Race condition in OpenSSL - CVE-2014-3509

Vulnerability identifier: #VU41411

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2014-3509

CWE-ID: CWE-362

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data.

OpenSSL
Gentoo Linux
Amazon Linux AMI
Slackware Linux
Fedora
HP Insight Control
HP System Management Homepage
WMI Mapper
FlashSystem V840 9846-AE1 & 9848-AE1
FlashSystem 840 9840-AE1 & 9843-AE1
TMS RAMSAN 710 & 810 Machine Type 9833 -AS1 & -AE1
FlashSystem 710 & 810 Machine Type 9830 -AS1 & -AE1
TMS RAMSAN 720 and 820 machine type 9834 -AS2 & AE2
IBM FlashSystem 720 and 820 Machine Type 9831 –AS2 and -AE2
FlashSystem V840 9846-AC0 & -AC1 and 9848-AC0 & -AC1
mingw-openssl
IBM Storwize V5000
IBM Storwize V3500
IBM Storwize V3700
IBM Storwize V7000
SAN Volume Controller and Storwize Family
HPE Service Manager

Install update from vendor's website.

mingw-openssl - update to 1.0.1j-1.fc21
FlashSystem V840 9846-AE1 & 9848-AE1 - update to 1.1.2.7
FlashSystem 840 9840-AE1 & 9843-AE1 - update to 1.1.2.7
TMS RAMSAN 710 & 810 Machine Type 9833 -AS1 & -AE1 - update to 5.6.2
FlashSystem 710 & 810 Machine Type 9830 -AS1 & -AE1 - update to 5.6.2
TMS RAMSAN 720 and 820 machine type 9834 -AS2 & AE2 - update to 6.3.2
IBM FlashSystem 720 and 820 Machine Type 9831 –AS2 and -AE2 - update to 6.3.2
IBM Storwize V5000 - addressed in versions 7.2.0.9, 7.3.0.7, 7.4.0.0
SAN Volume Controller and Storwize Family - addressed in versions 7.2.0.9, 7.3.0.7, 7.4.0.0
IBM Storwize V3500 - addressed in versions 7.2.0.9, 7.3.0.7, 7.4.0.0
IBM Storwize V3700 - addressed in versions 7.2.0.9, 7.3.0.7, 7.4.0.0
IBM Storwize V7000 - update to 7.2.0.9
FlashSystem V840 9846-AC0 & -AC1 and 9848-AC0 & -AC1 - update to 7.3.0.7
HPE Service Manager - addressed in versions 7.11.720 p22, 9.21.706 P9, 9.34.2003 p2

• ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc
• http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc
• http://linux.oracle.com/errata/ELSA-2014-1052.html
• http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html
• http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html
• http://lists.opensuse.org/opensuse-updates/2014-08/msg00036.html
• http://marc.info/?l=bugtraq&m=142350350616251&w=2
• http://marc.info/?l=bugtraq&m=142495837901899&w=2
• http://marc.info/?l=bugtraq&m=142624590206005&w=2
• http://marc.info/?l=bugtraq&m=142660345230545&w=2
• http://marc.info/?l=bugtraq&m=142791032306609&w=2
• http://marc.info/?l=bugtraq&m=143290437727362&w=2
• http://marc.info/?l=bugtraq&m=143290522027658&w=2
• http://rhn.redhat.com/errata/RHSA-2015-0197.html
• http://secunia.com/advisories/58962
• http://secunia.com/advisories/59700
• http://secunia.com/advisories/59710
• http://secunia.com/advisories/59756
• http://secunia.com/advisories/60022
• http://secunia.com/advisories/60221
• http://secunia.com/advisories/60493
• http://secunia.com/advisories/60684
• http://secunia.com/advisories/60803
• http://secunia.com/advisories/60917
• http://secunia.com/advisories/60921
• http://secunia.com/advisories/60938
• http://secunia.com/advisories/61017
• http://secunia.com/advisories/61100
• http://secunia.com/advisories/61139
• http://secunia.com/advisories/61184
• http://secunia.com/advisories/61775
• http://secunia.com/advisories/61959
• http://security.gentoo.org/glsa/glsa-201412-39.xml
• http://www.debian.org/security/2014/dsa-2998
• http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htm
• http://www.mandriva.com/security/advisories?name=MDVSA-2014:158
• http://www.securityfocus.com/bid/69084
• http://www.securitytracker.com/id/1030693
• http://www-01.ibm.com/support/docview.wss?uid=nas8N1020240
• http://www-01.ibm.com/support/docview.wss?uid=swg21682293
• http://www-01.ibm.com/support/docview.wss?uid=swg21683389
• http://www-01.ibm.com/support/docview.wss?uid=swg21686997
• https://bugzilla.redhat.com/show_bug.cgi?id=1127498
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95159
• https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=fb0bc2b273bcc2d5401dd883fe869af4fc74bb21
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380
• https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-September/000196.html
• https://support.citrix.com/article/CTX216642
• https://techzone.ergon.ch/CVE-2014-3511
• https://www.freebsd.org/security/advisories/FreeBSD-SA-14:18.openssl.asc
• https://www.openssl.org/news/secadv_20140806.txt

• Multiple vulnerabilities in OpenSSL
• Amazon Linux AMI update for openssl
• Gentoo update for OpenSSL
• Slackware Linux update for openssl
• Multiple vulnerabilities in IBM FlashSystem 840 and V840
• Multiple vulnerabilities in IBM FlashSystem (and TMS RAMSAN) 710, 720, 810, and 820 systems
• Multiple vulnerabilities in HP Systems Insight Manager
• Multiple vulnerabilities in HP Insight Control server deployment on Linux and Windows
• Multiple vulnerabilities in HP Service Manager
• Multiple vulnerabilities in Lenovo SAN Volume Controller and Storwize Family
• Multiple vulnerabilities in IBM SAN Volume Controller and Storwize Family
• Fedora 21 update for mingw-openssl