CVE:CVE-2005-0605
CNNVD:CNNVD-200503-036
OpenSSL是OpenSSL团队开发的一个开源的能够实现安全套接层（SSL v2/v3）和安全传输层（TLS v1）协议的通用加密库，它支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。
OpenSSL在处理SSL/TLS握手实现时存在问题，远程攻击者可以利用这个漏洞使OpenSSL崩溃。
使用Codenomicon TLS测试工具，OpenSSL发现在do_change_cipher_spec()函数中存在一个NULL指针分配。远程攻击者可以构建特殊的SSL/TLS握手，发送给使用OpenSSL库的服务器，可导致OpenSSL崩溃，依赖此库的应用程序会产生拒绝服务。
solution:Upgrade lesstif lesstif to a higher version than 0.93.94,and avoid the version 0.93.94; Upgrade sgi propack to a higher version than 3.0,and avoid the version 3.0; Upgrade x.org x11r6 to a higher version than 6.7.0,6.8,6.8.1,and avoid the version 6.7.0,6.8,6.8.1; Upgrade xfree86_project x11r6 to a higher version than 3.3,3.3.2,3.3.3,3.3.4,3.3.5,3.3.6,4.0,4.0.1,4.0.2.11,4.0.3,4.1.0,4.1.11,4.1.12,4.2.0,4.2.1,4.3.0,4.3.0.1,4.3.0.2,and avoid the version 3.3,3.3.2,3.3.3,3.3.4,3.3.5,3.3.6,4.0,4.0.1,4.0.2.11,4.0.3,4.1.0,4.1.11,4.1.12,4.2.0,4.2.1,4.3.0,4.3.0.1,4.3.0.2; Upgrade altlinux alt_linux to a higher version than 2.3,and avoid the version 2.3; Upgrade mandrakesoft mandrake_linux to a higher version than 10.0,10.1,10.2,and avoid the version 10.0,10.1,10.2; Upgrade mandrakesoft mandrake_linux_corporate_server to a higher version than 2.1,3.0,and avoid the version 2.1,3.0; Upgrade redhat enterprise_linux to a higher version than 3.0,4.0,and avoid the version 3.0,4.0; Upgrade redhat enterprise_linux_desktop to a higher version than 3.0,4.0,and avoid the version 3.0,4.0; Upgrade redhat fedora_core to a higher version than core_2.0,core_3.0,and avoid the version core_2.0,core_3.0; Upgrade suse suse_linux to a higher version than 6.1,6.1:alpha,6.2,6.3,6.3:alpha,6.4,6.4:alpha,7.0,7.0:alpha,7.1,7.1:alpha,7.2,7.3,8.0,8.1,8.2,9.0,9.1,9.2,and avoid the version 6.1,6.1:alpha,6.2,6.3,6.3:alpha,6.4,6.4:alpha,7.0,7.0:alpha,7.1,7.1:alpha,7.2,7.3,8.0,8.1,8.2,9.0,9.1,9.2