PT-2014-1697 · Openssl+7 · Openssl+7
Published
2014-08-06
·
Updated
2024-06-15
·
CVE-2014-3506
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
OpenSSL versions 0.9.8 through 0.9.8zb
OpenSSL versions 1.0.0 through 1.0.0n
OpenSSL versions 1.0.1 through 1.0.1i
Description
The issue allows remote attackers to cause a denial of service due to excessive memory consumption. This is achieved through specially crafted DTLS handshake messages that trigger memory allocations for large length values. The estimated number of potentially affected devices worldwide is not provided. There is no information about real-world incidents where this issue was exploited.
Recommendations
For OpenSSL versions 0.9.8 through 0.9.8zb, update to version 0.9.8zb or later.
For OpenSSL versions 1.0.0 through 1.0.0n, update to version 1.0.0n or later.
For OpenSSL versions 1.0.1 through 1.0.1i, update to version 1.0.1i or later.
As a temporary workaround, consider restricting the use of DTLS handshake messages to minimize the risk of exploitation.
Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Hp-Ux
Ibm Aix
Openssl
Red Hat
Suse
Ubuntu