Vulnerability CVE-2014-3506: Information

Description

d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via crafted DTLS handshake messages that trigger memory allocations corresponding to large length values.

Severity: MEDIUM (5.0)

URL: https://nvd.nist.gov/vuln/detail/CVE-2014-3506

Published: Aug. 14, 2014

Modified: Nov. 7, 2023

Error type identifier: CWE-399

Fixed packages

Package name	Branch	Fixed in version	Version from repository	Errata ID	Task #	State
openssl10	p9	1.0.1j-alt1	1.0.2u-alt1.p9.2	ALT-PU-2014-2312-1	133582	Fixed
openssl10	c9f2	1.0.1j-alt1	1.0.2u-alt1.p9.1	ALT-PU-2014-2312-1	133582	Fixed
openssl10	c7	1.0.1j-alt1.M70C.1	1.0.1u-alt0.M70C.1	ALT-PU-2014-2316-1	133754	Fixed

References to Advisories, Solutions, and Tools

Hyperlink	Resource
https://www.openssl.org/news/secadv_20140806.txt	Vendor Advisory
http://linux.oracle.com/errata/ELSA-2014-1053.html
60687
59221
60824
60917
NetBSD-SA2014-008
http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc
60938
60921
openSUSE-SU-2014:1052
RHSA-2014:1297
DSA-2998
HPSBUX03095
HPSBOV03099
RHSA-2014:1256
http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htm
61775
61959
http://www-01.ibm.com/support/docview.wss?uid=swg21686997
http://www-01.ibm.com/support/docview.wss?uid=swg21682293
59756
GLSA-201412-39
SSRT101846
openSUSE-SU-2016:0640
FreeBSD-SA-14:18
[syslog-ng-announce] 20140910 syslog-ng Premium Edition 5 LTS (5.0.6a) has been released
https://bugzilla.redhat.com/show_bug.cgi?id=1127500
http://www-01.ibm.com/support/docview.wss?uid=swg21683389
http://www-01.ibm.com/support/docview.wss?uid=nas8N1020240
1030693
69076
MDVSA-2014:158
http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15573.html
61250
61184
61100
61040
61017
60803
60778
60684
60493
60221
60022
59743
59710
59700
58962
FEDORA-2014-9308
FEDORA-2014-9301
http://linux.oracle.com/errata/ELSA-2014-1052.html
openssl-cve20143506-dos(95160)
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=1250f12613b61758675848f6600ebd914ccd7636

Affected configurations:
1. Configuration 1
  cpe:2.3:a:openssl:openssl:0.9.8b:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8m:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.1:beta2:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8c:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0c:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0i:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0:beta1:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.1h:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8n:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0:beta2:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8p:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0m:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.1c:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8e:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8u:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8za:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.1g:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8g:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0h:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8k:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8m:beta1:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8d:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0:beta3:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0e:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.1:beta3:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0f:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8j:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0d:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0j:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8s:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.1:beta1:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8l:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.1d:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0k:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8r:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8t:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0:beta4:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8a:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.1b:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8o:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8q:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8w:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.1e:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0:beta5:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.1f:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0l:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8v:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8i:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8f:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8y:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0a:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8h:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:0.9.8x:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0b:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.1:*:*:*:*:*:*:*
  cpe:2.3:a:openssl:openssl:1.0.0g:*:*:*:*:*:*:*

Version: v24.4.2

Vulnerability CVE-2014-3506: Information

Description

Fixed packages

References to Advisories, Solutions, and Tools

Configuration 1