OpenSSL DTLS Context Handling Flaw Can Cause Application Crashes
Vulnerability Disclosure · 13 sources · Updated 14d ago · First seen Jan 1, 2014
A denial-of-service vulnerability in OpenSSL's DTLS retransmission handling, CVE-2013-6450, can allow a man-in-the-middle attacker to crash affected applications by interfering with packet delivery. Improper maintenance of digest and encryption context structures can cause an application to use the wrong context. The flaw affects OpenSSL 1.0.0 releases before 1.0.0l and 1.0.1 releases before 1.0.1f, which contain the fixes. The CVE was originally published in January 2014, rather than representing a newly disclosed vulnerability.
IBM also published an Interim Fix 29 README for Tivoli Composite Application Manager for Transactions Internet Service Monitoring 7.3.0.1, identified as 7.3.0.1-TIV-CAMIS-IF0029. Administrators maintaining this legacy product should consult that README to establish product-specific applicability and remediation; the available reference does not confirm whether the interim fix addresses this CVE. Defenders should inventory applications using affected OpenSSL versions, prioritize those using DTLS, and apply vendor-supported updates containing the corrected implementation.
