Back to Database
Status published
Unknown
CVE-2004-0079
The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a...
Vulnerability Description
The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2004-0079
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.securityfocus.com/bid/9899
- http://www.redhat.com/archives/fedora-announce-list/2005-October/msg00087.html
- http://www.linuxsecurity.com/advisories/engarde_advisory-4135.html
- http://marc.info/?l=bugtraq&m=108403806509920&w=2
- http://www.redhat.com/support/errata/RHSA-2004-121.html
- http://www.mandriva.com/security/advisories?name=MDKSA-2004:023
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2621
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000834
- ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.10/SCOSA-2004.10.txt
- http://secunia.com/advisories/17381
- http://www.uniras.gov.uk/vuls/2004/224012/index.htm
- http://fedoranews.org/updates/FEDORA-2004-095.shtml
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9779
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A975
- http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57524
- http://www.novell.com/linux/security/advisories/2004_07_openssl.html
- http://lists.apple.com/mhonarc/security-announce/msg00045.html
- http://www.openssl.org/news/secadv_20040317.txt
- ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:05.openssl.asc
- ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-005.txt.asc
- http://www.ciac.org/ciac/bulletins/o-101.shtml
- http://www.us-cert.gov/cas/techalerts/TA04-078A.html
- http://secunia.com/advisories/17401
- http://www.redhat.com/support/errata/RHSA-2005-829.html
- http://support.avaya.com/elmodocs2/security/ASA-2005-239.htm
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A870
- http://www.redhat.com/support/errata/RHSA-2005-830.html
- http://security.gentoo.org/glsa/glsa-200403-03.xml
- http://secunia.com/advisories/11139
- http://www.redhat.com/support/errata/RHSA-2004-120.html
- http://marc.info/?l=bugtraq&m=107953412903636&w=2
- http://support.lexmark.com/index?page=content&id=TE88&locale=EN&userlocale=EN_US
- http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html
- http://secunia.com/advisories/17398
- http://www.slackware.org/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.455961
- http://www.redhat.com/support/errata/RHSA-2004-139.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15505
- http://www.trustix.org/errata/2004/0012
- http://www.cisco.com/warp/public/707/cisco-sa-20040317-openssl.shtml
- http://docs.info.apple.com/article.html?artnum=61798
- http://www.kb.cert.org/vuls/id/288574
- http://www.debian.org/security/2004/dsa-465
- http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html
- http://secunia.com/advisories/18247
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5770
More from cisco
View All →CVE-2025-27091
OpenH264 Decoding Functions Heap Overflow Vulnerability
High
8.6
CVE-2023-25653
Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)
High
7.5
CVE-2021-33478
The TrustZone implementation in certain Broadcom MediaxChange firmware could allow...
Medium
6.8
CVE-2020-16139
A denial-of-service in Cisco Unified IP Conference Station 7937G 1-4-4-0...
High
7.5
CVE-2020-16138
A denial-of-service issue in Cisco Unified IP Conference Station 7937G...
High
7.5
Affected Vendor
cisco
View all reports →Affected Software
firewall services module, aaa server, apache-based web server, clientless vpn gateway 4400, ciscoworks common management foundation, ciscoworks common services, converged communications server, sg200, sg203, sg208, sg5, mac os x, mac os x server, freebsd, hp-ux, openbsd, enterprise linux, enterprise linux desktop, linux, openserver, ios, webstar, intuity audix, vsu, firewall-1, provider-1, vpn-1, access registrar, application and content networking software, css secure content accelerator, css11000 content services switch, okena stormwatch, pix firewall, threat response, webns, bsafe ssl-j, wbem, speed technologies litespeed web server, instant virtual extranet, edirectory, imanager, openssl, propack, servercluster, stonebeat fullcluster, stonebeat securitycluster, stonebeat webcluster, stonegate, stonegate vpn client, tarantella enterprise, gsx server, s8300, s8500, s8700, proxysg, call manager, content services switch 11500, gss 4480 global site selector, gss 4490 global site selector, mds 9000, secure content accelerator, sidewinder, crypto accelerator 4000, cacheos ca sa, pix firewall software
Vulnerable Versions:
1.1.2, 1.1.3, 1.1_\(3.005\), 2.1_\(0.208\), 2.0.43.00, 2.0.43.04, 5.0, 2.1, 2.2, 2.0, 4.4, 4.31.29, 4.2, 4.3, 10.3.3, 4.8, 4.9, 5.1, 5.2, 5.2.1, 8.05, 11.00, 11.11, 11.23, 3.3, 3.4, 3.0, 7.2, 7.3, 8.0, 5.0.6, 5.0.7, 12.1\(11\)e, 12.1\(11b\)e, 12.1\(11b\)e12, 12.1\(11b\)e14, 12.1\(13\)e9, 12.1\(19\)e1, 12.2\(14\)sy, 12.2\(14\)sy1, 12.2sy, 12.2za, 4.0, 5.2.2, 5.2.3, 5.2.4, 5.3, 5.3.1, 5.1.46, s3210, s3400, 5, 5x, 100_r2.0.1, 500, 2000_r2.0.1, 5000_r2.0.1, 7500_r2.0.1, 10000_r2.0.1, next_generation_fp0, next_generation_fp1, next_generation_fp2, 4.1, vsx_ng_with_application_intelligence, 1.0, 3.2, 6.2.2_.111, 6.10, 6.10_b4, 7.1_0.1.02, 7.1_0.2.06, 7.2_0.0.03, 7.10, 7.10_.0.06s, 3.0.1, 3.1, a.01.05.08, a.02.00.00, a.02.00.01, 1.0.1, 1.0.2, 1.0.3, 1.1, 1.1.1, 1.2.1, 1.2.2, 1.2_rc1, 1.2_rc2, 1.3, 1.3.1, 1.3_rc1, 1.3_rc2, 1.3_rc3, 3.3.1, 8.5, 8.5.12a, 8.5.27, 8.6.2, 8.7, 8.7.1, 1.5, 0.9.6c, 0.9.6d, 0.9.6e, 0.9.6f, 0.9.6g, 0.9.6h, 0.9.6i, 0.9.6j, 0.9.6k, 0.9.7, 0.9.7a, 0.9.7b, 0.9.7c, 0.9.6-15, 0.9.6b-3, 0.9.7a-2, 2.3, 2.4, 2.5, 2.5.2, 1_2.0, 1_3.0, 1.5.17, 1.5.18, 1.6.2, 1.6.3, 1.7, 1.7.1, 1.7.2, 2.0.1, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.2.1, 2.2.4, 3.20, 3.30, 3.40, 2.0.1_build_2129, 2.5.1, 2.5.1_build_5336, 3.0_build_7592, r2.0.0, r2.0.1, 10000, 5.2.0.01, 5.2.0.02, 5.2.0.03, 5.2.0.04, 5.2.1.02, 4.1.10, 4.1.12, 6.0, 6.0\(1\), 6.0\(2\), 6.0\(3\), 6.0\(4\), 6.0\(4.101\), 6.1, 6.1\(1\), 6.1\(2\), 6.1\(3\), 6.1\(4\), 6.1\(5\), 6.2, 6.2\(1\), 6.2\(2\), 6.2\(3\), 6.2\(3.100\), 6.3, 6.3\(1\), 6.3\(2\), 6.3\(3.102\), 6.3\(3.109\)
Timeline
Official Publish:
March 18th, 2004
Last Modified:
January 16th, 2025
Added to House:
July 18th, 2026
CVSS Vectors
No vector data available
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.