This vulnerability (triggered by certain ASN.1 sequences which cause a large recursion) is only believed to be exploitable as a denial of service on the Windows platform at this time.
An SSL/TLS testing suite developed by the NISCC (UK National Infrastructure Security Co-Ordination Centre) uncovered ASN.1 parsing vulnerabilities in OpenSSL. Exploitation of these vulnerabilities may result in a denial of service.
After the release of ESA-20030916-023, the OpenSSH team discovered more buffer management bugs (fixed in OpenSSH 3.7.1) of the same type. Additionally, Solar Designer fixed additional bugs of this class. His fixes are included in this update.
To browse through our weekly Linux Advisory Watch newsletters,