592openSUSE Security Update : libopenssl-devel (openSUSE-SU-2010:0951-1)NessusSuSE Local Security Checks
medium
17767OpenSSL < 0.9.8p / 1.0.0e Double Free VulnerabilityNessusWeb Servers
medium
56425GLSA-201110-01 : OpenSSL: Multiple vulnerabilitiesNessusGentoo Local Security Checks
critical
53749openSUSE Security Update : libopenssl-devel (openSUSE-SU-2010:0951-1)NessusSuSE Local Security Checks
medium
53674openSUSE Security Update : libopenssl-devel (openSUSE-SU-2010:0952-1)NessusSuSE Local Security Checks
medium
53532HP System Management Homepage < 6.3 Multiple VulnerabilitiesNessusWeb Servers
critical
51971VMSA-2011-0003 : Third-party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESXNessusVMware ESX Local Security Checks
high
50938SuSE 11 / 11.1 Security Update : OpenSSL (SAT Patch Numbers 3208 / 3209)NessusSuSE Local Security Checks
medium
50668Slackware 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / current : openssl (SSA:2010-326-01)NessusSlackware Local Security Checks
high
50610SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 7174)NessusSuSE Local Security Checks
medium
49805Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS / 10.10 : openssl vulnerabilities (USN-1003-1)NessusUbuntu Local Security Checks
critical
49078Mandriva Linux Security Advisory : openssl (MDVSA-2010:168)NessusMandriva Local Security Checks
medium
49057Debian DSA-2100-1 : openssl - double freeNessusDebian Local Security Checks
medium