Loading vulnerability…
OpenSSL TLS Next Protocol Negotiation Client Denial of Service
CVE-2013-4353 is a NULL pointer dereference in the ssl3_take_mac function in OpenSSL 1.0.1 through 1.0.1e. A malicious TLS server can send a crafted Next Protocol Negotiation record during a handshake to crash a connecting application using OpenSSL for TLS/SSL client functionality. An attacker able to modify handshake packets in transit can also trigger the flaw. The vulnerable code was introduced with Next Protocol Negotiation support in OpenSSL 1.0.1; earlier versions are unaffected. The upstream fix was released in OpenSSL 1.0.1f.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation terminates the affected TLS/SSL client application, causing denial of service and interrupting any operations handled by that process. The vulnerability has no identified confidentiality or integrity impact and does not establish arbitrary code execution.
If you can’t patch tonight, do this now.
Until patched, restrict affected clients to trusted TLS endpoints and avoid connections to untrusted servers. Configurations that avoid the vulnerable Next Protocol Negotiation functionality may reduce exposure where operationally feasible. Endpoint restrictions do not eliminate the documented risk from an attacker capable of modifying handshake traffic; patching remains necessary.
Patch, then assume compromise.
Install a vendor-supported OpenSSL release containing the fix. The historical upstream correction is OpenSSL 1.0.1f; the 1.0.1 branch is now unsupported. Red Hat Enterprise Linux 6 received a backported fix in openssl-1.0.1e-16.el6_5.4 under RHSA-2014:0015. Update affected applications that bundle OpenSSL as well as system libraries. Restart applications and services linked to the updated library, or reboot the system, so the corrected code is loaded.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.