CVE-2010-3864

Advisory lineage Upstream: 0 Downstream: 7
Modified
Published: 17 Nov 2010, 15:00
Last modified:07 Aug 2024, 03:26

Vulnerability Summary

Overall Risk (default)
medium
31/100
CVSS Score
7.6 HIGH
v2.0 (nvd)
EPSS Score
4.82% LOW
5% probability -2.55%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

17 Nov 2010, 15:00
Published
Vulnerability first disclosed
07 Aug 2024, 03:26
Last Modified
Vulnerability information updated

Description

Multiple race conditions in ssl/t1_lib.c in OpenSSL 0.9.8f through 0.9.8o, 1.0.0, and 1.0.0a, when multi-threading and internal caching are enabled on a TLS server, might allow remote attackers to execute arbitrary code via client data that triggers a heap-based buffer overflow, related to (1) the TLS server name extension and (2) elliptic curve cryptography.

CVSS Metrics

  • v2.0•HIGH•Score: 7.6AV:N/AC:H/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 4.82%• Percentile: 90%

Techniques & Countermeasures

  • CWE-362•Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

    The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Affected Systems

  • Unknown•OpenSSL

    0.9.8f | 0.9.8g | 0.9.8h | 0.9.8i | 0.9.8j | 0.9.8k | 0.9.8l | 0.9.8m | 0.9.8n | 0.9.8o | 1.0.0 | 1.0.0a

References (39)