CVE-2010-0740 Null dereference in n/a
Remote attackers can crash OpenSSL via malformed TLS records, causing denial of service in applications using the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2010-0740?
CVE-2010-0740 is a medium-severity vulnerability in Openssl Openssl, published on 26 Mar 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The ssl3_get_record function in ssl/s3_pkt.c in OpenSSL 0.9.8f through 0.9.8m allows remote attackers to cause a denial of service (crash) via a malformed record in a TLS connection that triggers a NULL pointer dereference, related to the minor version number. NOTE: some of these details are obtained from third party information.
Weakness: CWE-20
Which versions are affected by CVE-2010-0740?
It affects 1 product.
Products include Openssl Openssl.
How do I fix CVE-2010-0740?
Upgrade to a fixed version.
Is CVE-2010-0740 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2010-0740 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Openssl Openssl
Sources
Also known as DEBIAN-CVE-2010-0740, GHSA-qr53-p9wq-vjrx.