SSL: OpenSSL KEY_ARG Buffer Overflow

This signature detects attempts to exploit a known vulnerability in OpenSSL. OpenSSL 0.9.6d and earlier versions are vulnerable. Attackers can exploit a buffer overflow condition in the KEY_ARG parameter to execute arbitrary code on the victim host.

Extended Description

A buffer-overflow vulnerability has been reported in some versions of OpenSSL. The issue occurs in the handling of the client key value during the negotiation of the SSLv2 protocol. A malicious client may be able to exploit this vulnerability to execute arbitrary code as the vulnerable server process or possibly to create a denial-of-service condition. ***UPDATE: A worm that likely exploits this vulnerability has been discovered propagating in the wild. Additionally, this code includes peer-to-peer and distributed denial-of-service capabilities. There have been numerous reports of intrusions in Europe. It is not yet confirmed whether this vulnerability is in OpenSSL, mod_ssl, or another component. Administrators are advised to upgrade to the most recent versions or to disable Apache, if possible, until more information is available.

Affected Products

Sonicwall ssl-r6,Hp tcp/ip_services_for_openvms,Openssl_project openssl

References

BugTraq: 5363

CVE: CVE-2002-0656

URL: http://www.securityfocus.com/bid/5363/info/

Short Name

SSL:OVERFLOW:SSL-KEY_ARG1

Severity

Critical

Recommended

False

Recommended Action

Drop

SSL: OpenSSL KEY_ARG Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?