CVE-2014-0221

Description

The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.

4.3

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 79.86% Top 5%

Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory mandriva.com Vendor Advisory gentoo.org Vendor Advisory fedoraproject.org Vendor Advisory opensuse.org Vendor Advisory opensuse.org Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory mandriva.com Vendor Advisory redhat.com Vendor Advisory cisco.com Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory fedoraproject.org Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory mandriva.com Vendor Advisory marc.info Vendor Advisory openssl.org

Affected: n/a n/a

References

Link	Tags
http://secunia.com/advisories/59342	third party advisory not applicable
http://secunia.com/advisories/59669	third party advisory not applicable
http://www.novell.com/support/kb/doc.php?id=7015300	third party advisory
http://secunia.com/advisories/59990	third party advisory not applicable
http://www.securitytracker.com/id/1030337	vdb entry third party advisory broken link
http://secunia.com/advisories/59454	third party advisory not applicable
http://secunia.com/advisories/59126	third party advisory not applicable
http://www.novell.com/support/kb/doc.php?id=7015264	third party advisory
http://secunia.com/advisories/59306	third party advisory not applicable
http://www-01.ibm.com/support/docview.wss?uid=swg21678289	third party advisory
http://www.vmware.com/security/advisories/VMSA-2014-0012.html	third party advisory
http://marc.info/?l=bugtraq&m=140266410314613&w=2	mailing list third party advisory vendor advisory
http://secunia.com/advisories/61254	third party advisory not applicable
http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=6061&myns=phmc&mync=E	broken link
http://secunia.com/advisories/59895	third party advisory not applicable
http://secunia.com/advisories/59449	third party advisory not applicable
http://www-01.ibm.com/support/docview.wss?uid=isg400001843	third party advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946	third party advisory
http://marc.info/?l=bugtraq&m=140317760000786&w=2	mailing list third party advisory vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21676879	broken link
http://www-01.ibm.com/support/docview.wss?uid=swg21677828	third party advisory
http://secunia.com/advisories/59441	third party advisory not applicable
http://marc.info/?l=bugtraq&m=140621259019789&w=2	mailing list third party advisory vendor advisory
http://secunia.com/advisories/59189	third party advisory not applicable
http://www.mandriva.com/security/advisories?name=MDVSA-2014:106	vendor advisory broken link
http://secunia.com/advisories/59300	third party advisory not applicable
http://security.gentoo.org/glsa/glsa-201407-05.xml	third party advisory vendor advisory
http://secunia.com/advisories/59284	third party advisory not applicable
http://www.ibm.com/support/docview.wss?uid=swg24037783	third party advisory
http://secunia.com/advisories/59365	third party advisory not applicable
http://www-01.ibm.com/support/docview.wss?uid=swg21677695	third party advisory
http://www.securityfocus.com/archive/1/534161/100/0/threaded	mailing list vdb entry third party advisory
http://secunia.com/advisories/59495	third party advisory not applicable
http://www-01.ibm.com/support/docview.wss?uid=nas8N1020163	third party advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21676889	broken link
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html	mailing list third party advisory vendor advisory
http://secunia.com/advisories/58945	third party advisory not applicable
http://www-01.ibm.com/support/docview.wss?uid=isg400001841	third party advisory
http://secunia.com/advisories/59659	third party advisory not applicable
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html	mailing list third party advisory vendor advisory
http://secunia.com/advisories/59429	third party advisory not applicable
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html	third party advisory
http://secunia.com/advisories/59655	third party advisory not applicable
http://www-01.ibm.com/support/docview.wss?uid=swg21676071	third party advisory
http://secunia.com/advisories/59437	third party advisory not applicable
http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095754	broken link
http://www.vmware.com/security/advisories/VMSA-2014-0006.html	third party advisory
http://secunia.com/advisories/59310	third party advisory not applicable
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	third party advisory patch
http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc	third party advisory
http://www.fortiguard.com/advisory/FG-IR-14-018/	third party advisory
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html	mailing list third party advisory vendor advisory
http://www.ibm.com/support/docview.wss?uid=swg21676793	broken link
http://www.ibm.com/support/docview.wss?uid=swg21676356	third party advisory
http://marc.info/?l=bugtraq&m=140389274407904&w=2	mailing list third party advisory vendor advisory
http://support.citrix.com/article/CTX140876	third party advisory
http://secunia.com/advisories/59167	third party advisory not applicable
http://secunia.com/advisories/59120	third party advisory not applicable
http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095757	broken link
http://marc.info/?l=bugtraq&m=140499827729550&w=2	mailing list third party advisory vendor advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2014:105	vendor advisory broken link
http://secunia.com/advisories/59460	third party advisory not applicable
http://rhn.redhat.com/errata/RHSA-2014-1021.html	vendor advisory broken link
http://secunia.com/advisories/58939	third party advisory not applicable
http://secunia.com/advisories/59027	third party advisory not applicable
http://secunia.com/advisories/59514	third party advisory not applicable
http://www.ibm.com/support/docview.wss?uid=swg21676226	broken link
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140605-openssl	third party advisory vendor advisory
http://www.securityfocus.com/bid/67901	vdb entry third party advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10075	broken link
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html	third party advisory
http://secunia.com/advisories/59221	third party advisory not applicable
http://www-01.ibm.com/support/docview.wss?uid=swg21676419	third party advisory
http://secunia.com/advisories/58714	third party advisory not applicable
http://marc.info/?l=bugtraq&m=140482916501310&w=2	mailing list third party advisory vendor advisory
http://www.openssl.org/news/secadv_20140605.txt	vendor advisory
http://secunia.com/advisories/58615	third party advisory not applicable
http://seclists.org/fulldisclosure/2014/Dec/23	third party advisory mailing list
http://support.apple.com/kb/HT6443	third party advisory
http://secunia.com/advisories/59301	third party advisory not applicable
http://secunia.com/advisories/59784	third party advisory not applicable
https://kb.bluecoat.com/index?page=content&id=SA80	broken link
http://marc.info/?l=bugtraq&m=140904544427729&w=2	mailing list third party advisory vendor advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629	third party advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21678167	third party advisory
http://secunia.com/advisories/59192	third party advisory not applicable
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html	mailing list third party advisory vendor advisory
http://marc.info/?l=bugtraq&m=140752315422991&w=2	mailing list third party advisory vendor advisory
http://marc.info/?l=bugtraq&m=140389355508263&w=2	mailing list third party advisory vendor advisory
http://secunia.com/advisories/59175	third party advisory not applicable
http://marc.info/?l=bugtraq&m=140448122410568&w=2	mailing list third party advisory vendor advisory
http://secunia.com/advisories/59666	third party advisory not applicable
http://marc.info/?l=bugtraq&m=140431828824371&w=2	mailing list third party advisory vendor advisory
http://secunia.com/advisories/59413	third party advisory not applicable
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html	third party advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21675821	third party advisory
http://secunia.com/advisories/59721	third party advisory not applicable
http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095756	broken link
http://www-01.ibm.com/support/docview.wss?uid=swg21676062	third party advisory
http://secunia.com/advisories/58713	third party advisory not applicable
http://www-01.ibm.com/support/docview.wss?uid=swg21673137	broken link
http://www.mandriva.com/security/advisories?name=MDVSA-2015:062	vendor advisory broken link
http://www-01.ibm.com/support/docview.wss?uid=swg21676035	broken link
http://secunia.com/advisories/59450	third party advisory not applicable
http://linux.oracle.com/errata/ELSA-2014-1053.html	third party advisory
http://secunia.com/advisories/59287	third party advisory not applicable
http://www-01.ibm.com/support/docview.wss?uid=swg21683332	third party advisory
http://secunia.com/advisories/59491	third party advisory not applicable
http://secunia.com/advisories/59364	third party advisory not applicable
http://secunia.com/advisories/59451	third party advisory not applicable
http://secunia.com/advisories/58977	third party advisory not applicable
https://www.novell.com/support/kb/doc.php?id=7015271	third party advisory
http://secunia.com/advisories/60571	third party advisory not applicable
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=d3152655d5319ce883c8e3ac4b99f8de4c59d846
http://www.blackberry.com/btsc/KB36051	third party advisory
http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095755	broken link
http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm	third party advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21677527	broken link
http://secunia.com/advisories/60687	third party advisory not applicable
https://bugzilla.redhat.com/show_bug.cgi?id=1103593	issue tracking third party advisory patch
http://secunia.com/advisories/59528	third party advisory not applicable
http://secunia.com/advisories/58337	third party advisory not applicable
http://secunia.com/advisories/59518	third party advisory not applicable
http://secunia.com/advisories/59162	third party advisory not applicable
http://secunia.com/advisories/59490	third party advisory not applicable
http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=6060&myns=phmc&mync=E	broken link
http://marc.info/?l=bugtraq&m=140491231331543&w=2	mailing list third party advisory vendor advisory

Frequently Asked Questions

What is the severity of CVE-2014-0221?: CVE-2014-0221 has been scored as a medium severity vulnerability.
How to fix CVE-2014-0221?: To fix CVE-2014-0221, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2014-0221 being actively exploited in the wild?: It is possible that CVE-2014-0221 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~80% probability that this vulnerability will be exploited by malicious actors in the next 30 days.