Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
4.3
CVSSv2

CVE-2014-3470

Published: 05/06/2014 Updated: 07/11/2023
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
VMScore: 384
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Subscribe to Openssl

Vulnerability Summary

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL prior to 0.9.8za, 1.0.0 prior to 1.0.0m, and 1.0.1 prior to 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote malicious users to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

openssl openssl

redhat enterprise linux 6.0

redhat storage 2.1

redhat enterprise linux 5

fedoraproject fedora

mariadb mariadb

fedoraproject fedora 20

fedoraproject fedora 19

suse linux enterprise workstation extension 12

opensuse leap 42.1

opensuse opensuse 13.2

suse linux enterprise server 12

suse linux enterprise software development kit 12

suse linux enterprise desktop 12

Vendor Advisories

Debian CVElist Bug Report Logs: virtualbox: CVE-2014-6588 CVE-2014-6589 CVE-2014-6590 CVE-2014-6595 CVE-2015-0418 CVE-2015-0427
Debian Bug report logs - #775888 virtualbox: CVE-2014-6588 CVE-2014-6589 CVE-2014-6590 CVE-2014-6595 CVE-2015-0418 CVE-2015-0427 Package: virtualbox; Maintainer for virtualbox is Debian Virtualbox Team <team+debian-virtualbox@trackerdebianorg>; Source for virtualbox is src:virtualbox (PTS, buildd, popcon) Reported by: Mori ...
Debian CVElist Bug Report Logs: openssl: CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470
Debian Bug report logs - #750665 openssl: CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470 Package: openssl; Maintainer for openssl is Debian OpenSSL Team <pkg-openssl-devel@listsaliothdebianorg>; Source for openssl is src:openssl (PTS, buildd, popcon) Reported by: Jeff Ballard < ...
Debian Security Advisories: DSA-2950-1 openssl -- security update
Multiple vulnerabilities have been discovered in OpenSSL: CVE-2014-0195 Jueri Aedla discovered that a buffer overflow in processing DTLS fragments could lead to the execution of arbitrary code or denial of service CVE-2014-0221 Imre Rad discovered the processing of DTLS hello packets is susceptible to denial of service CVE-20 ...
Amazon Linux AMI: ALAS-2014-349
It was found that OpenSSL clients and servers could be forced, via a specially crafted handshake packet, to use weak keying material for communication A man-in-the-middle attacker could use this flaw to decrypt and modify traffic between a client and a server (CVE-2014-0224) Note: In order to exploit this flaw, both the server and the client must ...
Ubuntu Security Notice: openssl vulnerabilities
Several security issues were fixed in OpenSSL ...
Ubuntu Security Notice: openssl regression
USN-2232-1 introduced a regression in OpenSSL ...
Ubuntu Security Notice: openssl vulnerabilities
USN-2232-1 introduced a regression in OpenSSL ...
Ubuntu Security Notice: openssl regression
USN-2232-1 introduced a regression in OpenSSL ...
Red Hat: CVE-2014-3470
The ssl3_send_client_key_exchange function in s3_clntc in OpenSSL before 098za, 100 before 100m, and 101 before 101h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value ...
Citrix Security Bulletins: Citrix Security Advisory for OpenSSL Vulnerabilities (June 2014)
Overview The OpenSSL security advisory released on the 5th of June 2014 disclosed six security vulnerabilities in this open source component; these are described below: • CVE-2014-0224: SSL/TLS MITM vulnerability • CVE-2014-0221: DTLS recursion flaw • CVE-2014-0195: DTLS invalid fragment vulnerability • CVE-2014-0198: SSL_MODE_RELEASE_BUFFE ...

Recent Articles

FireEye patches OS, torpedos Exploit-DB disclosure
The Register • Darren Pauli • 10 Jul 2014

Researcher suspended after zero-day dump

FireEye has patched a series of publicly-disclosed flaws in its operating system (FEOS) that facilitated man-in-the-middle attacks and command injection. The vulnerabilities released over June affected versions NX, EX, AX, FX, and CM of the FEOS and were patched in the first individual security bulletin for the system. The company urged customers to apply fixes. "FireEye encourages all customers to upgrade to the most current releases as soon as practical - especially customers running versions ...

Read more...

References

CWE-476http://www.openssl.org/news/secadv_20140605.txthttps://bugzilla.redhat.com/show_bug.cgi?id=1103600http://www.securityfocus.com/bid/67898http://secunia.com/advisories/58797http://secunia.com/advisories/59191http://secunia.com/advisories/58579https://kb.bluecoat.com/index?page=content&id=SA80http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140605-opensslhttp://www.blackberry.com/btsc/KB36051http://www-01.ibm.com/support/docview.wss?uid=swg21676035http://secunia.com/advisories/59438http://secunia.com/advisories/59301http://secunia.com/advisories/59450http://secunia.com/advisories/59491http://secunia.com/advisories/59721http://www-01.ibm.com/support/docview.wss?uid=swg21677695http://secunia.com/advisories/59655http://secunia.com/advisories/59659http://secunia.com/advisories/59162http://secunia.com/advisories/59120http://www-01.ibm.com/support/docview.wss?uid=swg21676655http://www-01.ibm.com/support/docview.wss?uid=swg21678289http://secunia.com/advisories/58939http://secunia.com/advisories/59666http://secunia.com/advisories/59126http://www-01.ibm.com/support/docview.wss?uid=swg21677828http://www-01.ibm.com/support/docview.wss?uid=swg21676062http://secunia.com/advisories/59490https://kc.mcafee.com/corporate/index?page=content&id=SB10075http://www-01.ibm.com/support/docview.wss?uid=swg21676496http://www-01.ibm.com/support/docview.wss?uid=swg21676419http://www-01.ibm.com/support/docview.wss?uid=swg21678167http://secunia.com/advisories/59442http://www.novell.com/support/kb/doc.php?id=7015300http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htmhttp://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=6060&myns=phmc&mync=Ehttp://www-01.ibm.com/support/docview.wss?uid=swg21673137http://secunia.com/advisories/59514http://www-01.ibm.com/support/docview.wss?uid=swg21677527http://secunia.com/advisories/59495http://secunia.com/advisories/59669http://secunia.com/advisories/59413http://www.novell.com/support/kb/doc.php?id=7015264http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=6061&myns=phmc&mync=Ehttp://www-01.ibm.com/support/docview.wss?uid=swg24037761http://secunia.com/advisories/59300http://www.splunk.com/view/SP-CAAAM2Dhttp://secunia.com/advisories/59895http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.htmlhttp://secunia.com/advisories/59459http://secunia.com/advisories/59451http://www-01.ibm.com/support/docview.wss?uid=isg400001843http://secunia.com/advisories/59342http://www-01.ibm.com/support/docview.wss?uid=isg400001841http://secunia.com/advisories/59916http://secunia.com/advisories/59990http://secunia.com/advisories/60571http://secunia.com/advisories/59784http://support.apple.com/kb/HT6443http://seclists.org/fulldisclosure/2014/Dec/23http://www-01.ibm.com/support/docview.wss?uid=swg21683332http://www-01.ibm.com/support/docview.wss?uid=swg21677836http://www-01.ibm.com/support/docview.wss?uid=swg21676889http://www-01.ibm.com/support/docview.wss?uid=swg21676879http://www-01.ibm.com/support/docview.wss?uid=swg21676615http://www-01.ibm.com/support/docview.wss?uid=swg21676529http://www-01.ibm.com/support/docview.wss?uid=swg21676501http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095754http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095755http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095756http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095757https://www.novell.com/support/kb/doc.php?id=7015271http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.htmlhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946http://marc.info/?l=bugtraq&m=140752315422991&w=2http://marc.info/?l=bugtraq&m=140389355508263&w=2http://marc.info/?l=bugtraq&m=140904544427729&w=2http://marc.info/?l=bugtraq&m=140317760000786&w=2http://marc.info/?l=bugtraq&m=140389274407904&w=2http://marc.info/?l=bugtraq&m=140482916501310&w=2http://marc.info/?l=bugtraq&m=140621259019789&w=2http://marc.info/?l=bugtraq&m=140491231331543&w=2http://marc.info/?l=bugtraq&m=140448122410568&w=2http://marc.info/?l=bugtraq&m=140266410314613&w=2http://marc.info/?l=bugtraq&m=140499827729550&w=2http://marc.info/?l=bugtraq&m=140431828824371&w=2http://www.mandriva.com/security/advisories?name=MDVSA-2015:062http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlhttp://www.vmware.com/security/advisories/VMSA-2014-0012.htmlhttp://www-01.ibm.com/support/docview.wss?uid=swg21676071http://secunia.com/advisories/59365http://secunia.com/advisories/59364http://secunia.com/advisories/59362http://secunia.com/advisories/59340http://secunia.com/advisories/59310http://secunia.com/advisories/59306http://secunia.com/advisories/59287http://secunia.com/advisories/59284http://secunia.com/advisories/59282http://secunia.com/advisories/59264http://secunia.com/advisories/59223http://secunia.com/advisories/59192http://secunia.com/advisories/59189http://secunia.com/advisories/59175http://secunia.com/advisories/59167http://secunia.com/advisories/58977http://secunia.com/advisories/58945http://secunia.com/advisories/58742http://secunia.com/advisories/58716http://secunia.com/advisories/58714http://secunia.com/advisories/58713http://secunia.com/advisories/58667http://secunia.com/advisories/58615http://secunia.com/advisories/58337http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.htmlhttp://kb.juniper.net/InfoCenter/index?page=content&id=KB29195http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.aschttp://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlhttp://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.htmlhttp://www.securityfocus.com/archive/1/534161/100/0/threadedhttp://www-01.ibm.com/support/docview.wss?uid=swg21675821http://www-01.ibm.com/support/docview.wss?uid=swg21675626http://www-01.ibm.com/support/docview.wss?uid=nas8N1020163http://www.vmware.com/security/advisories/VMSA-2014-0006.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2014:106http://www.mandriva.com/security/advisories?name=MDVSA-2014:105http://www.ibm.com/support/docview.wss?uid=swg24037783http://www.ibm.com/support/docview.wss?uid=swg21676793http://www.ibm.com/support/docview.wss?uid=swg21676356http://www.f-secure.com/en/web/labs_global/fsc-2014-6http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15342.htmlhttp://support.citrix.com/article/CTX140876http://security.gentoo.org/glsa/glsa-201407-05.xmlhttp://secunia.com/advisories/61254http://secunia.com/advisories/59525http://secunia.com/advisories/59518http://secunia.com/advisories/59483http://secunia.com/advisories/59460http://secunia.com/advisories/59449http://secunia.com/advisories/59445http://secunia.com/advisories/59441http://secunia.com/advisories/59440http://secunia.com/advisories/59437http://secunia.com/advisories/59431https://cert-portal.siemens.com/productcert/pdf/ssa-234763.pdfhttps://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=8011cd56e39a433b1837465259a9bd24a38727fbhttps://nvd.nist.govhttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775888https://usn.ubuntu.com/2232-1/https://access.redhat.com/security/cve/cve-2014-3470https://www.debian.org/security/./dsa-2950
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-47626CVE-2024-3400physicalCVE-2024-31426CVE-2024-22423CVE-2024-22438injectlocal usersCVE-2024-3797
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook