PT-2014-1775 · Polarssl · Polarssl

Published 2014-07-22 · Updated 2015-12-04 · CVE-2014-4911

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions PolarSSL versions prior to 1.2.11 PolarSSL versions 1.3.x prior to 1.3.8

Description The issue allows remote attackers to cause a denial of service, potentially disrupting the availability of protected information. This can be achieved through vectors related to the GCM ciphersuites. The Codenomicon Defensics toolkit has been used to demonstrate this issue.

Recommendations For PolarSSL versions prior to 1.2.11, update to version 1.2.11 or later. For PolarSSL versions 1.3.x prior to 1.3.8, update to version 1.3.8 or later.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

BDU:2015-02149

CVE-2014-4911

DLA-36-1

DSA-2981-1

MGASA-2014-0315

Affected Products

Polarssl

References · 12

• https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-02 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-4911 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4911 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0315 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0315.html · Security Note
• https://debian.org/security/2014/dsa-2981 · Vendor Advisory
• http://debian.org/security/2014/dsa-2981 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02149 · Security Note
• http://secunia.com/advisories/60215 · Note
• https://bugs.mageia.org/show_bug.cgi?id=13764 · Note
• http://debian.org/security/dsa-2981 · Note
• https://polarssl.org/tech-updates/releases/polarssl-1.3.8-released · Note