KLA10460 Multiple vulnerabilities in OpenSSL

Multiple serious vulnerabilities have been found in OpenSSL. Malicious users can exploit these vulnerabilities to cause denial of service or bypass security restrictions.

Below is a complete list of vulnerabilities pppeep

1. An unknown vulnerability can be exploited remotely via specially designed DTLS message;
2. Improper calculations can be exploited remotely via unspecified vectors;
3. An unknown vulnerability can be exploited remotely via unspecified vectors related to ServerKeyExchange, fingerprint-based certificate-blacklist, Diffie-Hellman certificate;
4. Lack of protocol checking can be exploited remotely via unexpected handshake;
5. An unknown vulnerability can be exploited remotely via RSA-to-EXPORT_RSA downgrade attacks;
6. Memory leak can be exploited remotely via specially designed records.

Original advisories

OpenSSL bulletin

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

OpenSSl

CVE list

CVE-2014-3571 warning

CVE-2014-8275 warning

CVE-2014-3569 warning

CVE-2014-3572 warning

CVE-2014-3570 warning

CVE-2015-0206 warning

CVE-2015-0204 warning

CVE-2015-0205 warning

Solution

Update to latest version!

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• LoI

Loss of integrity. Exploitation of vulnerabilities with this impact can lead to partial system fault or system components connection disruption.

Affected Products

• OpenSSL versions earlier than 0.9.8zdOpenSSL 1.0.0 versions earlier than 1.0.0pOpenSSL 1.0.1 versions earlier than 1.0.1k