CVE-2014-0160

 

Published at: - 08-04-2014 12:55

Last modified: - 15-11-2022 10:15

Total changes: - 2

Description

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

 

Verification logic

 

Reference

• http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=96db9023b881d7cd9f379b0c154650d6c108e9a3
• https://bugzilla.redhat.com/show_bug.cgi?id=1084875
• http://www.openssl.org/news/secadv_20140407.txt
• http://heartbleed.com/
• 1030078-Third Party Advisory, VDB Entry
• 20140409 Re: heartbleed OpenSSL bug CVE-2014-0160-Mailing List, Third Party Advisory
• 20140412 Re: heartbleed OpenSSL bug CVE-2014-0160-Mailing List, Third Party Advisory
• [syslog-ng-announce] 20140411 syslog-ng Premium Edition 5 LTS (5.0.4a) has been released-Third Party Advisory
• http://www.oracle.com/technetwork/topics/security/opensslheartbleedcve-2014-0160-2188454.html
• RHSA-2014:0376-Third Party Advisory
• RHSA-2014:0396-Third Party Advisory
• 1030082-Third Party Advisory, VDB Entry
• 57347-Third Party Advisory
• HPSBMU02995-Third Party Advisory
• 1030077-Third Party Advisory, VDB Entry
• http://www-01.ibm.com/support/docview.wss?uid=swg21670161
• DSA-2896-Third Party Advisory
• RHSA-2014:0377-Third Party Advisory
• 1030080-Third Party Advisory, VDB Entry
• FEDORA-2014-4879-Third Party Advisory
• 1030074-Third Party Advisory, VDB Entry
• 20140408 heartbleed OpenSSL bug CVE-2014-0160-Mailing List, Third Party Advisory
• 1030081-Third Party Advisory, VDB Entry
• 20140409 OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products-Third Party Advisory
• RHSA-2014:0378-Third Party Advisory
• 20140408 Re: heartbleed OpenSSL bug CVE-2014-0160-Mailing List, Third Party Advisory
• 57483-Third Party Advisory
• http://www.splunk.com/view/SP-CAAAMB3
• FEDORA-2014-4910-Third Party Advisory
• 1030079-Third Party Advisory, VDB Entry
• openSUSE-SU-2014:0492-Mailing List, Third Party Advisory
• 57721-Third Party Advisory
• http://www.blackberry.com/btsc/KB35882
• 1030026-Third Party Advisory, VDB Entry
• SUSE-SA:2014:002-Mailing List, Third Party Advisory
• 66690-Third Party Advisory, VDB Entry
• http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/
• TA14-098A-Third Party Advisory, US Government Resource
• http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/
• http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/
• https://blog.torproject.org/blog/openssl-bug-cve-2014-0160
• 57966-Third Party Advisory
• http://www.f-secure.com/en/web/labs_global/fsc-2014-1
• 20140411 MRI Rubies may contain statically linked, vulnerable OpenSSL-Mailing List, Third Party Advisory
• http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/
• 57968-Third Party Advisory
• https://code.google.com/p/mod-spdy/issues/detail?id=85
• 32745-Exploit, Third Party Advisory, VDB Entry
• VU#720951-Third Party Advisory, US Government Resource
• https://www.cert.fi/en/reports/2014/vulnerability788210.html
• 32764-Exploit, Third Party Advisory, VDB Entry
• 57836-Third Party Advisory
• https://gist.github.com/chapmajs/10473815
• http://www.getchef.com/blog/2014/04/09/chef-server-heartbleed-cve-2014-0160-releases/
• http://cogentdatahub.com/ReleaseNotes.html
• HPSBMU03009-Third Party Advisory
• HPSBMU03022-Third Party Advisory
• HPSBMU03024-Third Party Advisory
• http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=1
• http://www.kerio.com/support/kerio-control/release-history
• http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=3
• http://advisories.mageia.org/MGASA-2014-0165.html
• HPSBST03000-Broken Link
• http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
• http://www-01.ibm.com/support/docview.wss?uid=isg400001843
• https://filezilla-project.org/versions.php?type=server
• http://www-01.ibm.com/support/docview.wss?uid=isg400001841
• https://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html?sr=36517217
• HPSBHF03136-Third Party Advisory
• 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities-Mailing List, Third Party Advisory
• http://www.vmware.com/security/advisories/VMSA-2014-0012.html
• SSRT101846-Third Party Advisory
• http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0
• MDVSA-2015:062-Third Party Advisory
• HPSBMU03017-Third Party Advisory
• HPSBMU02994-Third Party Advisory
• HPSBST03001-Third Party Advisory
• HPSBST03004-Third Party Advisory
• HPSBST03016-Third Party Advisory
• HPSBMU03032-Third Party Advisory
• HPSBGN03011-Third Party Advisory
• HPSBMU03013-Third Party Advisory
• HPSBMU03023-Third Party Advisory
• HPSBMU03029-Third Party Advisory
• HPSBGN03008-Third Party Advisory
• HPSBPI03031-Third Party Advisory
• HPSBHF03021-Third Party Advisory
• HPSBMU03037-Third Party Advisory
• HPSBMU03012-Third Party Advisory
• HPSBMU03020-Third Party Advisory
• HPSBMU03025-Third Party Advisory
• HPSBST03027-Third Party Advisory
• HPSBMU02999-Third Party Advisory
• HPSBMU03040-Third Party Advisory
• HPSBST03015-Third Party Advisory
• HPSBMU02997-Third Party Advisory
• HPSBGN03010-Third Party Advisory
• HPSBMU03028-Third Party Advisory
• HPSBMU03044-Third Party Advisory
• HPSBMU03033-Third Party Advisory
• HPSBPI03014-Third Party Advisory
• HPSBMU02998-Third Party Advisory
• HPSBMU03019-Third Party Advisory
• HPSBMU03030-Third Party Advisory
• HPSBMU03018-Third Party Advisory
• HPSBMU03062-Third Party Advisory
• http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160512_00
• http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004661
• http://www.innominate.com/data/downloads/manuals/mdm_1.5.2.1_Release_Notes.pdf
• http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf
• 59347-Third Party Advisory
• 59243-Third Party Advisory
• 59139-Third Party Advisory
• FEDORA-2014-9308-Mailing List, Third Party Advisory
• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-119-01
• https://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html
• http://support.citrix.com/article/CTX140605
• USN-2165-1-Third Party Advisory
• openSUSE-SU-2014:0560-Mailing List, Third Party Advisory
• 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities-Not Applicable
• https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-17-0008
• [tomcat-dev] 20190319 svn commit: r1855831 [26/30] - in /tomcat/site/trunk: ./ docs/ xdocs/-Mailing List, Patch, Third Party Advisory
• [tomcat-dev] 20190325 svn commit: r1856174 [26/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/-Mailing List, Patch, Third Party Advisory
• https://sku11army.blogspot.com/2020/01/heartbleed-hearts-continue-to-bleed.html
• [tomcat-dev] 20200203 svn commit: r1873527 [26/30] - /tomcat/site/trunk/docs/-Mailing List, Patch, Third Party Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-635659.pdf
• [tomcat-dev] 20200213 svn commit: r1873980 [31/34] - /tomcat/site/trunk/docs/-Mailing List, Patch, Third Party Advisory
• https://yunus-shn.medium.com/ricon-industrial-cellular-router-heartbleed-attack-2634221c02bd

 

Keywords

NVD

 

CVE-2014-0160

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures