PT-2014-1692 · Openssl+4 · Openssl+4

Publicado 2014-10-15 · Atualizado 2024-06-15 · CVE-2014-3568

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 0.9.8zc OpenSSL versions prior to 1.0.0o OpenSSL versions prior to 1.0.1j

Description The issue allows remote attackers to bypass intended access restrictions via an SSL 3.0 handshake, related to files s23 clnt.c and s23 srvr.c. This is due to the improper enforcement of the no-ssl3 build option. The vulnerability can be exploited to bypass access restrictions.

Recommendations For versions prior to 0.9.8zc, update to version 0.9.8zc or later. For versions prior to 1.0.0o, update to version 1.0.0o or later. For versions prior to 1.0.1j, update to version 1.0.1j or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

ALT-PU-2014-2312

BDU:2015-00641

BDU:2015-09775

CVE-2014-3568

DLA-81-1

DSA-3053-1

HPSBUX03162

OPENSUSE-SU-2014_1331-1

OPENSUSE-SU-2016_0640-1

OPENSUSE-SU-2024:10271-1

OPENSUSE-SU-2024:10529-1

OPENSUSE-SU-2024:11127-1

SUSE-FU-2022:0445-1

SUSE-RU-2015:0769-1

SUSE-SU-2015:0182-2

SUSE-SU-2015:0543-1

SUSE-SU-2015:0545-1

SUSE-SU-2015:0545-2

SUSE-SU-2015:0546-1

SUSE-SU-2015:0578-1

SUSE-SU-2015:1182-1

SUSE-SU-2015:1182-2

SUSE-SU-2015:1183-1

SUSE-SU-2015:1184-1

SUSE-SU-2015:1184-2

SUSE-SU-2015:1185-1

SUSE-SU-403

Produtos afetados

Alt Linux

Hp-Ux

Openssl

Suse

Vmware Vcenter

Referências · 430

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/ssl_version.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/ssl_version.rb · Exploit
• 🔥 https://github.com/mpgn/poodle-PoC · Exploit
• 🔥 https://github.com/ssllabs/openssl-ccs-cve-2014-0224 · Exploit
• 🔥 https://github.com/secretnonempty/CVE-2014-0224 · Exploit
• 🔥 https://github.com/AbhishekGhosh/FREAK-Attack-CVE-2015-0204-Testing-Script · Exploit
• 🔥 https://github.com/ricedu/CVE-2014-0195 · Exploit
• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/openssl_ccs.rb · Nota
• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/ssl/dtls_fragment_overflow.rb · Nota
• https://github.com/Tripwire/OpenSSL-CCS-Inject-Test · Nota
• https://github.com/scottjpack/Freak-Scanner · Nota
• https://github.com/anthophilee/A2SV--SSL-VUL-Scan · Nota
• https://github.com/stdevel/poodle_protector · Nota
• https://bugzilla.suse.com/912293 · Nota
• https://suse.com/security/cve/CVE-2010-0742 · Nota