CVE-2014-3567

CVSS V2 High 7.1 CVSS V3 None

Description

Memory leak in the tls_decrypt_ticket function in t1_lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted session ticket that triggers an integrity-check failure.

Overview

CVE ID
CVE-2014-3567

Assigner
secalert@redhat.com

Vulnerability Status
Modified

Published Version
2014-10-19T01:55:13

Last Modified Date
2017-11-15T02:29:04

Weakness Enumerations

CWE	URL
CWE-20	http://cwe.mitre.org/data/definitions/20.html

CPE Configuration (Product)

CPE	Vulnerable	Operator	Version End
cpe:2.3:a:openssl:openssl::::::::	1	OR	0.9.8zb
cpe:2.3:a:openssl:openssl:1.0.0:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.0:beta1::::::	1	OR
cpe:2.3:a:openssl:openssl:1.0.0:beta2::::::	1	OR
cpe:2.3:a:openssl:openssl:1.0.0:beta3::::::	1	OR
cpe:2.3:a:openssl:openssl:1.0.0:beta4::::::	1	OR
cpe:2.3:a:openssl:openssl:1.0.0:beta5::::::	1	OR
cpe:2.3:a:openssl:openssl:1.0.0a:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.0b:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.0c:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.0d:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.0e:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.0f:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.0g:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.0h:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.0i:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.0j:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.0k:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.0l:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.0m:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.0n:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.1:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.1:beta1::::::	1	OR
cpe:2.3:a:openssl:openssl:1.0.1:beta2::::::	1	OR
cpe:2.3:a:openssl:openssl:1.0.1:beta3::::::	1	OR
cpe:2.3:a:openssl:openssl:1.0.1a:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.1b:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.1c:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.1d:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.1e:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.1f:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.1g:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.1h:::::::*	1	OR
cpe:2.3:a:openssl:openssl:1.0.1i:::::::*	1	OR

CVSS Version 2

Version
2.0

Vector String
AV:N/AC:M/Au:N/C:N/I:N/A:C

Access Vector
NETWORK

Access Compatibility
MEDIUM

Authentication
NONE

Confidentiality Impact
NONE

Integrity Impact
NONE

Availability Impact
COMPLETE

Base Score
7.1

Severity
HIGH

Exploitability Score
8.6

Impact Score
6.9

References

Reference URL	Reference Tags
https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=7fd4ce6a997be5f5c9e744ac527725c2850de203	Patch
https://www.openssl.org/news/secadv_20141015.txt	Vendor Advisory
http://www.securityfocus.com/bid/70586
http://www.mandriva.com/security/advisories?name=MDVSA-2014:203
http://rhn.redhat.com/errata/RHSA-2014-1652.html
http://www.debian.org/security/2014/dsa-3053
http://marc.info/?l=bugtraq&m=141477196830952&w=2
http://rhn.redhat.com/errata/RHSA-2014-1692.html
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00008.html
http://www.ubuntu.com/usn/USN-2385-1
http://advisories.mageia.org/MGASA-2014-0416.html
http://secunia.com/advisories/59627
http://aix.software.ibm.com/aix/efixes/security/openssl_advisory11.asc
http://secunia.com/advisories/61298
http://secunia.com/advisories/61959
http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00001.html
http://secunia.com/advisories/61130
http://secunia.com/advisories/61073
http://secunia.com/advisories/62070
https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_openssl6
http://www.securitytracker.com/id/1031052
http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00003.html
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-015.txt.asc
http://secunia.com/advisories/61207
http://secunia.com/advisories/62030
http://www-01.ibm.com/support/docview.wss?uid=swg21686997
http://secunia.com/advisories/61819
http://secunia.com/advisories/61058
http://secunia.com/advisories/61990
http://secunia.com/advisories/61837
http://secunia.com/advisories/62124
http://www.splunk.com/view/SP-CAAANST
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://support.apple.com/HT204244
http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html
http://security.gentoo.org/glsa/glsa-201412-39.xml
http://marc.info/?l=bugtraq&m=142103967620673&w=2
http://marc.info/?l=bugtraq&m=142495837901899&w=2
http://rhn.redhat.com/errata/RHSA-2015-0126.html
http://marc.info/?l=bugtraq&m=142624590206005&w=2
http://marc.info/?l=bugtraq&m=142118135300698&w=2
http://www.mandriva.com/security/advisories?name=MDVSA-2015:062
http://marc.info/?l=bugtraq&m=142791032306609&w=2
http://marc.info/?l=bugtraq&m=142834685803386&w=2
http://marc.info/?l=bugtraq&m=142804214608580&w=2
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
https://support.apple.com/HT205217
http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888
http://marc.info/?l=bugtraq&m=143290522027658&w=2
http://marc.info/?l=bugtraq&m=143290583027876&w=2
http://marc.info/?l=bugtraq&m=143290437727362&w=2
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html
https://kc.mcafee.com/corporate/index?page=content&id=SB10091
https://support.citrix.com/article/CTX216642

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2014-3567
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567

History

Created	Old Value	New Value	Data Type	Notes
2022-05-10 08:11:35				Added to TrackCVE
2022-12-02 01:39:33	2014-10-19T01:55Z	2014-10-19T01:55:13	CVE Published Date	updated
2022-12-02 01:39:33		2017-11-15T02:29:04	CVE Modified Date	updated
2022-12-02 01:39:33		Modified	Vulnerability Status	updated