CVE-2014-3567

Published: Oct 19, 2014Modified: May 6, 2026

7.1

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Exploitability: 8.6 / Impact: 6.9

Source: NVD

Description

Memory leak in the tls_decrypt_ticket function in t1_lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted session ticket that triggers an integrity-check failure.

Affected (34)

Products: Openssl: Openssl

Openssl

1 product

Openssl

Configuration A

34 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Up to 0.9.8zb
Openssl Openssl	Version 1.0.0
Openssl Openssl	Version 1.0.0 beta1
Openssl Openssl	Version 1.0.0 beta2
Openssl Openssl	Version 1.0.0 beta3
Openssl Openssl	Version 1.0.0 beta4
Openssl Openssl	Version 1.0.0 beta5
Openssl Openssl	Version 1.0.0a
Openssl Openssl	Version 1.0.0b
Openssl Openssl	Version 1.0.0c
Openssl Openssl	Version 1.0.0d
Openssl Openssl	Version 1.0.0e
Openssl Openssl	Version 1.0.0f
Openssl Openssl	Version 1.0.0g
Openssl Openssl	Version 1.0.0h
Openssl Openssl	Version 1.0.0i
Openssl Openssl	Version 1.0.0j
Openssl Openssl	Version 1.0.0k
Openssl Openssl	Version 1.0.0l
Openssl Openssl	Version 1.0.0m
Openssl Openssl	Version 1.0.0n
Openssl Openssl	Version 1.0.1
Openssl Openssl	Version 1.0.1 beta1
Openssl Openssl	Version 1.0.1 beta2
Openssl Openssl	Version 1.0.1 beta3
Openssl Openssl	Version 1.0.1a
Openssl Openssl	Version 1.0.1b
Openssl Openssl	Version 1.0.1c
Openssl Openssl	Version 1.0.1d
Openssl Openssl	Version 1.0.1e
Openssl Openssl	Version 1.0.1f
Openssl Openssl	Version 1.0.1g
Openssl Openssl	Version 1.0.1h
Openssl Openssl	Version 1.0.1i

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-399

References (112)

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-015.txt.asc (unsafe URL)

Source: secalert@redhat.com

http://advisories.mageia.org/MGASA-2014-0416.html

Source: secalert@redhat.com

http://aix.software.ibm.com/aix/efixes/security/openssl_advisory11.asc

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00008.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00001.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00003.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=141477196830952&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142103967620673&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142118135300698&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142495837901899&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142624590206005&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142791032306609&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142804214608580&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142834685803386&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=143290437727362&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=143290522027658&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=143290583027876&w=2

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-1652.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-1692.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2015-0126.html

Source: secalert@redhat.com

http://secunia.com/advisories/59627

Source: secalert@redhat.com

http://secunia.com/advisories/61058

Source: secalert@redhat.com

http://secunia.com/advisories/61073

Source: secalert@redhat.com

http://secunia.com/advisories/61130

Source: secalert@redhat.com

http://secunia.com/advisories/61207

Source: secalert@redhat.com

http://secunia.com/advisories/61298

Source: secalert@redhat.com

http://secunia.com/advisories/61819

Source: secalert@redhat.com

http://secunia.com/advisories/61837

Source: secalert@redhat.com

http://secunia.com/advisories/61959

Source: secalert@redhat.com

http://secunia.com/advisories/61990

Source: secalert@redhat.com

http://secunia.com/advisories/62030

Source: secalert@redhat.com

http://secunia.com/advisories/62070

Source: secalert@redhat.com

http://secunia.com/advisories/62124

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-201412-39.xml

Source: secalert@redhat.com

http://support.apple.com/HT204244

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21686997

Source: secalert@redhat.com

http://www.debian.org/security/2014/dsa-3053

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2014:203

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2015:062

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/70586

Source: secalert@redhat.com

http://www.securitytracker.com/id/1031052

Source: secalert@redhat.com

http://www.splunk.com/view/SP-CAAANST

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2385-1

Source: secalert@redhat.com

https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_openssl6

Source: secalert@redhat.com

https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=7fd4ce6a997be5f5c9e744ac527725c2850de203

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380

Source: secalert@redhat.com

https://kc.mcafee.com/corporate/index?page=content&id=SB10091

Source: secalert@redhat.com

https://support.apple.com/HT205217

Source: secalert@redhat.com

https://support.citrix.com/article/CTX216642

Source: secalert@redhat.com

https://www.openssl.org/news/secadv_20141015.txt

Source: secalert@redhat.com

Vendor Advisory

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-015.txt.asc (unsafe URL)