Executive Summary
Summary | |
---|---|
Title | openssl security update |
Informations | |||
---|---|---|---|
Name | DSA-2998 | First vendor Publication | 2014-08-07 |
Vendor | Debian | Last vendor Modification | 2014-08-07 |
Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 7.5 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Multiple vulnerabilities have been identified in OpenSSL, a Secure Sockets Layer toolkit, that may result in denial of service (application crash, large memory consumption), information leak, protocol downgrade. Additionally, a buffer overrun affecting only applications explicitly set up for SRP has been fixed (CVE-2014-3512). Detailed descriptions of the vulnerabilities can be found at: https://www.openssl.org/news/secadv_20140806.txt It's important that you upgrade the libssl1.0.0 package and not just the openssl package. All applications linked to openssl need to be restarted. You can use the "checkrestart" tool from the debian-goodies package to detect affected programs. Alternatively, you may reboot your system. For the stable distribution (wheezy), these problems have been fixed in version 1.0.1e-2+deb7u12. For the testing distribution (jessie), these problems will be fixed soon. For the unstable distribution (sid), these problems have been fixed in version 1.0.1i-1. We recommend that you upgrade your openssl packages. |
Original Source
Url : http://www.debian.org/security/2014/dsa-2998 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
40 % | CWE-399 | Resource Management Errors |
20 % | CWE-362 | Race Condition |
20 % | CWE-200 | Information Exposure |
20 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:25950 | |||
Oval ID: | oval:org.mitre.oval:def:25950 | ||
Title: | Vulnerability in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, allows remote DTLS servers to cause a denial of service (NULL pointer dereference and client application crash) | ||
Description: | The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS servers to cause a denial of service (NULL pointer dereference and client application crash) via a crafted handshake message in conjunction with a (1) anonymous DH or (2) anonymous ECDH ciphersuite. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2014-3510 | Version: | 3 |
Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows 7 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2 | Product(s): | OpenSSL |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:25965 | |||
Oval ID: | oval:org.mitre.oval:def:25965 | ||
Title: | Vulnerability in OpenSSL 1.0.1 before 1.0.1i, allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact | ||
Description: | Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid SRP (1) g, (2) A, or (3) B parameter. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2014-3512 | Version: | 3 |
Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows 7 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2 | Product(s): | OpenSSL |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:25983 | |||
Oval ID: | oval:org.mitre.oval:def:25983 | ||
Title: | AIX OpenSSL Denial of Service due to NULL pointer dereference | ||
Description: | The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client application crash) via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite with the client. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2014-5139 | Version: | 4 |
Platform(s): | IBM AIX 6.1 IBM AIX 7.1 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26147 | |||
Oval ID: | oval:org.mitre.oval:def:26147 | ||
Title: | Vulnerability in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data | ||
Description: | Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2014-3509 | Version: | 3 |
Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows 7 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2 | Product(s): | OpenSSL |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26169 | |||
Oval ID: | oval:org.mitre.oval:def:26169 | ||
Title: | AIX OpenSSL Denial of Service due to NULL pointer dereference | ||
Description: | The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS servers to cause a denial of service (NULL pointer dereference and client application crash) via a crafted handshake message in conjunction with a (1) anonymous DH or (2) anonymous ECDH ciphersuite. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2014-3510 | Version: | 4 |
Platform(s): | IBM AIX 6.1 IBM AIX 7.1 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26274 | |||
Oval ID: | oval:org.mitre.oval:def:26274 | ||
Title: | Vulnerability in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, allows context-dependent attackers to obtain sensitive information from process stack memory | ||
Description: | The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of '\0' characters, which allows context-dependent attackers to obtain sensitive information from process stack memory by reading output from X509_name_oneline, X509_name_print_ex, and unspecified other functions. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2014-3508 | Version: | 3 |
Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows 7 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2 | Product(s): | OpenSSL |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26293 | |||
Oval ID: | oval:org.mitre.oval:def:26293 | ||
Title: | Vulnerability in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, allows remote attackers to cause a denial of service (CVE-2014-3507) | ||
Description: | Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via zero-length DTLS fragments that trigger improper handling of the return value of a certain insert function. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2014-3507 | Version: | 3 |
Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows 7 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2 | Product(s): | OpenSSL |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26315 | |||
Oval ID: | oval:org.mitre.oval:def:26315 | ||
Title: | RHSA-2014:1053: openssl security update (Moderate) | ||
Description: | OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL), Transport Layer Security (TLS), and Datagram Transport Layer Security (DTLS) protocols, as well as a full-strength, general purpose cryptography library. It was discovered that the OBJ_obj2txt() function could fail to properly NUL-terminate its output. This could possibly cause an application using OpenSSL functions to format fields of X.509 certificates to disclose portions of its memory. (CVE-2014-3508) Multiple flaws were discovered in the way OpenSSL handled DTLS packets. A remote attacker could use these flaws to cause a DTLS server or client using OpenSSL to crash or use excessive amounts of memory. (CVE-2014-0221, CVE-2014-3505, CVE-2014-3506) A NULL pointer dereference flaw was found in the way OpenSSL performed a handshake when using the anonymous Diffie-Hellman (DH) key exchange. A malicious server could cause a DTLS client using OpenSSL to crash if that client had anonymous DH cipher suites enabled. (CVE-2014-3510) Red Hat would like to thank the OpenSSL project for reporting CVE-2014-0221. Upstream acknowledges Imre Rad of Search-Lab as the original reporter of this issue. All OpenSSL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. For the update to take effect, all services linked to the OpenSSL library (such as httpd and other SSL-enabled services) must be restarted or the system rebooted. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2014:1053-00 CESA-2014:1053 CVE-2014-0221 CVE-2014-3505 CVE-2014-3506 CVE-2014-3508 CVE-2014-3510 | Version: | 3 |
Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | openssl |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26324 | |||
Oval ID: | oval:org.mitre.oval:def:26324 | ||
Title: | Vulnerability in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, allows remote attackers to cause a denial of service (CVE-2014-3506) | ||
Description: | d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via crafted DTLS handshake messages that trigger memory allocations corresponding to large length values. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2014-3506 | Version: | 3 |
Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows 7 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2 | Product(s): | OpenSSL |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26329 | |||
Oval ID: | oval:org.mitre.oval:def:26329 | ||
Title: | AIX OpenSSL Denial of Service due to invalid SRP (1)g, (2)A or (3)B parameter | ||
Description: | Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid SRP (1) g, (2) A, or (3) B parameter. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2014-3512 | Version: | 4 |
Platform(s): | IBM AIX 6.1 IBM AIX 7.1 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26342 | |||
Oval ID: | oval:org.mitre.oval:def:26342 | ||
Title: | Vulnerability in OpenSSL 1.0.1 before 1.0.1i, allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue | ||
Description: | The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2014-3511 | Version: | 3 |
Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows 7 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2 | Product(s): | OpenSSL |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26347 | |||
Oval ID: | oval:org.mitre.oval:def:26347 | ||
Title: | AIX OpenSSL Man-in-the-Middle attack related to protocol downgrade issue | ||
Description: | The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2014-3511 | Version: | 4 |
Platform(s): | IBM AIX 6.1 IBM AIX 7.1 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26351 | |||
Oval ID: | oval:org.mitre.oval:def:26351 | ||
Title: | DSA-2998-1 openssl - security update | ||
Description: | Multiple vulnerabilities have been identified in OpenSSL, a Secure Sockets Layer toolkit, that may result in denial of service (application crash, large memory consumption), information leak, protocol downgrade. Additionally, a buffer overrun affecting only applications explicitly set up for SRP has been fixed (<a href="https://security-tracker.debian.org/tracker/CVE-2014-3512">CVE-2014-3512</a>). | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-2998-1 CVE-2014-3505 CVE-2014-3506 CVE-2014-3507 CVE-2014-3508 CVE-2014-3509 CVE-2014-3510 CVE-2014-3511 CVE-2014-3512 CVE-2014-5139 | Version: | 3 |
Platform(s): | Debian GNU/Linux 7.0 Debian GNU/kFreeBSD 7.0 | Product(s): | openssl |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26369 | |||
Oval ID: | oval:org.mitre.oval:def:26369 | ||
Title: | Vulnerability in OpenSSL 1.0.1 before 1.0.1i, allows remote SSL servers to cause a denial of service | ||
Description: | The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client application crash) via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite with the client. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2014-5139 | Version: | 3 |
Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows 7 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2 | Product(s): | OpenSSL |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26381 | |||
Oval ID: | oval:org.mitre.oval:def:26381 | ||
Title: | USN-2308-1 -- openssl vulnerabilities | ||
Description: | Several security issues were fixed in OpenSSL. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-2308-1 CVE-2014-3505 CVE-2014-3506 CVE-2014-3507 CVE-2014-3508 CVE-2014-3509 CVE-2014-3510 CVE-2014-3511 CVE-2014-3512 CVE-2014-5139 | Version: | 3 |
Platform(s): | Ubuntu 14.04 Ubuntu 12.04 Ubuntu 10.04 | Product(s): | openssl |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26426 | |||
Oval ID: | oval:org.mitre.oval:def:26426 | ||
Title: | RHSA-2014:1052: openssl security update (Moderate) | ||
Description: | OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL), Transport Layer Security (TLS), and Datagram Transport Layer Security (DTLS) protocols, as well as a full-strength, general purpose cryptography library. A race condition was found in the way OpenSSL handled ServerHello messages with an included Supported EC Point Format extension. A malicious server could possibly use this flaw to cause a multi-threaded TLS/SSL client using OpenSSL to write into freed memory, causing the client to crash or execute arbitrary code. (CVE-2014-3509) It was discovered that the OBJ_obj2txt() function could fail to properly NUL-terminate its output. This could possibly cause an application using OpenSSL functions to format fields of X.509 certificates to disclose portions of its memory. (CVE-2014-3508) A flaw was found in the way OpenSSL handled fragmented handshake packets. A man-in-the-middle attacker could use this flaw to force a TLS/SSL server using OpenSSL to use TLS 1.0, even if both the client and the server supported newer protocol versions. (CVE-2014-3511) Multiple flaws were discovered in the way OpenSSL handled DTLS packets. A remote attacker could use these flaws to cause a DTLS server or client using OpenSSL to crash or use excessive amounts of memory. (CVE-2014-3505, CVE-2014-3506, CVE-2014-3507) A NULL pointer dereference flaw was found in the way OpenSSL performed a handshake when using the anonymous Diffie-Hellman (DH) key exchange. A malicious server could cause a DTLS client using OpenSSL to crash if that client had anonymous DH cipher suites enabled. (CVE-2014-3510) All OpenSSL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. For the update to take effect, all services linked to the OpenSSL library (such as httpd and other SSL-enabled services) must be restarted or the system rebooted. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2014:1052-00 CESA-2014:1052 CVE-2014-3505 CVE-2014-3506 CVE-2014-3507 CVE-2014-3508 CVE-2014-3509 CVE-2014-3510 CVE-2014-3511 | Version: | 3 |
Platform(s): | Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 CentOS Linux 6 CentOS Linux 7 | Product(s): | openssl |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26491 | |||
Oval ID: | oval:org.mitre.oval:def:26491 | ||
Title: | Vulnerability in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, allows remote attackers to cause a denial of service (application crash) via crafted DTLS packets that trigger an error condition | ||
Description: | Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (application crash) via crafted DTLS packets that trigger an error condition. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2014-3505 | Version: | 3 |
Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows 7 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2 | Product(s): | OpenSSL |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26542 | |||
Oval ID: | oval:org.mitre.oval:def:26542 | ||
Title: | AIX OpenSSL allows attackers to obtain sensitive information | ||
Description: | The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of '\0' characters, which allows context-dependent attackers to obtain sensitive information from process stack memory by reading output from X509_name_oneline, X509_name_print_ex, and unspecified other functions. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2014-3508 | Version: | 4 |
Platform(s): | IBM AIX 6.1 IBM AIX 7.1 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26562 | |||
Oval ID: | oval:org.mitre.oval:def:26562 | ||
Title: | SUSE-SU-2014:1049-1 -- Security update for OpenSSL | ||
Description: | This OpenSSL update fixes the several security issue. | ||
Family: | unix | Class: | patch |
Reference(s): | SUSE-SU-2014:1049-1 CVE-2014-3508 CVE-2014-3505 CVE-2014-3506 CVE-2014-3507 CVE-2014-3510 | Version: | 3 |
Platform(s): | SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Desktop 11 | Product(s): | OpenSSL |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26622 | |||
Oval ID: | oval:org.mitre.oval:def:26622 | ||
Title: | AIX OpenSSL Denial of Service due to double free | ||
Description: | Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (application crash) via crafted DTLS packets that trigger an error condition. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2014-3505 | Version: | 4 |
Platform(s): | IBM AIX 6.1 IBM AIX 7.1 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26740 | |||
Oval ID: | oval:org.mitre.oval:def:26740 | ||
Title: | AIX OpenSSL Denial of Service due to memory allocation of large length values | ||
Description: | d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via crafted DTLS handshake messages that trigger memory allocations corresponding to large length values. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2014-3506 | Version: | 4 |
Platform(s): | IBM AIX 6.1 IBM AIX 7.1 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26781 | |||
Oval ID: | oval:org.mitre.oval:def:26781 | ||
Title: | DEPRECATED: SUSE-SU-2014:1049-1 -- Security update for OpenSSL | ||
Description: | This OpenSSL update fixes the several security issue. | ||
Family: | unix | Class: | patch |
Reference(s): | SUSE-SU-2014:1049-1 CVE-2014-3508 CVE-2014-3505 CVE-2014-3506 CVE-2014-3507 CVE-2014-3510 | Version: | 4 |
Platform(s): | SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Desktop 11 | Product(s): | OpenSSL |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26802 | |||
Oval ID: | oval:org.mitre.oval:def:26802 | ||
Title: | AIX OpenSSL Denial of Service due to improper handling of the return value | ||
Description: | Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via zero-length DTLS fragments that trigger improper handling of the return value of a certain insert function. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2014-3507 | Version: | 4 |
Platform(s): | IBM AIX 6.1 IBM AIX 7.1 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26904 | |||
Oval ID: | oval:org.mitre.oval:def:26904 | ||
Title: | AIX OpenSSL Denial of Service due to memory overwrite | ||
Description: | Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2014-3509 | Version: | 4 |
Platform(s): | IBM AIX 6.1 IBM AIX 7.1 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26954 | |||
Oval ID: | oval:org.mitre.oval:def:26954 | ||
Title: | ELSA-2014-1053 -- openssl security update (moderate) | ||
Description: | [0.9.8e-27.4] - fix CVE-2014-0221 - recursion in DTLS code leading to DoS - fix CVE-2014-3505 - doublefree in DTLS packet processing - fix CVE-2014-3506 - avoid memory exhaustion in DTLS - fix CVE-2014-3508 - fix OID handling to avoid information leak - fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling in DTLS | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2014-1053 CVE-2014-0221 CVE-2014-3505 CVE-2014-3506 CVE-2014-3508 CVE-2014-3510 | Version: | 3 |
Platform(s): | Oracle Linux 5 | Product(s): | openssl |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:27233 | |||
Oval ID: | oval:org.mitre.oval:def:27233 | ||
Title: | ELSA-2014-1052 -- openssl security update (moderate) | ||
Description: | [1.0.1e-34.4] - fix CVE-2014-3505 - doublefree in DTLS packet processing - fix CVE-2014-3506 - avoid memory exhaustion in DTLS - fix CVE-2014-3507 - avoid memory leak in DTLS - fix CVE-2014-3508 - fix OID handling to avoid information leak - fix CVE-2014-3509 - fix race condition when parsing server hello - fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling in DTLS - fix CVE-2014-3511 - disallow protocol downgrade via fragmentation | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2014-1052 CVE-2014-3505 CVE-2014-3506 CVE-2014-3507 CVE-2014-3508 CVE-2014-3509 CVE-2014-3510 CVE-2014-3511 | Version: | 5 |
Platform(s): | Oracle Linux 6 Oracle Linux 7 | Product(s): | openssl |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
Information Assurance Vulnerability Management (IAVM)
Date | Description |
---|---|
2015-01-22 | IAVM : 2015-B-0007 - Multiple Vulnerabilities in Juniper Secure Analytics (JSA) and Security Threa... Severity : Category I - VMSKEY : V0058213 |
Snort® IPS/IDS
Date | Description |
---|---|
2019-09-24 | OpenSSL DTLS zero-length fragments denial of service attempt RuleID : 51215 - Revision : 1 - Type : SERVER-OTHER |
2019-09-24 | OpenSSL DTLS bad fragment length denial of service attempt RuleID : 51214 - Revision : 2 - Type : SERVER-OTHER |
2015-10-20 | OpenSSL DTLS handshake oversized fragment length denial of service attempt RuleID : 36096 - Revision : 2 - Type : SERVER-OTHER |
2015-03-24 | OpenSSL fragmented protocol downgrade attempt RuleID : 33561 - Revision : 2 - Type : SERVER-OTHER |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2016-03-04 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-294.nasl - Type : ACT_GATHER_INFO |
2015-09-01 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-0197.nasl - Type : ACT_GATHER_INFO |
2015-08-03 | Name : The remote web server is affected by multiple vulnerabilities. File : hpsmh_7_4_1.nasl - Type : ACT_GATHER_INFO |
2015-03-26 | Name : The remote Debian host is missing a security update. File : debian_DLA-33.nasl - Type : ACT_GATHER_INFO |
2015-03-12 | Name : The remote host has software installed that is affected by multiple vulnerabi... File : ibm_rational_clearquest_8_0_1_6.nasl - Type : ACT_GATHER_INFO |
2015-03-05 | Name : The remote Apache Tomcat server is affected by multiple vulnerabilities. File : tomcat_8_0_15.nasl - Type : ACT_GATHER_INFO |
2015-03-05 | Name : The remote Apache Tomcat server is affected by multiple vulnerabilities. File : tomcat_7_0_57.nasl - Type : ACT_GATHER_INFO |
2015-03-05 | Name : The remote Apache Tomcat server is affected by multiple vulnerabilities. File : tomcat_6_0_43.nasl - Type : ACT_GATHER_INFO |
2015-02-06 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2015-0126.nasl - Type : ACT_GATHER_INFO |
2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_openssl_20141014_2.nasl - Type : ACT_GATHER_INFO |
2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_openssl_20140915.nasl - Type : ACT_GATHER_INFO |
2015-01-02 | Name : The remote Fedora host is missing a security update. File : fedora_2014-17587.nasl - Type : ACT_GATHER_INFO |
2015-01-02 | Name : The remote Fedora host is missing a security update. File : fedora_2014-17576.nasl - Type : ACT_GATHER_INFO |
2014-12-26 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201412-39.nasl - Type : ACT_GATHER_INFO |
2014-12-05 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_compat-openssl097g-141202.nasl - Type : ACT_GATHER_INFO |
2014-12-04 | Name : The remote web server contains an application that is affected by multiple vu... File : splunk_614.nasl - Type : ACT_GATHER_INFO |
2014-12-04 | Name : The remote web server contains an application that is affected by multiple vu... File : splunk_606.nasl - Type : ACT_GATHER_INFO |
2014-11-26 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2014-0040.nasl - Type : ACT_GATHER_INFO |
2014-11-26 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2014-0039.nasl - Type : ACT_GATHER_INFO |
2014-11-26 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2014-0032.nasl - Type : ACT_GATHER_INFO |
2014-11-26 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2014-0012.nasl - Type : ACT_GATHER_INFO |
2014-11-12 | Name : The remote host has an application installed that is affected by multiple vul... File : vmware_vcenter_converter_2014-0010.nasl - Type : ACT_GATHER_INFO |
2014-11-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-1054.nasl - Type : ACT_GATHER_INFO |
2014-10-14 | Name : The remote device is missing a vendor-supplied security patch. File : juniper_jsa10649.nasl - Type : ACT_GATHER_INFO |
2014-10-12 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2014-391.nasl - Type : ACT_GATHER_INFO |
2014-10-10 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL15568.nasl - Type : ACT_GATHER_INFO |
2014-10-10 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL15564.nasl - Type : ACT_GATHER_INFO |
2014-10-07 | Name : The remote Windows host has an application installed that is affected by mult... File : winscp_5_5_5.nasl - Type : ACT_GATHER_INFO |
2014-09-10 | Name : The remote AIX host has a version of OpenSSL installed that is affected by mu... File : aix_openssl_advisory10.nasl - Type : ACT_GATHER_INFO |
2014-08-22 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-509.nasl - Type : ACT_GATHER_INFO |
2014-08-21 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_libopenssl-devel-140812.nasl - Type : ACT_GATHER_INFO |
2014-08-15 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20140813_openssl_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2014-08-15 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20140813_openssl_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2014-08-14 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-1052.nasl - Type : ACT_GATHER_INFO |
2014-08-14 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-1052.nasl - Type : ACT_GATHER_INFO |
2014-08-14 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-1053.nasl - Type : ACT_GATHER_INFO |
2014-08-14 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-1053.nasl - Type : ACT_GATHER_INFO |
2014-08-14 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-1052.nasl - Type : ACT_GATHER_INFO |
2014-08-14 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-1053.nasl - Type : ACT_GATHER_INFO |
2014-08-13 | Name : The remote Windows host contains a program that is affected by multiple vulne... File : stunnel_5_03.nasl - Type : ACT_GATHER_INFO |
2014-08-10 | Name : The remote Fedora host is missing a security update. File : fedora_2014-9308.nasl - Type : ACT_GATHER_INFO |
2014-08-10 | Name : The remote Fedora host is missing a security update. File : fedora_2014-9301.nasl - Type : ACT_GATHER_INFO |
2014-08-09 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2014-158.nasl - Type : ACT_GATHER_INFO |
2014-08-09 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2014-220-01.nasl - Type : ACT_GATHER_INFO |
2014-08-08 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-2308-1.nasl - Type : ACT_GATHER_INFO |
2014-08-08 | Name : The remote service is affected by multiple vulnerabilities. File : openssl_1_0_1i.nasl - Type : ACT_GATHER_INFO |
2014-08-08 | Name : The remote service is affected by multiple vulnerabilities. File : openssl_1_0_0n.nasl - Type : ACT_GATHER_INFO |
2014-08-08 | Name : The remote service is affected by multiple vulnerabilities. File : openssl_0_9_8zb.nasl - Type : ACT_GATHER_INFO |
2014-08-07 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2998.nasl - Type : ACT_GATHER_INFO |
2014-08-07 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_8aff07eb1dbd11e4b6ba3c970e169bc2.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-08-14 21:31:27 |
|
2014-08-14 05:25:55 |
|
2014-08-08 13:24:50 |
|
2014-08-07 05:23:56 |
|