KLA10343 Multiple vulnerabilities in Stunnel

An obsolete version of OpenSSL was found in Stunnel. By exploiting this vulnerability malicious users can cause denial of service, obtain sensitive information and bypass security. This vulnerability can be exploited remotely.

Original advisories

Stunnel changelog

Exploitation

Public exploits exist for this vulnerability.

Related products

Stunnel

CVE list

CVE-2014-3508 warning

CVE-2014-3509 high

CVE-2014-3511 warning

CVE-2014-5139 warning

CVE-2014-3505 warning

CVE-2014-3506 warning

CVE-2014-3507 warning

CVE-2014-3510 warning

CVE-2014-3512 high

Solution

Update to latest version

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• Stunnel versions 5.02 and earlier