CVE-2014-5139

Description

The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client application crash) via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite with the client.

4.3

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 21.31% Top 5%

Vendor Advisory opensuse.org Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory gentoo.org Vendor Advisory marc.info Vendor Advisory netbsd.org Vendor Advisory marc.info Vendor Advisory freebsd.org Vendor Advisory debian.org Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory openssl.org

Affected: n/a n/a

References

Link	Tags
http://lists.opensuse.org/opensuse-updates/2014-08/msg00036.html	vendor advisory
http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15567.html
http://secunia.com/advisories/60221	third party advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21682293
http://secunia.com/advisories/61184	third party advisory
http://marc.info/?l=bugtraq&m=142660345230545&w=2	vendor advisory
http://secunia.com/advisories/60022	third party advisory
https://www.openssl.org/news/secadv_20140806.txt	vendor advisory
http://secunia.com/advisories/61017	third party advisory
http://marc.info/?l=bugtraq&m=142350350616251&w=2	vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21683389
http://marc.info/?l=bugtraq&m=142791032306609&w=2	vendor advisory
http://marc.info/?l=bugtraq&m=142624619906067&w=2	vendor advisory
http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htm
http://security.gentoo.org/glsa/glsa-201412-39.xml	vendor advisory
http://www.securityfocus.com/bid/69077	vdb entry
http://marc.info/?l=bugtraq&m=142495837901899&w=2	vendor advisory
http://secunia.com/advisories/60803	third party advisory
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=80bd7b41b30af6ee96f519e629463583318de3b0
http://secunia.com/advisories/59700	third party advisory
http://www.securitytracker.com/id/1030693	vdb entry
http://secunia.com/advisories/60917	third party advisory
http://www.tenable.com/security/tns-2014-06
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc	vendor advisory
http://secunia.com/advisories/60493	third party advisory
http://secunia.com/advisories/59710	third party advisory
http://secunia.com/advisories/60921	third party advisory
http://secunia.com/advisories/60810	third party advisory
http://marc.info/?l=bugtraq&m=142624679706236&w=2	vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=nas8N1020240
http://secunia.com/advisories/61100	third party advisory
https://www.freebsd.org/security/advisories/FreeBSD-SA-14:18.openssl.asc	vendor advisory
http://secunia.com/advisories/61775	third party advisory
http://www.debian.org/security/2014/dsa-2998	vendor advisory
http://marc.info/?l=bugtraq&m=143290437727362&w=2	vendor advisory
http://marc.info/?l=bugtraq&m=142624719706349&w=2	vendor advisory
http://secunia.com/advisories/61959	third party advisory
http://secunia.com/advisories/59756	third party advisory
http://marc.info/?l=bugtraq&m=142624590206005&w=2	vendor advisory
http://marc.info/?l=bugtraq&m=143290522027658&w=2	vendor advisory
http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc
http://secunia.com/advisories/61392	third party advisory
https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-September/000196.html	mailing list
http://secunia.com/advisories/61171	third party advisory
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=83764a989dcc87fbea337da5f8f86806fe767b7e
http://marc.info/?l=bugtraq&m=142624619906067	vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21686997

Frequently Asked Questions

What is the severity of CVE-2014-5139?: CVE-2014-5139 has been scored as a medium severity vulnerability.
How to fix CVE-2014-5139?: To fix CVE-2014-5139, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2014-5139 being actively exploited in the wild?: It is possible that CVE-2014-5139 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~21% probability that this vulnerability will be exploited by malicious actors in the next 30 days.