Intrusion PreventionOpenSSL.AES-NI.Integer.Underflow
Description
This indicates an attack attempt against an Integer Underflow Vulnerability in OpenSSL.
The vulnerability is caused by an error when vulnerable application is handling a CBC ciphersuites on platforms that support the AES-NI instruction set. It allows a remote attacker to cause a denial-of-service condition via a crafted TLS Encrypted Handshake Message.
Affected Products
OpenSSL Project OpenSSL 1.0.0x prior to 1.0.0k
OpenSSL Project OpenSSL 1.0.1x prior to 1.0.0d
OpenSSL Project OpenSSL 0.9.8x prior to 0.9.8y
Impact
Denial of Service: Remote attackers can crash vulnerable systems.
Recommended Actions
Refer to the vendor's website for suggested workaround.
http://www.openssl.org/news/secadv_20130205.txt
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 35037 |
| Created | Apr 23, 2013 |
| Updated | May 04, 2022 |
| Risk |
|
| CVE ID | CVE-2012-2686 |
| Exploit Prediction Score | 18.33% |
| Default Action | drop |
| Active | |
| Affected OS | All |
| Affected App | Other |