CVE-2014-0160

Published: Apr 7, 2014Modified: Apr 21, 2026CISA KEV

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

Affected (47)

Products: Openssl: Openssl · Filezilla Project: Filezilla Server · Siemens: Application Processing Engine Firmware, Cp 1543 1 Firmware, Simatic S7 1500 Firmware, Simatic S7 1500t Firmware, Elan 8.2, Wincc Open Architecture · +10 more

Show all products

1 product

1 product

6 products

Application Processing Engine Firmware

Cp 1543 1 Firmware

Simatic S7 1500 Firmware

Simatic S7 1500t Firmware

Elan 8.2

Wincc Open Architecture

2 products

2 products

1 product

1 product

1 product

9 products

Enterprise Linux Desktop

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Eus

Enterprise Linux Server Tus

Enterprise Linux Workstation

1 product

1 product

1 product

Symantec Messaging Gateway

Splunk

1 product

Splunk

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	From 1.0.1 to 1.0.1g

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Filezilla Project Filezilla Server	Before 0.9.44

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Application Processing Engine Firmware	Version 2.0

Running on/with	Platform Versions
Siemens Application Processing Engine	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Cp 1543 1 Firmware	Version 1.1

Running on/with	Platform Versions
Siemens Cp 1543 1	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic S7 1500 Firmware	Version 1.5

Running on/with	Platform Versions
Siemens Simatic S7 1500	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic S7 1500t Firmware	Version 1.5

Running on/with	Platform Versions
Siemens Simatic S7 1500t	All versions

Configuration G

2 vulnerable

Vulnerable Software	Affected Versions
Siemens Elan 8.2	Before 8.3.3
Siemens Wincc Open Architecture	Version 3.12

Configuration H

3 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Intellian V100 Firmware	Version 1.20
Intellian V100 Firmware	Version 1.21
Intellian V100 Firmware	Version 1.24

Running on/with	Platform Versions
Intellian V100	All versions

Configuration I

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Intellian V60 Firmware	Version 1.15
Intellian V60 Firmware	Version 1.25

Running on/with	Platform Versions
Intellian V60	All versions

Configuration J

11 vulnerable

Vulnerable Software	Affected Versions
Mitel Micollab	Version 6.0
Mitel Micollab	Version 7.0
Mitel Micollab	Version 7.1
Mitel Micollab	Version 7.2
Mitel Micollab	Version 7.3.0.104
Mitel Micollab	Version 7.3
Mitel Mivoice	Version 1.1.2.5
Mitel Mivoice	Version 1.1.3.3
Mitel Mivoice	Version 1.2.0.11
Mitel Mivoice	Version 1.3.2.2
Mitel Mivoice	Version 1.4.0.102

Configuration K

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 12.3
Opensuse Opensuse	Version 13.1

Configuration L

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 12.10
Canonical Ubuntu Linux	Version 13.10

Configuration M

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 19
Fedoraproject Fedora	Version 20

Configuration N

9 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server Aus	Version 6.5
Redhat Enterprise Linux Server Eus	Version 6.5
Redhat Enterprise Linux Server Tus	Version 6.5
Redhat Enterprise Linux Workstation	Version 6.0
Redhat Gluster Storage	Version 2.1
Redhat Storage	Version 2.1
Redhat Virtualization	Version 6.0

Configuration O

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 6.0
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ricon S9922l Firmware	Version 16.10.3(3794)

Running on/with	Platform Versions
Ricon S9922l	Version 1.0

Configuration Q

2 vulnerable

Vulnerable Software	Affected Versions
Broadcom Symantec Messaging Gateway	Version 10.6.0
Broadcom Symantec Messaging Gateway	Version 10.6.1

Configuration R

1 vulnerable

Vulnerable Software	Affected Versions
Splunk Splunk	From 6.0.0 to 6.0.3

Related CWEs

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (257)

http://advisories.mageia.org/MGASA-2014-0165.html

Source: secalert@redhat.com

Third Party Advisory

http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

http://cogentdatahub.com/ReleaseNotes.html

Source: secalert@redhat.com

Release Notes

http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-119-01

Source: secalert@redhat.com

Broken Link

http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=96db9023b881d7cd9f379b0c154650d6c108e9a3

Source: secalert@redhat.com

Broken Link

http://heartbleed.com/

Source: secalert@redhat.com

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131221.html

Source: secalert@redhat.com

Broken LinkThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131291.html

Source: secalert@redhat.com

Broken LinkThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00004.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00005.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-updates/2014-04/msg00061.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139722163017074&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139757726426985&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139757819327350&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139757919027752&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139758572430452&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139765756720506&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139774054614965&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139774703817488&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139808058921905&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139817685517037&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139817727317190&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139817782017443&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139824923705461&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139824993005633&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139833395230364&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139835815211508&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139835844111589&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139836085512508&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139842151128341&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139843768401936&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139869720529462&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139869891830365&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139889113431619&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139889295732144&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139905202427693&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139905243827825&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139905295427946&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139905351928096&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139905405728262&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139905458328378&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139905653828999&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=139905868529690&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=140015787404650&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=140075368411126&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=140724451518351&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=140752315422991&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=141287864628122&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=142660345230545&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=1

Source: secalert@redhat.com

Third Party Advisory

http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=3

Source: secalert@redhat.com

Permissions RequiredThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2014-0376.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2014-0377.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2014-0378.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2014-0396.html

Source: secalert@redhat.com

Third Party Advisory

http://seclists.org/fulldisclosure/2014/Apr/109

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2014/Apr/173

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2014/Apr/190

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2014/Apr/90

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2014/Apr/91

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2014/Dec/23

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://secunia.com/advisories/57347

Source: secalert@redhat.com

Broken LinkThird Party Advisory

http://secunia.com/advisories/57483

Source: secalert@redhat.com

Broken LinkThird Party Advisory

http://secunia.com/advisories/57721

Source: secalert@redhat.com

Broken LinkThird Party Advisory

http://secunia.com/advisories/57836

Source: secalert@redhat.com

Broken LinkThird Party Advisory

http://secunia.com/advisories/57966

Source: secalert@redhat.com

Broken LinkThird Party Advisory

http://secunia.com/advisories/57968

Source: secalert@redhat.com

Broken LinkThird Party Advisory

http://secunia.com/advisories/59139

Source: secalert@redhat.com

Broken LinkThird Party Advisory

http://secunia.com/advisories/59243

Source: secalert@redhat.com

Broken LinkThird Party Advisory

http://secunia.com/advisories/59347

Source: secalert@redhat.com

Broken LinkThird Party Advisory

http://support.citrix.com/article/CTX140605

Source: secalert@redhat.com

Third Party Advisory

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-heartbleed

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=isg400001841

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=isg400001843

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004661

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21670161

Source: secalert@redhat.com

Broken Link

http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf

Source: secalert@redhat.com

Broken LinkThird Party Advisory

http://www.blackberry.com/btsc/KB35882

Source: secalert@redhat.com

Broken Link

http://www.debian.org/security/2014/dsa-2896

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.exploit-db.com/exploits/32745

Source: secalert@redhat.com

ExploitThird Party AdvisoryVDB Entry

http://www.exploit-db.com/exploits/32764

Source: secalert@redhat.com

ExploitThird Party AdvisoryVDB Entry

http://www.f-secure.com/en/web/labs_global/fsc-2014-1

Source: secalert@redhat.com

Broken LinkThird Party Advisory

http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/

Source: secalert@redhat.com

Release Notes

http://www.getchef.com/blog/2014/04/09/chef-server-heartbleed-cve-2014-0160-releases/

Source: secalert@redhat.com

Third Party Advisory

http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/

Source: secalert@redhat.com

Release Notes

http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/

Source: secalert@redhat.com

Release Notes

http://www.innominate.com/data/downloads/manuals/mdm_1.5.2.1_Release_Notes.pdf

Source: secalert@redhat.com

Not Applicable

http://www.kb.cert.org/vuls/id/720951

Source: secalert@redhat.com

Third Party AdvisoryUS Government Resource

http://www.kerio.com/support/kerio-control/release-history

Source: secalert@redhat.com

Broken LinkThird Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2015:062

Source: secalert@redhat.com

Broken LinkThird Party Advisory

http://www.openssl.org/news/secadv_20140407.txt

Source: secalert@redhat.com

Broken LinkVendor Advisory

http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/topics/security/opensslheartbleedcve-2014-0160-2188454.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.securityfocus.com/archive/1/534161/100/0/threaded

Source: secalert@redhat.com

Broken LinkNot ApplicableThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/66690

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1030026

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1030074

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1030077

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1030078

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1030079

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1030080

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1030081

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1030082

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.splunk.com/view/SP-CAAAMB3

Source: secalert@redhat.com

Third Party Advisory

http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160512_00

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/USN-2165-1

Source: secalert@redhat.com

Third Party Advisory

http://www.us-cert.gov/ncas/alerts/TA14-098A

Source: secalert@redhat.com

Third Party AdvisoryUS Government Resource

http://www.vmware.com/security/advisories/VMSA-2014-0012.html

Source: secalert@redhat.com

Broken Link

http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0

Source: secalert@redhat.com

Broken Link

https://blog.torproject.org/blog/openssl-bug-cve-2014-0160

Source: secalert@redhat.com

Issue Tracking

https://bugzilla.redhat.com/show_bug.cgi?id=1084875

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-635659.pdf

Source: secalert@redhat.com

Third Party Advisory

https://code.google.com/p/mod-spdy/issues/detail?id=85

Source: secalert@redhat.com

Issue Tracking

https://filezilla-project.org/versions.php?type=server

Source: secalert@redhat.com

Release Notes

https://gist.github.com/chapmajs/10473815

Source: secalert@redhat.com

Exploit

https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04260637-4%257CdocLocale%253Den_US%257CcalledBy%253DSearch_Result&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken

Source: secalert@redhat.com

Broken Link

https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

Mailing ListPatchThird Party Advisory

https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

Mailing ListPatchThird Party Advisory

https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

Mailing ListPatchThird Party Advisory

https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

Mailing ListPatchThird Party Advisory

https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-April/000184.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://sku11army.blogspot.com/2020/01/heartbleed-hearts-continue-to-bleed.html

Source: secalert@redhat.com

ExploitPermissions RequiredThird Party Advisory

https://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html

Source: secalert@redhat.com

Third Party Advisory

https://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html?sr=36517217

Source: secalert@redhat.com

Third Party Advisory

https://www.cert.fi/en/reports/2014/vulnerability788210.html

Source: secalert@redhat.com

Not ApplicableThird Party Advisory

https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-17-0008

Source: secalert@redhat.com

Third Party Advisory

https://yunus-shn.medium.com/ricon-industrial-cellular-router-heartbleed-attack-2634221c02bd

Source: secalert@redhat.com

Broken LinkExploitThird Party Advisory

http://advisories.mageia.org/MGASA-2014-0165.html