CVE-2013-6449

Upstream information

CVE-2013-6449 at MITRE

Description

The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorrect data structure, which allows remote attackers to cause a denial of service (daemon crash) via crafted traffic from a TLS 1.2 client.

---

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having moderate severity.

CVSS v2 Scores

	National Vulnerability Database
Base Score	4.3
Vector	AV:N/AC:M/Au:N/C:N/I:N/A:P
Access Vector	Network
Access Complexity	Medium
Authentication	None
Confidentiality Impact	None
Integrity Impact	None
Availability Impact	Partial

SUSE Bugzilla entry: 856687 [RESOLVED / FIXED]

SUSE Security Advisories:

• TID7021300, published Sat Mar 3 09:45:58 UTC 2018
• TID7022768, published Sa 19. Mai 14:06:16 CEST 2018
• openSUSE-SU-2014:0012-1, published Fri, 3 Jan 2014 22:06:59 +0100 (CET)
• openSUSE-SU-2014:0015-1, published Fri, 3 Jan 2014 22:07:52 +0100 (CET)
• openSUSE-SU-2014:0018-1, published Fri, 3 Jan 2014 22:08:33 +0100 (CET)
• openSUSE-SU-2014:0048-1, published Sat, 11 Jan 2014 16:04:13 +0100 (CET)

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Linux Enterprise Desktop 12	libopenssl1_0_0 >= 1.0.1i-2.12 libopenssl1_0_0-32bit >= 1.0.1i-2.12 openssl >= 1.0.1i-2.12	Patchnames: SUSE Linux Enterprise Desktop 12 GA libopenssl1_0_0
SUSE Linux Enterprise Desktop 12 SP1	libopenssl1_0_0 >= 1.0.1i-34.1 libopenssl1_0_0-32bit >= 1.0.1i-34.1 openssl >= 1.0.1i-34.1	Patchnames: SUSE Linux Enterprise Desktop 12 SP1 GA libopenssl1_0_0
SUSE Linux Enterprise Desktop 12 SP2	libopenssl-devel >= 1.0.2j-55.1 libopenssl1_0_0 >= 1.0.2j-55.1 libopenssl1_0_0-32bit >= 1.0.2j-55.1 openssl >= 1.0.2j-55.1	Patchnames: SUSE Linux Enterprise Desktop 12 SP2 GA libopenssl-devel
SUSE Linux Enterprise Desktop 12 SP3	libopenssl-devel >= 1.0.2j-59.1 libopenssl1_0_0 >= 1.0.2j-59.1 libopenssl1_0_0-32bit >= 1.0.2j-59.1 openssl >= 1.0.2j-59.1	Patchnames: SUSE Linux Enterprise Desktop 12 SP3 GA libopenssl-devel
SUSE Linux Enterprise Desktop 12 SP4	libopenssl-1_0_0-devel >= 1.0.2p-2.11 libopenssl-devel >= 1.0.2p-1.13 libopenssl1_0_0 >= 1.0.2p-2.11 libopenssl1_0_0-32bit >= 1.0.2p-2.11 libopenssl1_1 >= 1.1.1-1.9 libopenssl1_1-32bit >= 1.1.1-1.9 openssl >= 1.0.2p-1.13 openssl-1_0_0 >= 1.0.2p-2.11	Patchnames: SUSE Linux Enterprise Desktop 12 SP4 GA libopenssl-1_0_0-devel SUSE Linux Enterprise Desktop 12 SP4 GA libopenssl-devel SUSE Linux Enterprise Desktop 12 SP4 GA libopenssl1_1
SUSE Linux Enterprise Module for Basesystem 15	libopenssl-1_1-devel >= 1.1.0h-2.3 libopenssl-devel >= 1.1.0h-1.11 libopenssl1_1 >= 1.1.0h-2.3 libopenssl1_1-32bit >= 1.1.0h-2.3 libopenssl1_1-hmac >= 1.1.0h-2.3 libopenssl1_1-hmac-32bit >= 1.1.0h-2.3 openssl >= 1.1.0h-1.11 openssl-1_1 >= 1.1.0h-2.3	Patchnames: SUSE Linux Enterprise Module for Basesystem 15 GA libopenssl-1_1-devel SUSE Linux Enterprise Module for Basesystem 15 GA libopenssl-devel
SUSE Linux Enterprise Module for Legacy Software 15	libopenssl-1_0_0-devel >= 1.0.2n-1.32 libopenssl1_0_0 >= 1.0.2n-1.32 openssl-1_0_0 >= 1.0.2n-1.32	Patchnames: SUSE Linux Enterprise Module for Legacy Software 15 GA libopenssl-1_0_0-devel
SUSE Linux Enterprise Server 11-SECURITY	libopenssl1-devel >= 1.0.1g-0.12.1 libopenssl1_0_0 >= 1.0.1g-0.12.1 libopenssl1_0_0-32bit >= 1.0.1g-0.12.1 openssl1 >= 1.0.1g-0.12.1 openssl1-doc >= 1.0.1g-0.12.1	Patchnames: SUSE Linux Enterprise Server 11-SECURITY GA libopenssl1-devel
SUSE Linux Enterprise Server 12	libopenssl1_0_0 >= 1.0.1i-2.7 libopenssl1_0_0-32bit >= 1.0.1i-2.12 libopenssl1_0_0-hmac >= 1.0.1i-2.7 libopenssl1_0_0-hmac-32bit >= 1.0.1i-2.12 openssl >= 1.0.1i-2.7 openssl-doc >= 1.0.1i-2.7	Patchnames: SUSE Linux Enterprise Server 12 GA libopenssl1_0_0
SUSE Linux Enterprise Server 12 SP1	libopenssl1_0_0 >= 1.0.1i-34.1 libopenssl1_0_0-32bit >= 1.0.1i-34.1 libopenssl1_0_0-hmac >= 1.0.1i-34.1 libopenssl1_0_0-hmac-32bit >= 1.0.1i-34.1 openssl >= 1.0.1i-34.1 openssl-doc >= 1.0.1i-34.1	Patchnames: SUSE Linux Enterprise Server 12 SP1 GA libopenssl1_0_0
SUSE Linux Enterprise Server 12 SP2	libopenssl-devel >= 1.0.2j-55.1 libopenssl1_0_0 >= 1.0.2j-55.1 libopenssl1_0_0-32bit >= 1.0.2j-55.1 libopenssl1_0_0-hmac >= 1.0.2j-55.1 libopenssl1_0_0-hmac-32bit >= 1.0.2j-55.1 openssl >= 1.0.2j-55.1 openssl-doc >= 1.0.2j-55.1	Patchnames: SUSE Linux Enterprise Server 12 SP2 GA libopenssl-devel
SUSE Linux Enterprise Server 12 SP3	libopenssl-devel >= 1.0.2j-59.1 libopenssl1_0_0 >= 1.0.2j-59.1 libopenssl1_0_0-32bit >= 1.0.2j-59.1 libopenssl1_0_0-hmac >= 1.0.2j-59.1 libopenssl1_0_0-hmac-32bit >= 1.0.2j-59.1 openssl >= 1.0.2j-59.1 openssl-doc >= 1.0.2j-59.1	Patchnames: SUSE Linux Enterprise Server 12 SP3 GA libopenssl-devel
SUSE Linux Enterprise Server 12 SP4	libopenssl-1_0_0-devel >= 1.0.2p-2.11 libopenssl-devel >= 1.0.2p-1.13 libopenssl1_0_0 >= 1.0.2p-2.11 libopenssl1_0_0-32bit >= 1.0.2p-2.11 libopenssl1_0_0-hmac >= 1.0.2p-2.11 libopenssl1_0_0-hmac-32bit >= 1.0.2p-2.11 libopenssl1_1 >= 1.1.1-1.9 libopenssl1_1-32bit >= 1.1.1-1.9 openssl >= 1.0.2p-1.13 openssl-1_0_0 >= 1.0.2p-2.11 openssl-1_0_0-doc >= 1.0.2p-2.11	Patchnames: SUSE Linux Enterprise Server 12 SP4 GA libopenssl-1_0_0-devel SUSE Linux Enterprise Server 12 SP4 GA libopenssl-devel SUSE Linux Enterprise Server 12 SP4 GA libopenssl1_1
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2	libopenssl-devel >= 1.0.2j-55.1 libopenssl1_0_0 >= 1.0.2j-55.1 libopenssl1_0_0-hmac >= 1.0.2j-55.1 openssl >= 1.0.2j-55.1 openssl-doc >= 1.0.2j-55.1	Patchnames: SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 GA libopenssl-devel
SUSE Linux Enterprise Software Development Kit 12	libopenssl-devel >= 1.0.1i-2.12	Patchnames: SUSE Linux Enterprise Software Development Kit 12 GA libopenssl-devel
SUSE Linux Enterprise Software Development Kit 12 SP1	libopenssl-devel >= 1.0.1i-34.1	Patchnames: SUSE Linux Enterprise Software Development Kit 12 SP1 GA libopenssl-devel
SUSE Linux Enterprise Software Development Kit 12 SP2	libopenssl-devel >= 1.0.2j-55.1	Patchnames: SUSE Linux Enterprise Software Development Kit 12 SP2 GA libopenssl-devel
SUSE Linux Enterprise Software Development Kit 12 SP3	libopenssl-devel >= 1.0.2j-59.1	Patchnames: SUSE Linux Enterprise Software Development Kit 12 SP3 GA libopenssl-devel
SUSE Linux Enterprise Software Development Kit 12 SP4	libopenssl-1_0_0-devel >= 1.0.2p-2.11 libopenssl-1_1-devel >= 1.1.1-1.9 libopenssl-1_1-devel-32bit >= 1.1.1-1.9 libopenssl-devel >= 1.0.2p-1.13	Patchnames: SUSE Linux Enterprise Software Development Kit 12 SP4 GA libopenssl-1_0_0-devel SUSE Linux Enterprise Software Development Kit 12 SP4 GA libopenssl-1_1-devel SUSE Linux Enterprise Software Development Kit 12 SP4 GA libopenssl-devel
openSUSE 12.3	libopenssl-devel >= 1.0.1e-1.21.1 libopenssl-devel-32bit >= 1.0.1e-1.21.1 libopenssl1_0_0 >= 1.0.1e-1.21.1 libopenssl1_0_0-32bit >= 1.0.1e-1.21.1 libopenssl1_0_0-debuginfo >= 1.0.1e-1.21.1 libopenssl1_0_0-debuginfo-32bit >= 1.0.1e-1.21.1 openssl >= 1.0.1e-1.21.1 openssl-debuginfo >= 1.0.1e-1.21.1 openssl-debugsource >= 1.0.1e-1.21.1 openssl-doc >= 1.0.1e-1.21.1	Patchnames: openSUSE-2014-10 openSUSE-2014-27
openSUSE 13.1	libopenssl-devel >= 1.0.1e-11.9.1 libopenssl-devel-32bit >= 1.0.1e-11.9.1 libopenssl1_0_0 >= 1.0.1e-11.9.1 libopenssl1_0_0-32bit >= 1.0.1e-11.9.1 libopenssl1_0_0-debuginfo >= 1.0.1e-11.9.1 libopenssl1_0_0-debuginfo-32bit >= 1.0.1e-11.9.1 openssl >= 1.0.1e-11.9.1 openssl-debuginfo >= 1.0.1e-11.9.1 openssl-debugsource >= 1.0.1e-11.9.1 openssl-doc >= 1.0.1e-11.9.1	Patchnames: openSUSE-2014-27 openSUSE-2014-4
openSUSE Leap 15.0	libopenssl1_0_0 >= 1.0.2n-lp150.1.25 libopenssl1_1 >= 1.1.0h-lp150.2.1 libopenssl1_1-32bit >= 1.1.0h-lp150.2.1 openssl >= 1.1.0h-lp150.1.1 openssl-1_1 >= 1.1.0h-lp150.2.1	Patchnames: openSUSE Leap 15.0 GA libopenssl1_0_0 openSUSE Leap 15.0 GA libopenssl1_1 openSUSE Leap 15.0 GA openssl
openSUSE Leap 42.1	libopenssl-devel >= 1.0.1i-4.1 libopenssl1_0_0 >= 1.0.1i-4.1 libopenssl1_0_0-32bit >= 1.0.1i-4.1 openssl >= 1.0.1i-4.1	Patchnames: openSUSE Leap 42.1 GA libopenssl-devel
openSUSE Leap 42.2	libopenssl-devel >= 1.0.2j-2.2 libopenssl1_0_0 >= 1.0.2j-2.2 libopenssl1_0_0-32bit >= 1.0.2j-2.2 openssl >= 1.0.2j-2.2	Patchnames: openSUSE Leap 42.2 GA libopenssl-devel
openSUSE Leap 42.3	libopenssl-devel >= 1.0.2j-7.3 libopenssl1_0_0 >= 1.0.2j-7.3 libopenssl1_0_0-32bit >= 1.0.2j-7.3 openssl >= 1.0.2j-7.3	Patchnames: openSUSE Leap 42.3 GA libopenssl-devel
openSUSE Tumbleweed	libopenssl-devel >= 1.0.2j-2.2 libopenssl-devel-32bit >= 1.0.2j-2.2 libopenssl1_0_0 >= 1.0.2j-2.2 libopenssl1_0_0-32bit >= 1.0.2j-2.2 libopenssl1_0_0-hmac >= 1.0.2j-2.2 libopenssl1_0_0-hmac-32bit >= 1.0.2j-2.2 libopenssl1_0_0-steam >= 1.0.2h-4.1 libopenssl1_0_0-steam-32bit >= 1.0.2h-4.1 openssl >= 1.0.2j-2.2 openssl-doc >= 1.0.2j-2.2	Patchnames: openSUSE Tumbleweed GA libopenssl-devel openSUSE Tumbleweed GA libopenssl1_0_0-steam