| Vulnerability Name: | CVE-2013-4550 (CCN-88725) | ||||||||
| Assigned: | 2013-11-08 | ||||||||
| Published: | 2013-11-08 | ||||||||
| Updated: | 2014-01-04 | ||||||||
| Summary: | Bip before 0.8.9, when running as a daemon, writes SSL handshake errors to an unexpected file descriptor that was previously associated with stderr before stderr has been closed, which allows remote attackers to write to other sockets and have an unspecified impact via a failed SSL handshake, a different vulnerability than CVE-2011-5268. Note: some sources originally mapped this CVE to two different types of issues; this CVE has since been SPLIT, producing CVE-2011-5268. | ||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
| ||||||||
| CVSS v2 Severity: | 5.1 Medium (CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P) 3.8 Low (Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-310 | ||||||||
| Vulnerability Consequences: | Denial of Service | ||||||||
| References: | Source: MITRE Type: CNA CVE-2013-4550 Source: FEDORA Type: Patch FEDORA-2013-21006 Source: FEDORA Type: UNKNOWN FEDORA-2013-21060 Source: FEDORA Type: UNKNOWN FEDORA-2013-21018 Source: CCN Type: oss-sec Mailing List, Fri, 08 Nov 2013 12:26:02 -0700 Re: CVE Request: bip denial of service via resource leak Source: CCN Type: SA55525 Bip Failed SSL Handshakes Handling Denial of Service Vulnerability Source: MLIST Type: UNKNOWN [oss-security] 20140102 Re: Duplicated CVE assignment for bip Source: CCN Type: BID-63639 BIP SSL Handshake Remote Denial of Service Vulnerability Source: XF Type: UNKNOWN bip-cve20134550-dos(88725) Source: CCN Type: Bip Web Site Bip Source: CCN Type: Bip Repository Web Site Failed SSL handshake causes bip to write to a random socket, and never close the connection Source: CONFIRM Type: UNKNOWN https://projects.duckcorp.org/issues/261 Source: CONFIRM Type: UNKNOWN https://projects.duckcorp.org/versions/13 Source: CCN Type: WhiteSource Vulnerability Database CVE-2013-4550 | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||