CVE-2003-0564

Description

Multiple vulnerabilities in multiple vendor implementations of the Secure/Multipurpose Internet Mail Extensions (S/MIME) protocol allow remote attackers to cause a denial of service and possibly execute arbitrary code via an S/MIME email message containing certain unexpected ASN.1 constructs, as demonstrated using the NISSC test suite.

5.0

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 35.37% Top 5%

Vendor Advisory redhat.com Vendor Advisory marc.info Vendor Advisory redhat.com Vendor Advisory marc.info Vendor Advisory mandriva.com Vendor Advisory sgi.com Vendor Advisory securityfocus.com Vendor Advisory gov.uk

Affected: n/a n/a

References

Link	Tags
http://www.redhat.com/support/errata/RHSA-2004-110.html	patch vendor advisory
http://marc.info/?l=bugtraq&m=109900315219363&w=2	vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11462	vdb entry signature
http://www.uniras.gov.uk/vuls/2003/006489/smime.htm	patch vendor advisory
http://www.securityfocus.com/bid/8981	vdb entry vendor advisory
http://www.redhat.com/support/errata/RHSA-2004-112.html	vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/13603	vdb entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A872	vdb entry signature
http://marc.info/?l=bugtraq&m=108448379429944&w=2	vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2004:021	vendor advisory
ftp://patches.sgi.com/support/free/security/advisories/20040402-01-U.asc	vendor advisory
http://www.kb.cert.org/vuls/id/428230	third party advisory us government resource
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A914	vdb entry signature

Frequently Asked Questions

What is the severity of CVE-2003-0564?: CVE-2003-0564 has been scored as a medium severity vulnerability.
How to fix CVE-2003-0564?: To fix CVE-2003-0564, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2003-0564 being actively exploited in the wild?: It is possible that CVE-2003-0564 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~35% probability that this vulnerability will be exploited by malicious actors in the next 30 days.