CVE-2011-3210

The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages from clients, which allows remote attackers to cause a denial of service (daemon crash) via out-of-order messages that violate the TLS protocol.

Affected Software

Name	Vendor	Start Version	End Version
Openssl	Openssl	0.9.8 (including)	0.9.8 (including)
Openssl	Openssl	0.9.8a (including)	0.9.8a (including)
Openssl	Openssl	0.9.8b (including)	0.9.8b (including)
Openssl	Openssl	0.9.8c (including)	0.9.8c (including)
Openssl	Openssl	0.9.8d (including)	0.9.8d (including)
Openssl	Openssl	0.9.8e (including)	0.9.8e (including)
Openssl	Openssl	0.9.8f (including)	0.9.8f (including)
Openssl	Openssl	0.9.8g (including)	0.9.8g (including)
Openssl	Openssl	0.9.8h (including)	0.9.8h (including)
Openssl	Openssl	0.9.8i (including)	0.9.8i (including)
Openssl	Openssl	0.9.8j (including)	0.9.8j (including)
Openssl	Openssl	0.9.8k (including)	0.9.8k (including)
Openssl	Openssl	0.9.8l (including)	0.9.8l (including)
Openssl	Openssl	0.9.8m (including)	0.9.8m (including)
Openssl	Openssl	0.9.8n (including)	0.9.8n (including)
Openssl	Openssl	0.9.8o (including)	0.9.8o (including)
Openssl	Openssl	0.9.8p (including)	0.9.8p (including)
Openssl	Openssl	0.9.8q (including)	0.9.8q (including)
Openssl	Openssl	0.9.8r (including)	0.9.8r (including)
Openssl	Openssl	0.9.8s (including)	0.9.8s (including)
Openssl	Ubuntu	hardy	*
Openssl	Ubuntu	lucid	*
Openssl	Ubuntu	maverick	*
Openssl	Ubuntu	natty	*
Openssl	Ubuntu	upstream	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2011-3210
CWE	https://cwe.mitre.org/data/definitions/399.html

Affected Software

References