Description
Off-by-one error in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 up to 0.9.7l, and 0.9.8 up to 0.9.8f, might allow remote attackers to execute arbitrary code via a crafted packet that triggers a one-byte buffer underflow. NOTE: this issue was introduced as a result of a fix for CVE-2006-3738. As of 20071012, it is unknown whether code execution is possible.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 0.9.8e-9 | — |
| Debian 13 | openssl | 0.9.8e-9 | — |
| Debian 12 | openssl | 0.9.8e-9 | — |
| Debian 4.0 | openssl | 0.9.8c-4etch1 | DSA-1379-1 |
| Debian 4.0 | openssl097 | 0.9.7k-3.1etch1 | DSA-1379-1 |
| Debian 3.1 | openssl | 0.9.7e-3sarge5 | DSA-1379-1 |
| Debian 3.1 | openssl096 | 0.9.6m-1sarge5 | DSA-1379-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | openssl +2 | 0.9.8b-8.3.el5_0.2 | RHSA-2007:0964 |
| RHEL 4 | openssl +2 | 0.9.7a-43.17.el4_6.1 | RHSA-2007:1003 |
| RHEL 3 | openssl +2 | 0.9.7a-33.24 | RHSA-2007:0813 |
| RHEL 2 | openssl +2 | 0.9.6b-48 | RHSA-2007:0813 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssl-1_0_0 | 1.0.2u-6.2 | openSUSE-SU-2024:11126-1 |
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1l-1.2 | openSUSE-SU-2024:11127-1 |
Advisories 6
- RHSA-2007:0964 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:1003 Red Hat Security Advisory: openssl security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0813 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1379-1 openssl - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11126-1 libopenssl-1_0_0-devel-1.0.2u-6.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11127-1 libopenssl-1_1-devel-1.1.1l-1.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- https://bugs.gentoo.org/show_bug.cgi?id=194039
- HPSBUX02292 vendor-advisory
- oval:org.mitre.oval:def:5337 vdb-entry signature
- 20071001 Re: OpenSSL SSL_get_shared_ciphers() off-by-one buffer overflow mailing-list
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0241
- 27205 third-party-advisory
- 27097 third-party-advisory
- ADV-2008-2362 vdb-entry
- 1018755 vdb-entry
- 31489 third-party-advisory
- APPLE-SA-2008-07-31 vendor-advisory
- FEDORA-2007-725 vendor-advisory
- RHSA-2007:1003 vendor-advisory
- 29242 third-party-advisory
- MDKSA-2007:193 vendor-advisory
- https://issues.rpath.com/browse/RPL-1770
- 27186 third-party-advisory
- 27851 third-party-advisory
- ADV-2008-2268 vdb-entry
- 30124 third-party-advisory
- SUSE-SR:2008:005 vendor-advisory
- 27394 third-party-advisory
- [4.1] 011: SECURITY FIX: October 10, 2007 vendor-advisory
- 20071004 Re: OpenSSL SSL_get_shared_ciphers() off-by-one buffer overflow mailing-list
- oval:org.mitre.oval:def:10904 vdb-entry signature
- 20080108 VMSA-2008-0001 Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages mailing-list
- 31308 third-party-advisory
- 22130 third-party-advisory
- 27031 third-party-advisory
- [Security-announce] 20080107 VMSA-2008-0001 Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages mailing-list
- ADV-2007-3625 vdb-entry
- 20070927 OpenSSL SSL_get_shared_ciphers() off-by-one buffer overflow mailing-list
- FreeBSD-SA-07:08 vendor-advisory
- USN-522-1 vendor-advisory
- ADV-2008-2361 vdb-entry
- 27217 third-party-advisory
- 31467 third-party-advisory
- 27961 third-party-advisory
- RHSA-2007:0964 vendor-advisory
- 27870 third-party-advisory
- 25831 vdb-entry
- DSA-1379 vendor-advisory
- ADV-2007-4042 vdb-entry
- 20071003 FLEA-2007-0058-1 openssl openssl-scripts mailing-list
- 27330 third-party-advisory
- http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=4038
- 30161 third-party-advisory
- GLSA-200805-07 vendor-advisory
- http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=4037
- http://www.vmware.com/security/advisories/VMSA-2008-0013.html
- 28368 third-party-advisory
- https://issues.rpath.com/browse/RPL-1769
- 27012 third-party-advisory
- 3179 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-485.htm
- 27229 third-party-advisory
- 27051 third-party-advisory
- 31326 third-party-advisory
- 27078 third-party-advisory
- GLSA-200710-06 vendor-advisory