OpenSSL TLS 1.2 Flaw Allows Remote Crashes of Affected Applications
Vulnerability Disclosure · 9 sources · Updated 14d ago · First seen Jan 8, 2014
CVE-2013-6449 is a denial-of-service vulnerability in OpenSSL that allows remote attackers to crash affected applications with crafted TLS 1.2 client traffic. The flaw retrieves protocol-version information from the wrong data structure, causing selection of an incorrect hash algorithm. Reports linked OpenSSL 1.0.1e to crashes in Apache Traffic Server 4.0.x, and OpenSSL fixed the issue upstream in version 1.0.1f. OpenSSL 0.9.8 and the versions shipped with Red Hat Enterprise Linux 5 and earlier were unaffected. The supplied records provide no evidence of active exploitation.
Fedora released fixes for versions 18, 19, and 20 in December 2013, followed by Red Hat updates for Enterprise Linux 6 and associated virtualization products in January 2014. An earlier RHEL 6 update had introduced OpenSSL 1.0.1e and TLS 1.1/1.2 support. Administrators maintaining these legacy deployments should verify that vendor-fixed packages are installed and restart OpenSSL-linked services, or reboot, to load updated libraries. Red Hat's virtualization advisory RHSA-2014:0041 also addressed separate NSS and OpenSSL vulnerabilities; its broader warnings about possible code execution and invalid-certificate acceptance should not be attributed to CVE-2013-6449 alone.
