OpenSSL is an Open Source toolkit which implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols and provides a full-strength general purpose cryptography library. Versions of OpenSSL prior to 0.9.6k and 0.9.7c are vulnerable to Denial of Service (DoS) attacks or could theoretically allow remote execution of arbitrary code.
| OpenSSL version |
Applicable advisories |
Effect |
|---|---|---|
| 0.9.6d and earlier |
30-Jul-2002 | Practical to run arbitrary code remotely |
| 0.9.6e-h and 0.9.7 |
19-Feb-2003 | Practical (LAN) attack to recover frequently repeated plaintext such as passwords |
| 0.9.6i and 0.9.7a |
17-Mar-2003
19-Mar-2003 |
Practical (LAN) attacks to obtain or use secret key |
| 0.9.6j and 0.9.7b |
30-Sep-2003 | Denial of Service, and theoretically possible run arbitrary code remotely |
| 0.9.6k and 0.9.7c |
Clean at present |
Some attacks may not be feasible except from systems on the same LAN as the attacked system, since a very fast connection between the attacker and target may be needed to make the attack practicable. If a webserver is in a datacenter with perhaps dozens or even hundreds of other systems, a compromised system within the datacenter could be used by an attacker to exploit these vulnerabilities on other servers within the same datacenter, however.
If you need to determine which version of OpenSSL you are running, you
can use the command openssl version. You may need to specify
the full path to the command if it isn't in your default path. For a Solaris
10 system, you can use the following path:
# /usr/sfw/bin/openssl version
OpenSSL 0.9.7d 17 Mar 2004
For Solaris 7, use /usr/local/ssl/bin/openssl version.
References:
