#VU41411 Race condition in OpenSSL - CVE-2014-3509

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU41411

#VU41411 Race condition in OpenSSL - CVE-2014-3509

Published: August 14, 2014 / Updated: August 10, 2020


Vulnerability identifier: #VU41411
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2014-3509
CWE-ID: CWE-362
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
OpenSSL
Software vendor:
OpenSSL Software Foundation

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data.


Remediation

Install update from vendor's website.

External links