CVE-2017-3730
Bad (EC)DHE parameters cause a client crash
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack.
Productos afectados
OpenSSL · OpenSSLPoCs públicas encontradas — 3
githubgithub.com/olivierh59500/CVE-2017-3730★ 0cve_referencewww.exploit-db.com/exploits/41192/no verificadoexploitdbwww.exploit-db.com/exploits/41192no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →Referencias
https://github.com/openssl/openssl/commit/efbe126e3ebb9123ac9d058aa2bb044261342aaahttps://security.gentoo.org/glsa/201702-07https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03838en_ushttps://www.exploit-db.com/exploits/41192/https://www.openssl.org/news/secadv/20170126.txthttps://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlhttp://www.securityfocus.com/bid/95812http://www.securitytracker.com/id/1037717