CVE-2013-0166 : OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for

OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause a denial of service (NULL pointer dereference and application crash) via an invalid key.

Published 2013-02-08 19:55:01

Updated 2018-08-09 01:29:01

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Memory CorruptionDenial of service

Exploit prediction scoring system (EPSS) score for CVE-2013-0166

Probability of exploitation activity in the next 30 days: 0.68%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 77 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2013-0166

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial

CWE ids for CVE-2013-0166

CWE-310

Assigned by: nvd@nist.gov (Primary)

References for CVE-2013-0166

https://bugzilla.redhat.com/show_bug.cgi?id=908052

908052 – (CVE-2013-0166) CVE-2013-0166 openssl: DoS due to improper handling of OCSP response verification
http://rhn.redhat.com/errata/RHSA-2013-0587.html

RHSA-2013:0587 - Security Advisory - Red Hat Customer Portal

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html

[security-announce] openSUSE-SU-2016:0640-1: important: Security update

CVEs referencing this url
http://marc.info/?l=bugtraq&m=137545771702053&w=2

'[security bulletin] HPSBUX02909 SSRT101289 rev.1 - HP-UX Apache Web Server, Remote Denial of Service' - MARC

CVEs referencing this url
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19360

Repository / Oval Repository
http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=66e8211c0b1347970096e04b18aa52567c325200

git.openssl.org Git - openssl.git/commit
http://www.kb.cert.org/vuls/id/737740

VU#737740 - Fiery Network Controllers for Xerox DocuColor 242/252/260 Printer/Copier use a vulnerable version of OpenSSL
US Government Resource

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2013-0783.html

RHSA-2013:0783 - Security Advisory - Red Hat Customer Portal

CVEs referencing this url
http://marc.info/?l=bugtraq&m=136432043316835&w=2

'[security bulletin] HPSBOV02852 SSRT101108 rev.1 - HP SSL for OpenVMS, Remote Denial of Service (DoS' - MARC

CVEs referencing this url
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c03883001

HPSBUX02909 SSRT101289 rev.1 - HP-UX Apache Web Server, Remote Denial of Service (DoS)

CVEs referencing this url
http://www.splunk.com/view/SP-CAAAHXG

Splunk 5.0.3 addresses multiple vulnerabilities - May 28, 2013 | Splunk

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html

[security-announce] SUSE-SU-2015:0578-1: important: Security update for

CVEs referencing this url
http://www.openssl.org/news/secadv_20130204.txt

/err404.html
Vendor Advisory

CVEs referencing this url
http://support.apple.com/kb/HT5880

About the security content of OS X Mountain Lion v10.8.5 and Security Update 2013-004 - Apple Support

CVEs referencing this url
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19487

Repository / Oval Repository
http://marc.info/?l=bugtraq&m=136396549913849&w=2

'[security bulletin] HPSBUX02856 SSRT101104 rev.1 - HP-UX Running OpenSSL, Remote Denial of Service (' - MARC

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2013-0833.html

RHSA-2013:0833 - Security Advisory - Red Hat Customer Portal

CVEs referencing this url
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19081

Repository / Oval Repository
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18754

Repository / Oval Repository
http://www.debian.org/security/2013/dsa-2621

Debian -- Security Information -- DSA-2621-1 openssl

CVEs referencing this url
http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=62e4506a7d4cec1c8e1ff687f6b220f6a62a57c7

git.openssl.org Git - openssl.git/commit
http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=ebc71865f0506a293242bd4aec97cdc7a8ef24b0

git.openssl.org Git - openssl.git/commit
http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html

Apple - Lists.apple.com

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2013-0782.html

Red Hat Customer Portal

CVEs referencing this url

Products affected by CVE-2013-0166

Redhat » Openssl » Version: 0.9.6b-3
cpe:2.3:a:redhat:openssl:0.9.6b-3:*:*:*:*:*:*:*
Matching versions
Redhat » Openssl » Version: 0.9.7a-2
cpe:2.3:a:redhat:openssl:0.9.7a-2:*:*:*:*:*:*:*
Matching versions
Redhat » Openssl » Version: 0.9.6-15
cpe:2.3:a:redhat:openssl:0.9.6-15:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.4
cpe:2.3:a:openssl:openssl:0.9.4:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.1c
cpe:2.3:a:openssl:openssl:0.9.1c:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.2b
cpe:2.3:a:openssl:openssl:0.9.2b:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.3
cpe:2.3:a:openssl:openssl:0.9.3:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.5
cpe:2.3:a:openssl:openssl:0.9.5:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.6
cpe:2.3:a:openssl:openssl:0.9.6:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.6a
cpe:2.3:a:openssl:openssl:0.9.6a:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.5a
cpe:2.3:a:openssl:openssl:0.9.5a:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.6c
cpe:2.3:a:openssl:openssl:0.9.6c:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.6d
cpe:2.3:a:openssl:openssl:0.9.6d:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.7 Update Beta1
cpe:2.3:a:openssl:openssl:0.9.7:beta1:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.7 Update Beta2
cpe:2.3:a:openssl:openssl:0.9.7:beta2:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.6b
cpe:2.3:a:openssl:openssl:0.9.6b:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.6e
cpe:2.3:a:openssl:openssl:0.9.6e:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.6h
cpe:2.3:a:openssl:openssl:0.9.6h:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.6i
cpe:2.3:a:openssl:openssl:0.9.6i:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.7
cpe:2.3:a:openssl:openssl:0.9.7:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.7a
cpe:2.3:a:openssl:openssl:0.9.7a:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.6g
cpe:2.3:a:openssl:openssl:0.9.6g:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.7 Update Beta3
cpe:2.3:a:openssl:openssl:0.9.7:beta3:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.6f
cpe:2.3:a:openssl:openssl:0.9.6f:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.7b
cpe:2.3:a:openssl:openssl:0.9.7b:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.6j
cpe:2.3:a:openssl:openssl:0.9.6j:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.6k
cpe:2.3:a:openssl:openssl:0.9.6k:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.7c
cpe:2.3:a:openssl:openssl:0.9.7c:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.7d
cpe:2.3:a:openssl:openssl:0.9.7d:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.6l
cpe:2.3:a:openssl:openssl:0.9.6l:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.6m
cpe:2.3:a:openssl:openssl:0.9.6m:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.6 Update Beta3
cpe:2.3:a:openssl:openssl:0.9.6:beta3:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.6a Update Beta1
cpe:2.3:a:openssl:openssl:0.9.6a:beta1:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.6a Update Beta2
cpe:2.3:a:openssl:openssl:0.9.6a:beta2:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.5 Update Beta1
cpe:2.3:a:openssl:openssl:0.9.5:beta1:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.5 Update Beta2
cpe:2.3:a:openssl:openssl:0.9.5:beta2:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.5a Update Beta1
cpe:2.3:a:openssl:openssl:0.9.5a:beta1:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.7e
cpe:2.3:a:openssl:openssl:0.9.7e:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.6 Update Beta2
cpe:2.3:a:openssl:openssl:0.9.6:beta2:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.6a Update Beta3
cpe:2.3:a:openssl:openssl:0.9.6a:beta3:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.7 Update Beta5
cpe:2.3:a:openssl:openssl:0.9.7:beta5:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.7f
cpe:2.3:a:openssl:openssl:0.9.7f:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.3a
cpe:2.3:a:openssl:openssl:0.9.3a:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.5a Update Beta2
cpe:2.3:a:openssl:openssl:0.9.5a:beta2:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.6 Update Beta1
cpe:2.3:a:openssl:openssl:0.9.6:beta1:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.7 Update Beta4
cpe:2.3:a:openssl:openssl:0.9.7:beta4:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.7 Update Beta6
cpe:2.3:a:openssl:openssl:0.9.7:beta6:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.7g
cpe:2.3:a:openssl:openssl:0.9.7g:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8
cpe:2.3:a:openssl:openssl:0.9.8:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.7i
cpe:2.3:a:openssl:openssl:0.9.7i:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.7j
cpe:2.3:a:openssl:openssl:0.9.7j:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.7k
cpe:2.3:a:openssl:openssl:0.9.7k:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8b
cpe:2.3:a:openssl:openssl:0.9.8b:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8c
cpe:2.3:a:openssl:openssl:0.9.8c:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8a
cpe:2.3:a:openssl:openssl:0.9.8a:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.7h
cpe:2.3:a:openssl:openssl:0.9.7h:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8q
cpe:2.3:a:openssl:openssl:0.9.8q:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8o
cpe:2.3:a:openssl:openssl:0.9.8o:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8k
cpe:2.3:a:openssl:openssl:0.9.8k:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8m Update Beta1
cpe:2.3:a:openssl:openssl:0.9.8m:beta1:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8i
cpe:2.3:a:openssl:openssl:0.9.8i:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8j
cpe:2.3:a:openssl:openssl:0.9.8j:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8e
cpe:2.3:a:openssl:openssl:0.9.8e:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8f
cpe:2.3:a:openssl:openssl:0.9.8f:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8l
cpe:2.3:a:openssl:openssl:0.9.8l:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.7l
cpe:2.3:a:openssl:openssl:0.9.7l:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.7m
cpe:2.3:a:openssl:openssl:0.9.7m:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8p
cpe:2.3:a:openssl:openssl:0.9.8p:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8n
cpe:2.3:a:openssl:openssl:0.9.8n:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8s
cpe:2.3:a:openssl:openssl:0.9.8s:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8d
cpe:2.3:a:openssl:openssl:0.9.8d:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8g
cpe:2.3:a:openssl:openssl:0.9.8g:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8h
cpe:2.3:a:openssl:openssl:0.9.8h:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8r
cpe:2.3:a:openssl:openssl:0.9.8r:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8m
cpe:2.3:a:openssl:openssl:0.9.8m:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.0
cpe:2.3:a:openssl:openssl:1.0.0:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.0a
cpe:2.3:a:openssl:openssl:1.0.0a:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.0b
cpe:2.3:a:openssl:openssl:1.0.0b:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.0g
cpe:2.3:a:openssl:openssl:1.0.0g:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.0f
cpe:2.3:a:openssl:openssl:1.0.0f:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.0e
cpe:2.3:a:openssl:openssl:1.0.0e:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8v
cpe:2.3:a:openssl:openssl:0.9.8v:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8w
cpe:2.3:a:openssl:openssl:0.9.8w:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1c
cpe:2.3:a:openssl:openssl:1.0.1c:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1b
cpe:2.3:a:openssl:openssl:1.0.1b:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.0j
cpe:2.3:a:openssl:openssl:1.0.0j:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8t
cpe:2.3:a:openssl:openssl:0.9.8t:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8u
cpe:2.3:a:openssl:openssl:0.9.8u:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1
cpe:2.3:a:openssl:openssl:1.0.1:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.0d
cpe:2.3:a:openssl:openssl:1.0.0d:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.0c
cpe:2.3:a:openssl:openssl:1.0.0c:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 0.9.8x
cpe:2.3:a:openssl:openssl:0.9.8x:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.1a
cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.0i
cpe:2.3:a:openssl:openssl:1.0.0i:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl » Version: 1.0.0h
cpe:2.3:a:openssl:openssl:1.0.0h:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2013-0166

Exploit prediction scoring system (EPSS) score for CVE-2013-0166

CVSS scores for CVE-2013-0166

CWE ids for CVE-2013-0166

References for CVE-2013-0166

Products affected by CVE-2013-0166