Forced SSLv3 support in OpenSSL - CVE-2014-3568

Vulnerability identifier: #VU5215

CSH Severity: Low

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2014-3568

CWE-ID: CWE-749

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to force SSLv3 usage.

When OpenSSL is configured with "no-ssl3" as a build option, servers could accept and complete a SSL 3.0 handshake, and clients could be configured to send them. A remote attacker can force SSLv3 usage and perfom a variety of attacks against SSLv3 protocol

Successful exploitation of the vulnerability may allow an attacker to obtain potentially sensitive information.

OpenSSL
Debian Linux
Gentoo Linux
Amazon Linux AMI
SUSE Linux
Opensuse
Slackware Linux
openssl (Alpine package)
SUSE Studio Onsite
SUSE Manager
HP Insight Control
HP System Management Homepage
WMI Mapper
WebSphere Message Broker
FlashSystem 840 9840-AE1 & 9843-AE1
FlashSystem V840 9846-AE1 & 9848-AE1
SSL for OpenVMS
OnCommand Workflow Automation
Open Systems SnapVault Agent
Data ONTAP SMI-S Agent
TMS RAMSAN 710 & 810 Machine Type 9833 -AS1 & -AE1
FlashSystem 710 & 810 Machine Type 9830 -AS1 & -AE1
TMS RAMSAN 710 and 810 Machine Type 9834 -AS1 and -AE1
IBM FlashSystem 720 and 820 Machine Type 9831 –AS2 and -AE2
FlashSystem V840 9846-AC0 & -AC1 and 9848-AC0 & -AC1
IBM Integration Bus
OnCommand Unified Manager Core Package

Update OpenSSL to version 0.9.8zc, 1.0.0o or 1.0.1j.

openssl (Alpine package) - update to 1.0.1j-r0
WebSphere Message Broker - update to 8.0.0.6
IBM Integration Bus - update to 9.0.0.4
FlashSystem 840 9840-AE1 & 9843-AE1 - update to 1.1.3.2
FlashSystem V840 9846-AE1 & 9848-AE1 - update to 1.1.3.2
SSL for OpenVMS - update to 1.4-495
OnCommand Workflow Automation - update to 3.0
Open Systems SnapVault Agent - update to 3.0.1P6
Data ONTAP SMI-S Agent - update to 5.2.1
OnCommand Unified Manager Core Package - update to 5.2.1P1
TMS RAMSAN 710 & 810 Machine Type 9833 -AS1 & -AE1 - update to 5.6.2
FlashSystem 710 & 810 Machine Type 9830 -AS1 & -AE1 - update to 5.6.2
TMS RAMSAN 710 and 810 Machine Type 9834 -AS1 and -AE1 - update to 6.3.2
IBM FlashSystem 720 and 820 Machine Type 9831 –AS2 and -AE2 - update to 6.3.2
FlashSystem V840 9846-AC0 & -AC1 and 9848-AC0 & -AC1 - update to 7.3.0.8

• https://www.openssl.org/news/secadv/20141015.txt

• Multiple vulnerabilities in OpenSSL
• Debian update for openssl
• Slackware Linux update for openssl
• openSUSE update for openssl
• SUSE Linux update for OpenSSL
• SUSE Linux update for OpenSSL
• SUSE Linux update for OpenSSL
• SUSE Linux update for OpenSSL
• SUSE Linux update for OpenSSL
• SUSE Linux update for openssl1
• Amazon Linux AMI update for openssl
• Forced SSLv3 support in openssl (Alpine package)
• Gentoo update for OpenSSL
• Multiple vulnerabilities in IBM Websphere Message Broker and IBM Integration Bus
• Multiple vulnerabilities in IBM FlashSystem 840 and V840 systems
• Multiple vulnerabilities in IBM FlashSystem (and TMS RAMSAN) 710, 720, 810, and 820 systems
• Multiple vulnerabilities in HP Systems Insight Manager
• Multiple vulnerabilities in HP Insight Control server deployment on Linux and Windows
• Multiple vulnerabilities in HP SSL for OpenVMS
• Multiple vulnerabilities in Data ONTAP SMI-S Agent, OnCommand Workflow Automation, OnCommand Unified Manager Core Package and Open Systems SnapVault Agent