Description
OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | openssl +2 | 0.9.7a-33.4 | RHSA-2004:120 |
| RHEL 3 | openssl096b | 0.9.6b-16 | RHSA-2004:120 |
Advisories 2
- RHSA-2004:120 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-465 openssl - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 9899 vdb-entry
- ESA-20040317-003 vendor-advisory
- 20040317 Re: New OpenSSL releases fix denial of service attacks [17 March 2004] mailing-list
- RHSA-2004:121 vendor-advisory
- CLA-2004:834 vendor-advisory
- openssl-tls-dos(15509) vdb-entry
- http://www.uniras.gov.uk/vuls/2004/224012/index.htm
- FEDORA-2004-095 vendor-advisory
- 57524 vendor-advisory
- oval:org.mitre.oval:def:871 vdb-entry signature
- oval:org.mitre.oval:def:11755 vdb-entry signature
- VU#465542 third-party-advisory
- TA04-078A third-party-advisory
- GLSA-200403-03 vendor-advisory
- 11139 third-party-advisory
- RHSA-2004:120 vendor-advisory
- RHSA-2004:119 vendor-advisory
- oval:org.mitre.oval:def:902 vdb-entry signature
- RHSA-2004:139 vendor-advisory
- 2004-0012 vendor-advisory
- 20040508 [FLSA-2004:1395] Updated OpenSSL resolves security vulnerability mailing-list
- 20040317 Cisco OpenSSL Implementation Vulnerability vendor-advisory
- DSA-465 vendor-advisory