Resource management error in OpenSSL - CVE-2014-0221

Vulnerability identifier: #VU11532

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2014-0221

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to an error when processing invalid DTLS handshake. A remote attacker can initiate SSL/TLS connection to the affected application and trigger denial of service conditions.

OpenSSL
HPE Operations Orchestration
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Fedora
Red Hat Enterprise Linux EUS Compute Node
SUSE Linux
Opensuse
Ubuntu
Slackware Linux
openssl (Ubuntu package)
mingw-openssl
Operations Analytics
TMS RAMSAN 710 & 810 Machine Type 9833 -AS1 & -AE1
FlashSystem 710 & 810 Machine Type 9830 -AS1 & -AE1
TMS RAMSAN 720 and 820 machine type 9834 -AS2 & AE2
IBM FlashSystem 720 and 820 Machine Type 9831 –AS2 and -AE2
IBM BladeCenter Advanced Management Module
HP Smart Update Manager

Update to version 0.9.8za, 1.0.0m or 1.0.1h.

openssl (Ubuntu package) - update to 0.9.8k-7ubuntu8.21
mingw-openssl - addressed in versions 1.0.1j-1.el7, 1.0.1j-1.fc21
IBM BladeCenter Advanced Management Module - update to 3.66F
TMS RAMSAN 710 & 810 Machine Type 9833 -AS1 & -AE1 - update to 5.6.2
FlashSystem 710 & 810 Machine Type 9830 -AS1 & -AE1 - update to 5.6.2
TMS RAMSAN 720 and 820 machine type 9834 -AS2 & AE2 - update to 6.3.2
IBM FlashSystem 720 and 820 Machine Type 9831 –AS2 and -AE2 - update to 6.3.2
HP Smart Update Manager - update to 6.4.1

• https://www.openssl.org/news/secadv/20140605.txt

• Multiple vulnerabilities in OpenSSL
• Ubuntu update for OpenSSL
• Ubuntu update for OpenSSL
• Ubuntu update for OpenSSL
• Ubuntu update for OpenSSL
• Gentoo update for OpenSSL
• Slackware Linux update for openssl
• SUSE Linux update for OpenSSL
• openSUSE update for openssl
• openSUSE update for openssl
• SUSE Linux update for OpenSSL 1.0
• SUSE Linux update for OpenSSL
• Red Hat update for openssl
• Red Hat update for openssl
• Multiple vulnerabilities in IBM FlashSystem (and TMS RAMSAN) 710, 720, 810, and 820 systems
• Multiple vulnerabilities in HP Software Operation Orchestration
• Multiple vulnerabilities in HP Operations Analytics
• Multiple vulnerabilities in HP Smart Update Manager (HP SUM)
• Multiple vulnerabilities in IBM BladeCenter Advanced Management Module
• Fedora 21 update for mingw-openssl
• Fedora EPEL 7 update for mingw-openssl