NULL pointer dereference in OpenSSL - CVE-2017-3730
Published: January 27, 2017 / Updated: September 14, 2018
Vulnerability identifier: #VU5440
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2017-3730
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vendor: OpenSSL Software Foundation
Affected software:
OpenSSL
OpenSSL
Detailed vulnerability description
The vulnerability allows a remote attacker to cause denial of service.
The vulnerability exists in OpenSSL due to NULL pointer dereference error when processing specially crafted parameters for a Diffie-Hellman Key Exchange (DHE) or Elliptic Curve Diffie-Hellman Exchange (ECDHE), received from malicious server. A remote attacker can trick the victim into connecting to a specially crafted website and trigger NULL pointer dereference error in client software.
Successful exploitation of the vulnerability may allow an attacker to perform denial of service (DoS) attack against vulnerable client software.
How to mitigate CVE-2017-3730
Update OpenSSL to version 1.1.0d.