CVE-2014-3569

Description

The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 0.9.8zc, 1.0.0o, and 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshake to a no-ssl3 application with certain error handling. NOTE: this issue became relevant after the CVE-2014-3568 fix.

5.0

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 14.26% Top 10%

Vendor Advisory marc.info Vendor Advisory opensuse.org Vendor Advisory cisco.com Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory opensuse.org Vendor Advisory mandriva.com Vendor Advisory marc.info Vendor Advisory apple.com Vendor Advisory opensuse.org Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory mandriva.com Vendor Advisory marc.info Vendor Advisory debian.org

Affected: n/a n/a

References

Link	Tags
http://www.securityfocus.com/bid/71934	vdb entry
http://marc.info/?l=bugtraq&m=142895206924048&w=2	vendor advisory
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00021.html	vendor advisory
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150310-ssl	vendor advisory
http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-3569.html
http://marc.info/?l=bugtraq&m=144050155601375&w=2	vendor advisory
https://support.apple.com/HT204659
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
https://security-tracker.debian.org/tracker/CVE-2014-3569
http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
http://marc.info/?l=bugtraq&m=143748090628601&w=2	vendor advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888
http://www.securitytracker.com/id/1033378	vdb entry
http://marc.info/?l=bugtraq&m=142721102728110&w=2	vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html	vendor advisory
https://www.openssl.org/news/secadv_20150108.txt
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380
http://www.mandriva.com/security/advisories?name=MDVSA-2015:019	vendor advisory
http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10679
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=b82924741b4bd590da890619be671f4635e46c2b
http://marc.info/?l=bugtraq&m=142496289803847&w=2	vendor advisory
http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html	vendor advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10108
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=6ce9687b5aba5391fc0de50e18779eb676d0e04d
https://kc.mcafee.com/corporate/index?page=content&id=SB10102
http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00026.html	vendor advisory
http://marc.info/?l=bugtraq&m=144050297101809&w=2	vendor advisory
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
http://marc.info/?l=bugtraq&m=144050205101530&w=2	vendor advisory
http://marc.info/?l=bugtraq&m=142496179803395&w=2	vendor advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2015:062	vendor advisory
https://support.citrix.com/article/CTX216642
http://marc.info/?l=bugtraq&m=144050254401665&w=2	vendor advisory
http://rt.openssl.org/Ticket/Display.html?id=3571&user=guest&pass=guest
https://bto.bluecoat.com/security-advisory/sa88
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=392fa7a952e97d82eac6958c81ed1e256e6b8ca5
http://www.debian.org/security/2015/dsa-3125	vendor advisory

Frequently Asked Questions

What is the severity of CVE-2014-3569?: CVE-2014-3569 has been scored as a medium severity vulnerability.
How to fix CVE-2014-3569?: To fix CVE-2014-3569, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2014-3569 being actively exploited in the wild?: It is possible that CVE-2014-3569 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~14% probability that this vulnerability will be exploited by malicious actors in the next 30 days.