OpenSSL · OpenSSL
CVE-2014-0160
OpenSSL Information Disclosure Vulnerability
Cos'è
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
CISA: The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.
Cosa fare
Apply updates per vendor instructions.
Scadenza per le agenzie federali USA: 25 maggio 2022
- Aggiunta all'elenco CISA
- 4 maggio 2022
- Pubblicato
- 7 aprile 2014
- Gravità
- Alta 7,5 CVSS 3.1
- Probabilità di attacchi nei prossimi 30 giorni (EPSS)
- >99,9% tra il 0,1% più alto di tutte le vulnerabilità note
- Tipo di debolezza
- CWE-125
- Più dettagli
- NVD · CVE.org · CISA
Tutte le fonti (20)
- http://www.debian.org/security/2014/dsa-2896
- http://marc.info/?l=bugtraq&m=139774054614965&w=2
- http://marc.info/?l=bugtraq&m=139889113431619&w=2
- http://rhn.redhat.com/errata/RHSA-2014-0396.html
- http://marc.info/?l=bugtraq&m=139835815211508&w=2
- http://marc.info/?l=bugtraq&m=141287864628122&w=2
- http://marc.info/?l=bugtraq&m=139905295427946&w=2
- http://marc.info/?l=bugtraq&m=139833395230364&w=2
- http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00004.html
- http://marc.info/?l=bugtraq&m=142660345230545&w=2
- https://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html?sr=36517217
- http://www.securitytracker.com/id/1030077
- http://seclists.org/fulldisclosure/2014/Apr/90
- http://www.getchef.com/blog/2014/04/09/chef-server-heartbleed-cve-2014-0160-releases/
- http://www.kb.cert.org/vuls/id/720951
- http://www.splunk.com/view/SP-CAAAMB3
- http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0
- http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf
- http://www-01.ibm.com/support/docview.wss?uid=swg21670161
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.