The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

computer weakness CVE-2014-0221

OpenSSL: denial of service via DTLS Recursion

Synthesis of the vulnerability

An attacker, who is located on a DTLS server, can use a malicious handshake, in order to trigger a denial of service in OpenSSL client applications.
Severity of this announce: 2/4.
Creation date: 05/06/2014.
Références of this computer vulnerability: aid-06062014, c04336637, c04363613, c04368523, CERTFR-2014-AVI-253, CERTFR-2014-AVI-254, CERTFR-2014-AVI-255, CERTFR-2014-AVI-260, CERTFR-2014-AVI-279, CERTFR-2014-AVI-286, cisco-sa-20140605-openssl, CTX140876, CVE-2014-0221, DOC-53313, DSA-2950-1, DSA-2950-2, FEDORA-2014-17576, FEDORA-2014-17587, FEDORA-2014-7101, FEDORA-2014-7102, FG-IR-14-018, FreeBSD-SA-14:14.openssl, HPSBMU03069, HPSBUX03046, JSA10629, KB36051, MDVSA-2014:105, MDVSA-2014:106, MDVSA-2015:062, NetBSD-SA2014-006, openSUSE-SU-2014:0764-1, openSUSE-SU-2014:0765-1, openSUSE-SU-2016:0640-1, RHSA-2014:0625-01, RHSA-2014:0628-01, RHSA-2014:0679-01, RHSA-2014:1019-01, RHSA-2014:1020-01, RHSA-2014:1021-01, RHSA-2014:1053-01, SA40006, SA80, SB10075, SOL15343, SSA:2014-156-03, SSRT101590, SUSE-SU-2014:0759-1, SUSE-SU-2014:0759-2, SUSE-SU-2014:0761-1, SUSE-SU-2014:0762-1, USN-2232-1, USN-2232-2, USN-2232-3, USN-2232-4, VIGILANCE-VUL-14845.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

The OpenSSL product implements DTLS, which uses a handshake.

However, a special handshake triggers an infinite recursion in the OpenSSL client.

An attacker, who is located on a DTLS server, can therefore use a malicious handshake, in order to trigger a denial of service in OpenSSL client applications.
Full Vigil@nce bulletin... (Free trial)

This vulnerability note impacts software or systems such as ArubaOS, BES, ProxyAV, ProxySG par Blue Coat, SGOS by Blue Coat, Cisco ASR, Cisco ATA, Cisco ACE, ASA, AsyncOS, Cisco Catalyst, CiscoWorks, Cisco Content SMA, Cisco CSS, Cisco ESA, IOS by Cisco, IOS XE Cisco, IOS XR Cisco, Cisco IPS, IronPort Email, IronPort Management, IronPort Web, Nexus by Cisco, NX-OS, Prime Collaboration Assurance, Prime Collaboration Manager, Prime Infrastructure, Cisco PRSM, Cisco Router, Secure ACS, Cisco CUCM, Cisco Manager Attendant Console, Cisco Unified CCX, Cisco IP Phone, Cisco MeetingPlace, Cisco Wireless IP Phone, Unity Cisco, WebNS, Cisco WSA, Debian, Avamar, EMC CAVA, EMC CEE, EMC CEPA, Celerra FAST, Celerra NS, Celerra NX4, EMC CMDCE, Connectrix Switch, ECC, NetWorker, PowerPath, Unisphere EMC, VNX Operating Environment, VNX Series, BIG-IP Hardware, TMOS, Fedora, FortiAnalyzer, FortiAnalyzer Virtual Appliance, FortiClient, FortiManager, FortiManager Virtual Appliance, FreeBSD, HP Operations, HP-UX, AIX, Juniper J-Series, Junos OS, Junos Pulse, Juniper Network Connect, Juniper UAC, McAfee Web Gateway, NetBSD, OpenBSD, OpenSSL, openSUSE, openSUSE Leap, Solaris, Polycom CMA, HDX, RealPresence Collaboration Server, Polycom VBP, RHEL, JBoss EAP by Red Hat, ACE Agent, ACE Server, RSA Authentication Agent, RSA Authentication Manager, SecurID, Slackware, stunnel, SUSE Linux Enterprise Desktop, SLES, Ubuntu.

Our Vigil@nce team determined that the severity of this cybersecurity vulnerability is medium.

The trust level is of type confirmed by the editor, with an origin of internet server.

An attacker with a expert ability can exploit this computer threat note.

Solutions for this threat

OpenSSL: version 1.0.1h.
The version 1.0.1h is fixed:
  http://www.openssl.org/

OpenSSL: version 1.0.0m.
The version 1.0.0m is fixed:
  http://www.openssl.org/

OpenSSL: version 0.9.8za.
Version 0.9.8za is fixed:
  http://www.openssl.org/

stunnel: version 5.02.
The version 5.02 is fixed:
  https://www.stunnel.org/downloads.html

AIX: patch for OpenSSL.
A patch is available in information sources.

Aruba: solution for OpenSSL.
The solution is indicated in information sources.

BlackBerry: solution for OpenSSL.
The solution is indicated in information sources.

Blue Coat: solution for OpenSSL.
The solution is indicated in information sources.

Cisco: solution for OpenSSL.
The solution is indicated in information sources.
Vulnerable products are listed in the information sources.

Debian: new openssl packages.
New packages are available:
  Debian 7: openssl 1.0.1e-2+deb7u11

EMC: solution for OpenSSL.
The solution is indicated in information sources.

F5 BIG-IP: solution for OpenSSL DTLS Recursion.
The solution is indicated in information sources.

Fedora: new mingw-openssl packages.
New packages are available:
  Fedora 20: mingw-openssl 1.0.1j-1.fc20
  Fedora 21: mingw-openssl 1.0.1j-1.fc21

Fedora: new openssl packages.
New packages are available:
  Fedora 19: openssl 1.0.1e-38.fc19
  Fedora 20: openssl 1.0.1e-38.fc20

Fortinet: solution for OpenSSL.
The solution is indicated in information sources.

FreeBSD: patch for openssl.
A patch is available in information sources.

HP Operations Analytics: solution for OpenSSL.
The solution is indicated in the following document:
  http://support.openview.hp.com/selfsolve/document/KM01020441

HP Operations Orchestration: solution for OpenSSL.
The solution is indicated in the following document:
  http://support.openview.hp.com/selfsolve/document/LID/OO_00030

HP-UX: fixed versions for OpenSSL.
Fixed versions are indicated in information sources.

Juniper: solution for OpenSSL.
The solution is indicated in information sources.

Mandriva BS2: new openssl packages.
New packages are available:
  Mandriva BS2: openssl 1.0.1m-1.mbs2

Mandriva BS: new openssl packages.
New packages are available:
  Mandriva BS1: openssl 1.0.0m-1.mbs1

Mandriva ES: new openssl packages.
New packages are available:
  Mandriva ES5: openssl 0.9.8h-3.18mdvmes5.2

McAfee Web Gateway: patch for OpenSSL.
A patch is available in information sources.

NetBSD: patch for OpenSSL.
A patch is available in information sources.

OpenBSD: patch for openssl.
A patch is available in information sources.

openSUSE: new libopenssl0_9_8 packages.
New packages are available:
  openSUSE 13.2: libopenssl0_9_8 0.9.8zh-9.3.1
  openSUSE Leap 42.1: libopenssl0_9_8 0.9.8zh-14.1

openSUSE: new openssl packages.
New packages are available:
  openSUSE 11.4: openssl 1.0.0m-18.53.1
  openSUSE 12.3: openssl 1.0.1h-1.60.1
  openSUSE 13.1: openssl 1.0.1h-11.48.1

Polycom Converged Management Application: version 5.2.6.
The version 5.2.6 is fixed.

Polycom HDX: version 3.1.5.
The version 3.1.5 is fixed.

Polycom RMX 1800/Collaboration Server: version 8.4.1.
The version 8.4.1 is fixed.

Polycom Video Border Proxy: version 11.2.18.
The version 11.2.18 is fixed.

Red Hat JBoss Enterprise: new Application Platform packages.
New packages are available, as indicated in information sources.

Red Hat Storage Server 2.1: new openssl packages.
New packages are available:
  RHEL 6: openssl 1.0.1e-16.el6_5.14

RHEL 5: new openssl packages.
New packages are available:
  RHEL 5: openssl 0.9.8e-27.el5_10.4

RHEL 6.5: new openssl packages.
New packages are available:
  RHEL 6: openssl 1.0.1e-16.el6_5.14

RHEL 7.0: new openssl packages.
New packages are available:
  RHEL 7: openssl 1.0.1e-34.el7_0.3

Slackware: new openssl packages.
New packages are available:
  Slackware 13.0: openssl 0.9.8za-i486-1_slack13.0
  Slackware 13.1: openssl 0.9.8za-i486-1_slack13.1
  Slackware 13.37: openssl 0.9.8za-i486-1_slack13.37
  Slackware 14.0: openssl 1.0.1h-i486-1_slack14.0
  Slackware 14.1: openssl 1.0.1h-i486-1_slack14.1

Solaris: version 11.1.20.5.0.
The version 11.1.20.5.0 is fixed:
  https://support.oracle.com/rs?type=doc&id=1683966.1

SUSE LE 10: new openssl packages.
New packages are available:
  SUSE LE 10: openssl 0.9.8a-18.82.4

SUSE LE 11: new openssl packages.
New packages are available:
  SUSE LE 11: openssl 0.9.8j-0.58.1

Ubuntu: new libssl packages.
New packages are available:
  Ubuntu 14.04 LTS: libssl1.0.0 1.0.1f-1ubuntu2.4
  Ubuntu 13.10: libssl1.0.0 1.0.1e-3ubuntu1.6
  Ubuntu 12.04 LTS: libssl1.0.0 1.0.1-4ubuntu5.16
  Ubuntu 10.04 LTS: libssl0.9.8 0.9.8k-7ubuntu8.21
Full Vigil@nce bulletin... (Free trial)

Computer vulnerabilities tracking service

Vigil@nce provides software vulnerability analysis. The Vigil@nce computer vulnerability tracking service alerts your teams of vulnerabilities or threats impacting your information system. Each administrator can customize the list of products for which he wants to receive vulnerability alerts. The technology watch team tracks security threats targeting the computer system.