CVE-2004-0079

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-03-18 · updated 2026-06-16
Weakness: CWE-476

Description

The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference.

Affected products

4D Webstar: 4.0, 5.2, 5.2.1, 5.2.2, 5.2.3, 5.2.4 (+2)
macOS: 10.3.3
Apple Mac Os X Server: 10.3.3
Avaya Converged Communications Server: 2.0
Avaya Intuity Audix: 5.1.46, s3210, s3400
Avaya S8300: r2.0.0, r2.0.1
Avaya S8500: r2.0.0, r2.0.1
Avaya S8700: r2.0.0, r2.0.1
Avaya Sg200: 4.4, 4.31.29
Avaya Sg203: 4.4, 4.31.29
Avaya Sg208: 4.4
Avaya Sg5: 4.2, 4.3, 4.4
Avaya Vsu: 5, 5x, 100_r2.0.1, 500, 2000_r2.0.1, 5000_r2.0.1 (+2)
Bluecoat Cacheos Ca Sa: 4.1.10, 4.1.12
Bluecoat Proxysg: all versions
checkpoint Firewall-1: 2.0, next_generation_fp0, next_generation_fp1, next_generation_fp2
checkpoint Provider-1: 4.1, 4.1-sp1, 4.1-sp2, 4.1-sp3, 4.1-sp4
checkpoint Vpn-1: next_generation_fp0, next_generation_fp1, next_generation_fp2, vsx_ng_with_application_intelligence
Cisco Access Registrar: all versions
Cisco Application And Content Networking Software: all versions
Cisco Call Manager: all versions
Ciscoworks Common Management Foundation: 2.1
Ciscoworks Common Services: 2.2
Cisco Content Services Switch 11500: all versions
Cisco Css11000 Content Services Switch: all versions
Cisco Css Secure Content Accelerator: 1.0, 2.0
Cisco Firewall Services Module: 1.1.2, 1.1.3, 1.1_(3.005), 2.1_(0.208)
Cisco Gss 4480 Global Site Selector: all versions
Cisco Gss 4490 Global Site Selector: all versions
Cisco IOS: 12.1(11)e, 12.1(11b)e, 12.1(11b)e12, 12.1(11b)e14, 12.1(13)e9, 12.1(19)e1 (+4)

References

Get alerted when CVE-2004-0079 or the next vulnerability affects your stack