DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
OpenSSL: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2014-08-06
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in OpenSSL ausnutzen, um einen Denial of Service Angriff durchzuführen, Informationen offenzulegen und eine Protokoll Downgrade Attacke durchzuführen.
01
beschreibt (9)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2014-5139US | medium4.3 | Exploit | ||
The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client applicat… | ||||
| CVE-2014-3512US | high7.5 | — | ||
Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i allow remote attackers to cause a denial of service (application crash) o… | ||||
| CVE-2014-3511US | medium4.3OT erhöht | — | ||
The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fr… | ||||
| CVE-2014-3510US | medium4.3 | — | ||
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS servers to cause a denial o… | ||||
| CVE-2014-3509US | medium6.8 | — | ||
Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used,… | ||||
| CVE-2014-3508US | medium4.3 | — | ||
The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure th… | ||||
| CVE-2014-3507US | medium5.0 | Exploit | ||
Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of servi… | ||||
| CVE-2014-3506US | medium5.0 | — | ||
d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory cons… | ||||
| CVE-2014-3505US | medium5.0 | — | ||
Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a d… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- IBM Security Advisory vom 2014-09-09external
- CentOS Errata and Security Advisory CESA-2014:1052 vom 2014-08-13external
- CentOS Errata and Security Advisory CESA-2014:1053 vom 2014-08-13external
- SUSE Security update for OpenSSL (9598)external
- SUSE Security update for openssl1 (9599)external
- NetBSD Security Advisory 2014-008 vom 2014-08-27external
- HP Security Bulletin HPSBUX03095 SSRT101674 rev.1 vom 2014-08-15external
- Oracle Linux Security Advisory ELSA-2019-4581 vom 2019-03-13external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan