CVE-2014-0224

Scores

EPSS

0.897high89.7%
0%20%40%60%80%100%

Percentile: 89.7%

CVSS

7.4high3.x
0246810

CVSS Score: 7.4/10

All CVSS Scores

CVSS 3.x
7.4

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS 2.0
5.8

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N

Description

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the “CCS Injection” vulnerability.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

debiannvdredhatubuntu

CWEs

CWE-326CWE-841

Exploits

Exploit ID: CVE-2014-0224

Source: github-poc

URL: https://github.com/secretnonempty/CVE-2014-0224

Recommendations

Source: nvd

Apply an UpdateOpenSSL 0.9.8 SSL/TLS users (client and/or server) should upgrade to 0.9.8za.OpenSSL 1.0.0 SSL/TLS users (client and/or server) should upgrade to 1.0.0m.OpenSSL 1.0.1 SSL/TLS users (client and/or server) should upgrade to 1.0.1h.

URL: http://www.kb.cert.org/vuls/id/978508

Source: nvd

Before applying this update, make sure all previously released erratarelevant to your system have been applied.
This update is available via the Red Hat Network. Details on how touse the Red Hat Network to apply this update are available athttps://access.redhat.com/site/articles/11258

URL: http://rhn.redhat.com/errata/RHSA-2014-0680.html

Source: nvd

The References section of this erratum contains a download link (you mustlog in to download the update). Before applying the update, back up yourexisting Red Hat JBoss Web Server installation (including all applicationsand configuration files).

URL: http://rhn.redhat.com/errata/RHSA-2014-0632.html

Source: nvd

The References section of this erratum contains a download link (you mustlog in to download the update). Before applying this update, back up yourexisting Red Hat JBoss Enterprise Application Platform installation anddeployed applications (including all applications and configuration files).

URL: http://rhn.redhat.com/errata/RHSA-2014-0631.html

Source: nvd

The References section of this erratum contains a download link (you mustlog in to download the update). Before applying this update, back up yourexisting Red Hat JBoss Enterprise Application Platform installation anddeployed applications (including all applications and configuration files).

URL: http://rhn.redhat.com/errata/RHSA-2014-0630.html

Source: nvd

Before applying this update, make sure all previously released erratarelevant to your system have been applied.
This update is available via the Red Hat Network. Details on how touse the Red Hat Network to apply this update are available athttps://access.redhat.com/site/articles/11258

URL: http://rhn.redhat.com/errata/RHSA-2014-0627.html

Source: nvd

Before applying this update, make sure all previously released erratarelevant to your system have been applied.
This update is available via the Red Hat Network. Details on how touse the Red Hat Network to apply this update are available athttps://access.redhat.com/site/articles/11258

URL: http://rhn.redhat.com/errata/RHSA-2014-0626.html

Source: nvd

Before applying this update, make sure all previously released erratarelevant to your system have been applied.
This update is available via the Red Hat Network. Details on how touse the Red Hat Network to apply this update are available athttps://access.redhat.com/site/articles/11258

URL: http://rhn.redhat.com/errata/RHSA-2014-0624.html

Vulnerable Software (34)

Type: Configuration

Product: openssl

Operating System: rhel 6.2

Trait:
{  "fixed": "1.0.0-20.el6_2.7"}

Source: redhat

Type: Configuration

Product: openssl

Operating System: debian

Trait:
{  "fixed": "1.0.1h-1"}

Source: debian

Type: Configuration

Product: openssl

Operating System: rhel

Trait:
{  "fixed": "1.0.1e-16.el6_5.14"}

Source: redhat

Type: Configuration

Product: openssl

Operating System: rhel 7

Trait:
{  "fixed": "1.0.1e-34.el7_0.3"}

Source: redhat

Type: Configuration

Product: openssl

Operating System: rhel 6.4

Trait:
{  "fixed": "1.0.0-27.el6_4.4"}

Source: redhat

Type: Configuration

Product: openssl

Operating System: rhel 6.3

Trait:
{  "fixed": "1.0.0-25.el6_3.3"}

Source: redhat

Type: Configuration

Product: openssl

Operating System: debian squeeze 6

Trait:
{  "fixed": "0.9.8o-4squeeze15"}

Source: debian

Type: Configuration

Product: openssl

Operating System: rhel 6

Trait:
{  "fixed": "1.0.1e-16.el6_5.14"}

Source: redhat

Type: Configuration

Product: openssl

Operating System: rhel 5.9

Trait:
{  "fixed": "0.9.8e-26.el5_9.4"}

Source: redhat

Type: Configuration

Product: openssl

Operating System: rhel 5.6

Trait:
{  "fixed": "0.9.8e-12.el5_6.12"}

Source: redhat