The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

computer weakness announce CVE-2014-0195

OpenSSL: buffer overflow of DTLS

Synthesis of the vulnerability

An attacker can generate a buffer overflow via DTLS of OpenSSL, in order to trigger a denial of service, and possibly to execute code.
Severity of this threat: 3/4.
Creation date: 05/06/2014.
Références of this weakness: aid-06062014, c04336637, c04363613, c04368523, CERTFR-2014-AVI-253, CERTFR-2014-AVI-254, CERTFR-2014-AVI-255, CERTFR-2014-AVI-260, CERTFR-2014-AVI-279, CERTFR-2014-AVI-286, CERTFR-2014-AVI-291, cisco-sa-20140605-openssl, CTX140876, CVE-2014-0195, DOC-53313, DSA-2950-1, DSA-2950-2, FEDORA-2014-17576, FEDORA-2014-17587, FEDORA-2014-7101, FEDORA-2014-7102, FG-IR-14-018, FreeBSD-SA-14:14.openssl, HPSBMU03069, HPSBUX03046, JSA10629, KB36051, MDVSA-2014:106, MDVSA-2015:062, NetBSD-SA2014-006, openSUSE-SU-2014:0764-1, openSUSE-SU-2014:0765-1, openSUSE-SU-2016:0640-1, RHSA-2014:0625-01, RHSA-2014:0628-01, RHSA-2014:0679-01, SA40006, SA80, SB10075, SOL15356, SSA:2014-156-03, SSRT101590, USN-2232-1, USN-2232-2, USN-2232-3, USN-2232-4, VIGILANCE-VUL-14846, ZDI-14-173.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

The DTLS (Datagram Transport Layer Security) protocol, based on TLS, provides a cryptographic layer over the UDP protocol.

However, if the size of data of a DTLS fragment is greater than the size of the storage array, an overflow occurs.

An attacker can therefore generate a buffer overflow via DTLS of OpenSSL, in order to trigger a denial of service, and possibly to execute code.
Full Vigil@nce bulletin... (Free trial)

This security alert impacts software or systems such as ArubaOS, BES, ProxyAV, ProxySG par Blue Coat, SGOS by Blue Coat, Cisco ASR, Cisco ATA, Cisco ACE, ASA, AsyncOS, Cisco Catalyst, CiscoWorks, Cisco Content SMA, Cisco CSS, Cisco ESA, IOS by Cisco, IOS XE Cisco, IOS XR Cisco, Cisco IPS, IronPort Email, IronPort Management, IronPort Web, Nexus by Cisco, NX-OS, Prime Collaboration Assurance, Prime Collaboration Manager, Prime Infrastructure, Cisco PRSM, Cisco Router, Secure ACS, Cisco CUCM, Cisco Manager Attendant Console, Cisco Unified CCX, Cisco IP Phone, Cisco MeetingPlace, Cisco Wireless IP Phone, Unity Cisco, WebNS, Cisco WSA, Debian, Avamar, EMC CAVA, EMC CEE, EMC CEPA, Celerra FAST, Celerra NS, Celerra NX4, EMC CMDCE, Connectrix Switch, ECC, NetWorker, PowerPath, Unisphere EMC, VNX Operating Environment, VNX Series, BIG-IP Hardware, TMOS, Fedora, FortiAnalyzer, FortiAnalyzer Virtual Appliance, FortiClient, FortiManager, FortiManager Virtual Appliance, FreeBSD, HP Operations, HP-UX, AIX, Juniper J-Series, Junos OS, Junos Pulse, Juniper Network Connect, Juniper UAC, McAfee Web Gateway, NetBSD, OpenBSD, OpenSSL, openSUSE, openSUSE Leap, Solaris, Polycom CMA, HDX, RealPresence Collaboration Server, Polycom VBP, RHEL, ACE Agent, ACE Server, RSA Authentication Agent, RSA Authentication Manager, SecurID, Slackware, stunnel, Ubuntu.

Our Vigil@nce team determined that the severity of this security weakness is important.

The trust level is of type confirmed by the editor, with an origin of internet client.

A proof of concept or an attack tool is available, so your teams have to process this alert. An attacker with a technician ability can exploit this security announce.

Solutions for this threat

OpenSSL: version 1.0.1h.
The version 1.0.1h is fixed:
  http://www.openssl.org/

OpenSSL: version 1.0.0m.
The version 1.0.0m is fixed:
  http://www.openssl.org/

OpenSSL: version 0.9.8za.
Version 0.9.8za is fixed:
  http://www.openssl.org/

stunnel: version 5.02.
The version 5.02 is fixed:
  https://www.stunnel.org/downloads.html

AIX: patch for OpenSSL.
A patch is available in information sources.

Aruba: solution for OpenSSL.
The solution is indicated in information sources.

BlackBerry: solution for OpenSSL.
The solution is indicated in information sources.

Blue Coat: solution for OpenSSL.
The solution is indicated in information sources.

Cisco: solution for OpenSSL.
The solution is indicated in information sources.
Vulnerable products are listed in the information sources.

Debian: new openssl packages.
New packages are available:
  Debian 7: openssl 1.0.1e-2+deb7u11

EMC: solution for OpenSSL.
The solution is indicated in information sources.

F5 BIG-IP: solution for OpenSSL DTLS.
The solution is indicated in information sources.

Fedora: new mingw-openssl packages.
New packages are available:
  Fedora 20: mingw-openssl 1.0.1j-1.fc20
  Fedora 21: mingw-openssl 1.0.1j-1.fc21

Fedora: new openssl packages.
New packages are available:
  Fedora 19: openssl 1.0.1e-38.fc19
  Fedora 20: openssl 1.0.1e-38.fc20

Fortinet: solution for OpenSSL.
The solution is indicated in information sources.

FreeBSD: patch for openssl.
A patch is available in information sources.

HP Operations Analytics: solution for OpenSSL.
The solution is indicated in the following document:
  http://support.openview.hp.com/selfsolve/document/KM01020441

HP Operations Orchestration: solution for OpenSSL.
The solution is indicated in the following document:
  http://support.openview.hp.com/selfsolve/document/LID/OO_00030

HP-UX: fixed versions for OpenSSL.
Fixed versions are indicated in information sources.

Juniper: solution for OpenSSL.
The solution is indicated in information sources.

Mandriva BS2: new openssl packages.
New packages are available:
  Mandriva BS2: openssl 1.0.1m-1.mbs2

Mandriva BS: new openssl packages.
New packages are available:
  Mandriva BS1: openssl 1.0.0m-1.mbs1

McAfee Web Gateway: patch for OpenSSL.
A patch is available in information sources.

NetBSD: patch for OpenSSL.
A patch is available in information sources.

OpenBSD: patch for openssl.
A patch is available in information sources.

openSUSE: new libopenssl0_9_8 packages.
New packages are available:
  openSUSE 13.2: libopenssl0_9_8 0.9.8zh-9.3.1
  openSUSE Leap 42.1: libopenssl0_9_8 0.9.8zh-14.1

openSUSE: new openssl packages.
New packages are available:
  openSUSE 11.4: openssl 1.0.0m-18.53.1
  openSUSE 12.3: openssl 1.0.1h-1.60.1
  openSUSE 13.1: openssl 1.0.1h-11.48.1

Polycom Converged Management Application: version 5.2.6.
The version 5.2.6 is fixed.

Polycom HDX: version 3.1.5.
The version 3.1.5 is fixed.

Polycom RMX 1800/Collaboration Server: version 8.4.1.
The version 8.4.1 is fixed.

Polycom Video Border Proxy: version 11.2.18.
The version 11.2.18 is fixed.

Red Hat Storage Server 2.1: new openssl packages.
New packages are available:
  RHEL 6: openssl 1.0.1e-16.el6_5.14

RHEL 6.5: new openssl packages.
New packages are available:
  RHEL 6: openssl 1.0.1e-16.el6_5.14

RHEL 7.0: new openssl packages.
New packages are available:
  RHEL 7: openssl 1.0.1e-34.el7_0.3

Slackware: new openssl packages.
New packages are available:
  Slackware 13.0: openssl 0.9.8za-i486-1_slack13.0
  Slackware 13.1: openssl 0.9.8za-i486-1_slack13.1
  Slackware 13.37: openssl 0.9.8za-i486-1_slack13.37
  Slackware 14.0: openssl 1.0.1h-i486-1_slack14.0
  Slackware 14.1: openssl 1.0.1h-i486-1_slack14.1

Solaris: version 11.1.20.5.0.
The version 11.1.20.5.0 is fixed:
  https://support.oracle.com/rs?type=doc&id=1683966.1

Ubuntu: new libssl packages.
New packages are available:
  Ubuntu 14.04 LTS: libssl1.0.0 1.0.1f-1ubuntu2.4
  Ubuntu 13.10: libssl1.0.0 1.0.1e-3ubuntu1.6
  Ubuntu 12.04 LTS: libssl1.0.0 1.0.1-4ubuntu5.16
  Ubuntu 10.04 LTS: libssl0.9.8 0.9.8k-7ubuntu8.21
Full Vigil@nce bulletin... (Free trial)

Computer vulnerabilities tracking service

Vigil@nce provides a computer vulnerability announce. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications. The Vigil@nce computer vulnerability tracking service alerts your teams of vulnerabilities or threats impacting your information system. Each administrator can customize the list of products for which he wants to receive vulnerability alerts.