Description
The multi-block feature in the ssl3_write_bytes function in s3_pkt.c in OpenSSL 1.0.2 before 1.0.2a on 64-bit x86 platforms with AES NI support does not properly handle certain non-blocking I/O cases, which allows remote attackers to cause a denial of service (pointer corruption and application crash) via unspecified vectors.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.securityfocus.com/bid/73226 ↗
- https://kc.mcafee.com/corporate/index?page=content&id=SB10110 ↗
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html ↗
- http://marc.info/?l=bugtraq&m=144050155601375&w=2 ↗
- https://bto.bluecoat.com/security-advisory/sa92 ↗
- https://www.openssl.org/news/secadv_20150319.txt ↗
- http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html ↗
- http://marc.info/?l=bugtraq&m=143748090628601&w=2 ↗
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=1202345 ↗
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html ↗
- https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=77c77f0a1b9f15b869ca3342186dfbedd1119d0e ↗
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html ↗
- http://marc.info/?l=bugtraq&m=144050297101809&w=2 ↗
- http://www.securitytracker.com/id/1031929 ↗
- https://security.gentoo.org/glsa/201503-11 ↗
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf ↗