CVE-2014-3513

Published: Oct 19, 2014Modified: May 6, 2026

7.1

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Exploitability: 8.6 / Impact: 6.9

Source: NVD

Description

Memory leak in d1_srtp.c in the DTLS SRTP extension in OpenSSL 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted handshake message.

Affected (13)

Products: Openssl: Openssl

Openssl

1 product

Openssl

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 1.0.1
Openssl Openssl	Version 1.0.1 beta1
Openssl Openssl	Version 1.0.1 beta2
Openssl Openssl	Version 1.0.1 beta3
Openssl Openssl	Version 1.0.1a
Openssl Openssl	Version 1.0.1b
Openssl Openssl	Version 1.0.1c
Openssl Openssl	Version 1.0.1d
Openssl Openssl	Version 1.0.1e
Openssl Openssl	Version 1.0.1f
Openssl Openssl	Version 1.0.1g
Openssl Openssl	Version 1.0.1h
Openssl Openssl	Version 1.0.1i

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (84)

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-015.txt.asc (unsafe URL)

Source: secalert@redhat.com

http://advisories.mageia.org/MGASA-2014-0416.html

Source: secalert@redhat.com

http://aix.software.ibm.com/aix/efixes/security/openssl_advisory11.asc

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00008.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00001.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142118135300698&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142495837901899&w=2

Source: secalert@redhat.com

Patch

http://marc.info/?l=bugtraq&m=142624590206005&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142791032306609&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142804214608580&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142834685803386&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=143290437727362&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=143290522027658&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=143290583027876&w=2

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-1652.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-1692.html

Source: secalert@redhat.com

http://secunia.com/advisories/59627

Source: secalert@redhat.com

http://secunia.com/advisories/61058

Source: secalert@redhat.com

http://secunia.com/advisories/61073

Source: secalert@redhat.com

http://secunia.com/advisories/61207

Source: secalert@redhat.com

http://secunia.com/advisories/61298

Source: secalert@redhat.com

http://secunia.com/advisories/61439

Source: secalert@redhat.com

http://secunia.com/advisories/61837

Source: secalert@redhat.com

http://secunia.com/advisories/61959

Source: secalert@redhat.com

http://secunia.com/advisories/61990

Source: secalert@redhat.com

http://secunia.com/advisories/62070

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-201412-39.xml

Source: secalert@redhat.com

Patch

http://www-01.ibm.com/support/docview.wss?uid=swg21686997

Source: secalert@redhat.com

http://www.debian.org/security/2014/dsa-3053

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2015:062

Source: secalert@redhat.com

http://www.securityfocus.com/bid/70584

Source: secalert@redhat.com

http://www.securitytracker.com/id/1031052

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2385-1

Source: secalert@redhat.com

https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_openssl6

Source: secalert@redhat.com

https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=2b0532f3984324ebe1236a63d15893792384328d

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380

Source: secalert@redhat.com

https://kc.mcafee.com/corporate/index?page=content&id=SB10091

Source: secalert@redhat.com

https://support.apple.com/HT205217

Source: secalert@redhat.com

https://support.f5.com/kb/en-us/solutions/public/15000/700/sol15722.html

Source: secalert@redhat.com

https://www.openssl.org/news/secadv_20141015.txt

Source: secalert@redhat.com

Vendor Advisory

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-015.txt.asc (unsafe URL)