7.5
CVSSv2

CVE-2014-3512

Published: 13/08/2014 Updated: 07/11/2023
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
VMScore: 668
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP implementation in OpenSSL 1.0.1 prior to 1.0.1i allow remote malicious users to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid SRP (1) g, (2) A, or (3) B parameter.

Vulnerable Product Search on Vulmon Subscribe to Product

openssl openssl 1.0.1

openssl openssl 1.0.0c

openssl openssl 1.0.0i

openssl openssl 1.0.0

openssl openssl 1.0.1h

openssl openssl 1.0.0m

openssl openssl 1.0.1c

openssl openssl 1.0.1g

openssl openssl 1.0.0h

openssl openssl 1.0.0e

openssl openssl 1.0.0f

openssl openssl 1.0.0d

openssl openssl 1.0.0j

openssl openssl 1.0.1a

openssl openssl 1.0.1d

openssl openssl 1.0.0k

openssl openssl 1.0.1b

openssl openssl 1.0.1e

openssl openssl 1.0.1f

openssl openssl 1.0.0l

openssl openssl 1.0.0a

openssl openssl 1.0.0b

openssl openssl 1.0.0g

Vendor Advisories

Several security issues were fixed in OpenSSL ...
Multiple vulnerabilities have been identified in OpenSSL, a Secure Sockets Layer toolkit, that may result in denial of service (application crash, large memory consumption), information leak, protocol downgrade Additionally, a buffer overrun affecting only applications explicitly set up for SRP has been fixed (CVE-2014-3512) Detailed descriptions ...
A flaw was discovered in the way OpenSSL handled DTLS packets A remote attacker could use this flaw to cause a DTLS server or client using OpenSSL to crash or use excessive amounts of memory Multiple buffer overflows in crypto/srp/srp_libc in the SRP implementation in OpenSSL 101 before 101i allow remote attackers to cause a denial of servi ...

References

CWE-119https://www.openssl.org/news/secadv_20140806.txthttp://www.securityfocus.com/bid/69083http://www.tenable.com/security/tns-2014-06http://secunia.com/advisories/60810http://secunia.com/advisories/60917ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.aschttp://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.aschttp://secunia.com/advisories/60921http://www.debian.org/security/2014/dsa-2998http://lists.opensuse.org/opensuse-updates/2014-08/msg00036.htmlhttp://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htmhttp://secunia.com/advisories/61775http://secunia.com/advisories/61959http://www-01.ibm.com/support/docview.wss?uid=swg21686997http://www-01.ibm.com/support/docview.wss?uid=swg21682293http://secunia.com/advisories/59756http://security.gentoo.org/glsa/glsa-201412-39.xmlhttp://marc.info/?l=bugtraq&m=142660345230545&w=2https://www.freebsd.org/security/advisories/FreeBSD-SA-14:18.openssl.aschttps://lists.balabit.hu/pipermail/syslog-ng-announce/2014-September/000196.htmlhttp://www-01.ibm.com/support/docview.wss?uid=swg21683389http://www-01.ibm.com/support/docview.wss?uid=nas8N1020240http://www.securitytracker.com/id/1030693http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15565.htmlhttp://secunia.com/advisories/61184http://secunia.com/advisories/61171http://secunia.com/advisories/61100http://secunia.com/advisories/61017http://secunia.com/advisories/60803http://secunia.com/advisories/60493http://secunia.com/advisories/60221http://secunia.com/advisories/60022http://secunia.com/advisories/59710http://secunia.com/advisories/59700https://exchange.xforce.ibmcloud.com/vulnerabilities/95158https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=4a23b12a031860253b58d503f296377ca076427bhttps://usn.ubuntu.com/2308-1/https://nvd.nist.gov