KLA10460
Multiple vulnerabilities in OpenSSL
Обновлено: 17/06/2019
Дата обнаружения
08/01/2015
Уровень угрозы
Warning
Описание

Multiple serious vulnerabilities have been found in OpenSSL. Malicious users can exploit these vulnerabilities to cause denial of service or bypass security restrictions.

Below is a complete list of vulnerabilities pppeep

  1. An unknown vulnerability can be exploited remotely via specially designed DTLS message;
  2. Improper calculations can be exploited remotely via unspecified vectors;
  3. An unknown vulnerability can be exploited remotely via unspecified vectors related to ServerKeyExchange, fingerprint-based certificate-blacklist, Diffie-Hellman certificate;
  4. Lack of protocol checking can be exploited remotely via unexpected handshake;
  5. An unknown vulnerability can be exploited remotely via RSA-to-EXPORT_RSA downgrade attacks;
  6. Memory leak can be exploited remotely via specially designed records.
Пораженные продукты

OpenSSL versions earlier than 0.9.8zd
OpenSSL 1.0.0 versions earlier than 1.0.0p
OpenSSL 1.0.1 versions earlier than 1.0.1k

Решение

Update to latest version!

Первичный источник обнаружения
OpenSSL bulletin
Оказываемое влияние
?
ACE 
[?]

OSI 
[?]

DoS 
[?]

SB 
[?]

LoI 
[?]
CVE-IDS
CVE-2014-35715.0Critical
CVE-2014-82755.0Critical
CVE-2014-35695.0Critical
CVE-2014-35725.0Critical
CVE-2014-35705.0Critical
CVE-2015-02065.0Critical
CVE-2015-02044.3Warning
CVE-2015-02055.0Critical