PT-2011-1149 · Openssl+2 · Openssl+2

Neel Mehta · Published 2011-02-08 · Updated 2024-06-15 · CVE-2011-0014

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenSSL versions 0.9.8h through 0.9.8q OpenSSL versions 1.0.0 through 1.0.0c OpenSSL versions prior to 1.0.0e

Description The issue allows remote attackers to cause a denial of service (crash) and possibly obtain sensitive information in applications that use OpenSSL, via a malformed ClientHello handshake message that triggers an out-of-bounds memory access. Exploitation of the vulnerabilities may lead to a violation of confidentiality, integrity, and availability of protected information and can be carried out remotely.

Recommendations For OpenSSL versions 0.9.8h through 0.9.8q, update to a version later than 0.9.8q. For OpenSSL versions 1.0.0 through 1.0.0c, update to a version later than 1.0.0c. For OpenSSL versions prior to 1.0.0e, update to version 1.0.0e or later.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-09418

CVE-2011-0014

DSA-2162-1

HPSBUX02689

OPENSUSE-SU-2024:10271-1

OPENSUSE-SU-2024:10529-1

OPENSUSE-SU-2024:11127-1

RHSA-2011:0677

RHSA-2011_0677

SUSE-FU-2022:0445-1

SUSE-SU-2015:1184-1

SUSE-SU-403

Affected Products

Hp-Ux

Openssl

Red Hat

References · 260

• https://security-tracker.debian.org/tracker/CVE-2011-0014 · Vendor Advisory
• http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2011-002.txt.asc · Vendor Advisory
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02794777 · Vendor Advisory
• http://secunia.com/advisories/43301 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-0014 · Vendor Advisory
• http://vupen.com/english/advisories/2011/0395 · Vendor Advisory
• http://ubuntu.com/usn/USN-1064-1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054007.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0014 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11127-1 · Vendor Advisory
• http://vupen.com/english/advisories/2011/0387 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=131042179515633&w=2 · Vendor Advisory
• http://vupen.com/english/advisories/2011/0361 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=130497251507577&w=2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0014 · Security Note