CVE-2014-0160
mediumPriorität · handeln · 90OT-Risiko · kritischKEV · ausgenutztEPSS 1.000 · 100. PerzentilExploit · funktionalEUUShinzugefügt 2022-05-04beheben bis 2022-05-25
erforderliche Maßnahme Apply updates per vendor instructions.
EPSS · bewertet 2026-10-23
OpenSSL Information Disclosure Vulnerability
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.
- MitigationmGuardcisa_csaf_ot
All users of the affected mGuard firmware Versions 8.0.0 and 8.0.1 should upgrade to mGuard firmware Version 8.0.2. Innominate recommends users update SSL keys on the affected products after upgrade. The mGuard firmware Version 8.0.2 provides a combined function to replace both the HTTPS and SSH keys.
- MitigationAPE 2.0 (when SSL/TLS component is used in customer implementation)cisa_csaf_ot
S7-1500 V1.5. The update for S7-1500 V1.5 can be obtained here: (http://support.automation.siemens.com/WW/view/en/67295862/133100)
http://support.automation.siemens.com/WW/view/en/67295862/133100 - MitigationCP1543-1 (when FTPS active)cisa_csaf_ot
S7-1500 V1.5. The update for S7-1500 V1.5 can be obtained here: (http://support.automation.siemens.com/WW/view/en/67295862/133100)
http://support.automation.siemens.com/WW/view/en/67295862/133100 - MitigationS7-1500 (when HTTPS active)cisa_csaf_ot
S7-1500 V1.5. The update for S7-1500 V1.5 can be obtained here: (http://support.automation.siemens.com/WW/view/en/67295862/133100)
http://support.automation.siemens.com/WW/view/en/67295862/133100 - MitigationWinCC OA onlycisa_csaf_ot
S7-1500 V1.5. The update for S7-1500 V1.5 can be obtained here: (http://support.automation.siemens.com/WW/view/en/67295862/133100)
http://support.automation.siemens.com/WW/view/en/67295862/133100 - MitigationeLAN-8.2 eLAN (when RIP is used)cisa_csaf_ot
S7-1500 V1.5. The update for S7-1500 V1.5 can be obtained here: (http://support.automation.siemens.com/WW/view/en/67295862/133100)
http://support.automation.siemens.com/WW/view/en/67295862/133100 - Mitigationatvise scadacisa_csaf_ot
Certec has made the new OpenSSL (1.0.1g) libraries available to fix the Heartbleed bug in atvise. The DLLs and the installation instructions can be found on their web site at the following location: (http://www.atvise.com/en/component/phocadownload/category/2-products?download=181:patch-openssl)
http://www.atvise.com/en/component/phocadownload/category/2-products?download=181:patch-openssl - Mitigation650 seriescisa_csaf_ot
The ABB cybersecurity team has issued a Cyber Security Advisory and software maintenance Release 650 series Ver. 1.3.0.1, in order to provide adequate protection to ABB 650 series customers. ABB recommends that this maintenance release be applied, based on customers risk assessment and exposure of the system. For more information, please see the ABB Cyber Security Advisory on the ABB Cyber Security Alerts & Notifications web page at: (http://www.abb.com/cawp/abbzh254/2c9d1261d9fa1dcfc1257950002e4fbf.aspx)
http://www.abb.com/cawp/abbzh254/2c9d1261d9fa1dcfc1257950002e4fbf.aspx - MitigationConnectPortcisa_csaf_ot
Digi International published a Security Notice OpenSSL “Heartbleed” on April 14, 2014, updated on April 18, 2014, at the following URL: (http://www.digi.com/support/kbase/kbaseresultdetl?id=3564)
http://www.digi.com/support/kbase/kbaseresultdetl?id=3564 - MitigationDigi Embedded Linuxcisa_csaf_ot
Digi International published a Security Notice OpenSSL “Heartbleed” on April 14, 2014, updated on April 18, 2014, at the following URL: (http://www.digi.com/support/kbase/kbaseresultdetl?id=3564)
http://www.digi.com/support/kbase/kbaseresultdetl?id=3564 - MitigationDigi Embedded Yoctocisa_csaf_ot
Digi International published a Security Notice OpenSSL “Heartbleed” on April 14, 2014, updated on April 18, 2014, at the following URL: (http://www.digi.com/support/kbase/kbaseresultdetl?id=3564)
http://www.digi.com/support/kbase/kbaseresultdetl?id=3564 - MitigationWireless Vehicle Bus Adapter (WVA)cisa_csaf_ot
Digi International published a Security Notice OpenSSL “Heartbleed” on April 14, 2014, updated on April 18, 2014, at the following URL: (http://www.digi.com/support/kbase/kbaseresultdetl?id=3564)
http://www.digi.com/support/kbase/kbaseresultdetl?id=3564 - MitigationTableau Servercisa_csaf_ot
Schneider Electric Wonderware has issued Security Advisory “Tableau OpenSSL Vulnerability (LFSEC00000098),” available at (user registration required to access this site): (https://wdn.wonderware.com/sites/WDN/Pages/Security%20Central/CyberSecurityUpdates.aspx)
https://wdn.wonderware.com/sites/WDN/Pages/Security%20Central/CyberSecurityUpdates.aspx - MitigationANSI C based OPC UA SDKcisa_csaf_ot
Disable HTTPS transport by configuration in the C++ SDK (default)
- MitigationC++ based OPC UA SDKcisa_csaf_ot
Disable HTTPS transport by configuration in the C++ SDK (default)
- MitigationOpenSSLcisa_csaf_ot
Asset owners and operators should contact their product vendor to check for availability of updates.
- MitigationEKI-132x platform devicescisa_csaf_ot
Update to the latest version. (http://support.advantech.com.tw/Support/SearchResult.aspx?keyword=EKI-132*&searchtabs=Firmware)
http://support.advantech.com.tw/Support/SearchResult.aspx?keyword=EKI-132*&searchtabs=Firmware
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5–7.5
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
Exploits (80)
Öffentlicher Proof-of-Concept- und Exploit-Code.
- EDB-32745OpenSSL TLS Heartbeat Extension - 'Heartbleed' Memory Disclosurefunktional · exploit_db
- EDB-32791OpenSSL TLS Heartbeat Extension - 'Heartbleed' Information Leak (1)funktional · exploit_db
- EDB-32998OpenSSL TLS Heartbeat Extension - 'Heartbleed' Information Leak (2) (DTLS Support)funktional · exploit_db
- auxiliary/scanner/ssl/openssl_heartbleedOpenSSL Heartbeat (Heartbleed) Information Leakfunktional · metasploit
betroffene Produkte (84)
Betroffene Produkte und Versionsbereiche.
Advisories (9)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-14-105-02AInnominate mGuard OpenSSL HeartBleed Vulnerability2014-01-16icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
- ICSA-14-105-03BSiemens Industrial Products OpenSSL Heartbleed Vulnerability (Update B)2014-01-16icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
- ICSA-14-114-01Certec atvise scada OpenSSL Heartbleed Vulnerability2014-01-25icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
- ICSA-14-126-01AABB Relion 650 Series OpenSSL Vulnerability (Update A)2014-02-06icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
- ICSA-14-128-01Digi International OpenSSL Vulnerability2014-02-08icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
- ICSA-14-135-02Schneider Electric Wonderware Intelligence Security Patch for OpenSSL Vulnerability2014-02-15icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
- ICSA-14-135-04Unified Automation OPC SDK OpenSSL Vulnerability2014-02-15icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
- ICSA-14-135-05OpenSSL Vulnerability2014-02-15icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
- ICSA-15-344-01BAdvantech EKI Vulnerabilities (Update B)2015-09-12icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (391)
Externe Belege — Patches, Meldungen, Analysen.
- http://advisories.mageia.org/MGASA-2014-0165.htmlcnnvd
- http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/cnnvd
- http://cogentdatahub.com/ReleaseNotes.htmlcnnvd
- http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-119-01cnnvd
- http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=96db9023b881d7cd9f379b0c154650d6c108e9a3cnnvd
- http://heartbleed.com/cnnvd
- http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131221.htmlcnnvd
- http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131291.htmlcnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan