PT-2014-1702 · Gentoo+7 · Gentoo Linux+7

Published 2014-08-06 · Updated 2024-06-15 · CVE-2014-3511

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 1.0.1j Gentoo Linux (affected versions not specified)

Description The issue allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue. This can be exploited remotely and may lead to a violation of confidentiality, integrity, and availability of protected information. The vulnerability is in the ssl23 get client hello function in s23 srvr.c.

Recommendations For OpenSSL versions prior to 1.0.1j, update to version 1.0.1j or later to resolve the issue. As a temporary workaround, consider restricting the use of TLS 1.0 until a patch is available. Avoid using the ssl23 get client hello function in s23 srvr.c until the issue is resolved.

Exploit

Fix

Related Identifiers

ALT-PU-2014-2312

BDU:2015-00652

BDU:2015-09775

CESA-2014_1052

CVE-2014-3511

DSA-2998-1

MGASA-2014-0325

OPENSUSE-SU-2024:10271-1

OPENSUSE-SU-2024:10309-1

OPENSUSE-SU-2024:10529-1

OPENSUSE-SU-2024:11127-1

RHSA-2014:1052

RHSA-2014:1054

RHSA-2014_1052

RHSA-2015:0126

RHSA-2015:0197

SUSE-FU-2022:0445-1

SUSE-RU-2015:0769-1

SUSE-SU-2015:0546-1

SUSE-SU-2015:1185-1

USN-2308-1

Affected Products

Alt Linux

Centos

Gentoo Linux

Ibm Aix

Openssl

Red Hat

Suse

Ubuntu

References · 280

• 🔥 https://github.com/mpgn/poodle-PoC · Exploit
• http://marc.info/?l=bugtraq&m=142660345230545&w=2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3505 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3509 · Security Note
• https://advisories.mageia.org/MGASA-2014-0325.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3511 · Security Note
• http://marc.info/?l=bugtraq&m=143290522027658&w=2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3512 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3511 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11127-1 · Vendor Advisory
• https://freebsd.org/security/advisories/FreeBSD-SA-14:18.openssl.asc · Vendor Advisory
• ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0325 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00650 · Security Note