CVE-2014-3508

Published: Aug 13, 2014Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of '\0' characters, which allows context-dependent attackers to obtain sensitive information from process stack memory by reading output from X509_name_oneline, X509_name_print_ex, and unspecified other functions.

Affected (59)

Products: Openssl: Openssl

Openssl

1 product

Openssl

Configuration A

59 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 0.9.8
Openssl Openssl	Version 0.9.8a
Openssl Openssl	Version 0.9.8b
Openssl Openssl	Version 0.9.8c
Openssl Openssl	Version 0.9.8d
Openssl Openssl	Version 0.9.8e
Openssl Openssl	Version 0.9.8f
Openssl Openssl	Version 0.9.8g
Openssl Openssl	Version 0.9.8h
Openssl Openssl	Version 0.9.8i
Openssl Openssl	Version 0.9.8j
Openssl Openssl	Version 0.9.8k
Openssl Openssl	Version 0.9.8l
Openssl Openssl	Version 0.9.8m
Openssl Openssl	Version 0.9.8m beta1
Openssl Openssl	Version 0.9.8n
Openssl Openssl	Version 0.9.8o
Openssl Openssl	Version 0.9.8p
Openssl Openssl	Version 0.9.8q
Openssl Openssl	Version 0.9.8r
Openssl Openssl	Version 0.9.8s
Openssl Openssl	Version 0.9.8t
Openssl Openssl	Version 0.9.8u
Openssl Openssl	Version 0.9.8v
Openssl Openssl	Version 0.9.8w
Openssl Openssl	Version 0.9.8x
Openssl Openssl	Version 0.9.8y
Openssl Openssl	Version 0.9.8za
Openssl Openssl	Version 1.0.0
Openssl Openssl	Version 1.0.0 beta1
Openssl Openssl	Version 1.0.0 beta2
Openssl Openssl	Version 1.0.0 beta3
Openssl Openssl	Version 1.0.0 beta4
Openssl Openssl	Version 1.0.0 beta5
Openssl Openssl	Version 1.0.0a
Openssl Openssl	Version 1.0.0b
Openssl Openssl	Version 1.0.0c
Openssl Openssl	Version 1.0.0d
Openssl Openssl	Version 1.0.0e
Openssl Openssl	Version 1.0.0f
Openssl Openssl	Version 1.0.0g
Openssl Openssl	Version 1.0.0h
Openssl Openssl	Version 1.0.0i
Openssl Openssl	Version 1.0.0j
Openssl Openssl	Version 1.0.0k
Openssl Openssl	Version 1.0.0l
Openssl Openssl	Version 1.0.0m
Openssl Openssl	Version 1.0.1
Openssl Openssl	Version 1.0.1 beta1
Openssl Openssl	Version 1.0.1 beta2
Openssl Openssl	Version 1.0.1 beta3
Openssl Openssl	Version 1.0.1a
Openssl Openssl	Version 1.0.1b
Openssl Openssl	Version 1.0.1c
Openssl Openssl	Version 1.0.1d
Openssl Openssl	Version 1.0.1e
Openssl Openssl	Version 1.0.1f
Openssl Openssl	Version 1.0.1g
Openssl Openssl	Version 1.0.1h

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (140)

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc (unsafe URL)

Source: secalert@redhat.com

http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc

Source: secalert@redhat.com

http://linux.oracle.com/errata/ELSA-2014-1052.html

Source: secalert@redhat.com

http://linux.oracle.com/errata/ELSA-2014-1053.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2014-08/msg00036.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=140853041709441&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=140973896703549&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=141077370928502&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142495837901899&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142624590206005&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142660345230545&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142791032306609&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=143290437727362&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=143290522027658&w=2

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-1256.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-1297.html

Source: secalert@redhat.com

http://secunia.com/advisories/58962

Source: secalert@redhat.com

http://secunia.com/advisories/59221

Source: secalert@redhat.com

http://secunia.com/advisories/59700

Source: secalert@redhat.com

http://secunia.com/advisories/59710

Source: secalert@redhat.com

http://secunia.com/advisories/59743

Source: secalert@redhat.com

http://secunia.com/advisories/59756

Source: secalert@redhat.com

http://secunia.com/advisories/60022

Source: secalert@redhat.com

http://secunia.com/advisories/60221

Source: secalert@redhat.com

http://secunia.com/advisories/60410

Source: secalert@redhat.com

http://secunia.com/advisories/60493

Source: secalert@redhat.com

http://secunia.com/advisories/60684

Source: secalert@redhat.com

http://secunia.com/advisories/60687

Source: secalert@redhat.com

http://secunia.com/advisories/60778

Source: secalert@redhat.com

http://secunia.com/advisories/60803

Source: secalert@redhat.com

http://secunia.com/advisories/60824

Source: secalert@redhat.com

http://secunia.com/advisories/60861

Source: secalert@redhat.com

http://secunia.com/advisories/60917

Source: secalert@redhat.com

http://secunia.com/advisories/60921

Source: secalert@redhat.com

http://secunia.com/advisories/60938

Source: secalert@redhat.com

http://secunia.com/advisories/61017

Source: secalert@redhat.com

http://secunia.com/advisories/61100

Source: secalert@redhat.com

http://secunia.com/advisories/61171

Source: secalert@redhat.com

http://secunia.com/advisories/61184

Source: secalert@redhat.com

http://secunia.com/advisories/61214

Source: secalert@redhat.com

http://secunia.com/advisories/61250

Source: secalert@redhat.com

http://secunia.com/advisories/61392

Source: secalert@redhat.com

http://secunia.com/advisories/61775

Source: secalert@redhat.com

http://secunia.com/advisories/61959

Source: secalert@redhat.com

http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15571.html

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=nas8N1020240

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21681752

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21682293

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21683389

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21686997

Source: secalert@redhat.com

http://www.debian.org/security/2014/dsa-2998

Source: secalert@redhat.com

http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htm

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2014:158

Source: secalert@redhat.com

http://www.securityfocus.com/bid/69075

Source: secalert@redhat.com

http://www.securitytracker.com/id/1030693

Source: secalert@redhat.com

http://www.tenable.com/security/tns-2014-06

Source: secalert@redhat.com

https://blogs.oracle.com/sunsecurity/entry/cve_2014_3508_information_disclosure

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1127490

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/95165

Source: secalert@redhat.com

https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=0042fb5fd1c9d257d713b15a1f45da05cf5c1c87

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380

Source: secalert@redhat.com

https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-September/000196.html

Source: secalert@redhat.com

https://support.citrix.com/article/CTX216642

Source: secalert@redhat.com

https://www.freebsd.org/security/advisories/FreeBSD-SA-14:18.openssl.asc

Source: secalert@redhat.com

https://www.openssl.org/news/secadv_20140806.txt

Source: secalert@redhat.com

Vendor Advisory

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc (unsafe URL)