CVE-2014-0160
At a glance
- Source
- NVD
- EPSS
- EPSS 100.00 % · percentile 100 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Analyzed
Description
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
Weaknesses (CWE)
- CWE-125 — Out-of-bounds Read
References
- https://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html?sr=36517217
- http://www.securitytracker.com/id/1030077
- http://seclists.org/fulldisclosure/2014/Apr/90
- http://www.getchef.com/blog/2014/04/09/chef-server-heartbleed-cve-2014-0160-releases/
- http://www.debian.org/security/2014/dsa-2896
- http://marc.info/?l=bugtraq&m=139774054614965&w=2
- http://marc.info/?l=bugtraq&m=139889113431619&w=2
- http://rhn.redhat.com/errata/RHSA-2014-0396.html
- http://marc.info/?l=bugtraq&m=139835815211508&w=2
- http://marc.info/?l=bugtraq&m=141287864628122&w=2
- http://www.kb.cert.org/vuls/id/720951
- http://www.splunk.com/view/SP-CAAAMB3
- http://marc.info/?l=bugtraq&m=139905295427946&w=2
- http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0
- http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf
- http://marc.info/?l=bugtraq&m=139833395230364&w=2
- http://www-01.ibm.com/support/docview.wss?uid=swg21670161
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00004.html
- http://marc.info/?l=bugtraq&m=142660345230545&w=2
- http://seclists.org/fulldisclosure/2014/Apr/109
- http://marc.info/?l=bugtraq&m=140724451518351&w=2
- http://www.securitytracker.com/id/1030080
- http://secunia.com/advisories/57836
- http://www-01.ibm.com/support/docview.wss?uid=isg400001843
- http://marc.info/?l=bugtraq&m=139808058921905&w=2
- http://marc.info/?l=bugtraq&m=139758572430452&w=2
- http://www.securityfocus.com/bid/66690
- http://www.innominate.com/data/downloads/manuals/mdm_1.5.2.1_Release_Notes.pdf
- https://filezilla-project.org/versions.php?type=server
- http://marc.info/?l=bugtraq&m=139843768401936&w=2
- http://secunia.com/advisories/57483
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-heartbleed
- http://www.kerio.com/support/kerio-control/release-history
- http://advisories.mageia.org/MGASA-2014-0165.html
- http://www.blackberry.com/btsc/KB35882
- http://marc.info/?l=bugtraq&m=140075368411126&w=2
- http://marc.info/?l=bugtraq&m=139905351928096&w=2
- http://www.securitytracker.com/id/1030081
- http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131221.html
- http://www.securityfocus.com/archive/1/534161/100/0/threaded
- http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131291.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1084875
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html
- http://www-01.ibm.com/support/docview.wss?uid=isg400001841
- http://marc.info/?l=bugtraq&m=139824993005633&w=2
- http://www.securitytracker.com/id/1030079
- http://rhn.redhat.com/errata/RHSA-2014-0377.html
- http://marc.info/?l=bugtraq&m=139722163017074&w=2
- http://marc.info/?l=bugtraq&m=139889295732144&w=2
- +79 more
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | CISA-ADP |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2014-0217
- GCVE · GCVE-0-2014-0160
CERT-FR advisories
- CERTFR-2014-AVI-213 — Vulnérabilité dans Microsoft Windows · cert.ssi.gouv.fr
- CERTFR-2014-AVI-201 — Multiples vulnérabilités dans les produits Apple · cert.ssi.gouv.fr
- CERTFR-2014-AVI-199 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2014-AVI-198 — Vulnérabilité dans Apache Tomcat · cert.ssi.gouv.fr
- CERTFR-2014-AVI-197 — Vulnérabilité dans les produits Huawei · cert.ssi.gouv.fr
- CERTFR-2014-AVI-181 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2014-AVI-180 — Vulnérabilité dans plusieurs produits F5 · cert.ssi.gouv.fr
- CERTFR-2014-AVI-179 — Vulnérabilité dans IBM AIX · cert.ssi.gouv.fr
- CERTFR-2014-AVI-178 — Vulnérabilité dans plusieurs produits Sophos · cert.ssi.gouv.fr
- CERTFR-2014-AVI-177 — Vulnérabilité dans plusieurs produits McAfee · cert.ssi.gouv.fr
- CERTFR-2014-AVI-169 — Vulnérabilité dans plusieurs produits Blue Coat · cert.ssi.gouv.fr
- CERTFR-2014-AVI-167 — Vulnérabilité dans OpenVPN Access Server · cert.ssi.gouv.fr
- CERTFR-2014-AVI-162 — Vulnérabilité dans plusieurs produits Juniper · cert.ssi.gouv.fr
- CERTFR-2014-AVI-161 — Vulnérabilité dans plusieurs produits Cisco · cert.ssi.gouv.fr
- CERTFR-2014-AVI-156 — Vulnérabilité dans OpenSSL · cert.ssi.gouv.fr
- CERTFR-2014-ALE-003 — Vulnérabilité dans OpenSSL · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*≥ 1.0.1 < 1.0.1gcpe:2.3:a:filezilla-project:filezilla_server:*:*:*:*:*:*:*:*< 0.9.44cpe:2.3:o:siemens:application_processing_engine_firmware:2.0:*:*:*:*:*:*:*cpe:2.3:o:siemens:cp_1543-1_firmware:1.1:*:*:*:*:*:*:*cpe:2.3:o:siemens:simatic_s7-1500_firmware:1.5:*:*:*:*:*:*:*cpe:2.3:o:siemens:simatic_s7-1500t_firmware:1.5:*:*:*:*:*:*:*cpe:2.3:a:siemens:elan-8.2:*:*:*:*:*:*:*:*< 8.3.3cpe:2.3:a:siemens:wincc_open_architecture:3.12:*:*:*:*:*:*:*cpe:2.3:o:intellian:v100_firmware:1.20:*:*:*:*:*:*:*cpe:2.3:o:intellian:v100_firmware:1.21:*:*:*:*:*:*:*cpe:2.3:o:intellian:v100_firmware:1.24:*:*:*:*:*:*:*cpe:2.3:o:intellian:v60_firmware:1.15:*:*:*:*:*:*:*cpe:2.3:o:intellian:v60_firmware:1.25:*:*:*:*:*:*:*cpe:2.3:a:mitel:micollab:6.0:*:*:*:*:*:*:*cpe:2.3:a:mitel:micollab:7.0:*:*:*:*:*:*:*cpe:2.3:a:mitel:micollab:7.1:*:*:*:*:*:*:*cpe:2.3:a:mitel:micollab:7.2:*:*:*:*:*:*:*cpe:2.3:a:mitel:micollab:7.3:*:*:*:*:*:*:*cpe:2.3:a:mitel:micollab:7.3.0.104:*:*:*:*:*:*:*cpe:2.3:a:mitel:mivoice:1.1.2.5:*:*:*:*:lync:*:*cpe:2.3:a:mitel:mivoice:1.1.3.3:*:*:*:*:skype_for_business:*:*cpe:2.3:a:mitel:mivoice:1.2.0.11:*:*:*:*:skype_for_business:*:*cpe:2.3:a:mitel:mivoice:1.3.2.2:*:*:*:*:skype_for_business:*:*cpe:2.3:a:mitel:mivoice:1.4.0.102:*:*:*:*:skype_for_business:*:*cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*cpe:2.3:a:redhat:gluster_storage:2.1:*:*:*:*:*:*:*cpe:2.3:a:redhat:storage:2.1:*:*:*:*:*:*:*cpe:2.3:a:redhat:virtualization:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:6.5:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:6.5:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*- +7 more
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |