CVE-2014-3568

Published: Oct 19, 2014Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j does not properly enforce the no-ssl3 build option, which allows remote attackers to bypass intended access restrictions via an SSL 3.0 handshake, related to s23_clnt.c and s23_srvr.c.

Affected (34)

Products: Openssl: Openssl

Openssl

1 product

Openssl

Configuration A

34 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Up to 0.9.8zb
Openssl Openssl	Version 1.0.0
Openssl Openssl	Version 1.0.0 beta1
Openssl Openssl	Version 1.0.0 beta2
Openssl Openssl	Version 1.0.0 beta3
Openssl Openssl	Version 1.0.0 beta4
Openssl Openssl	Version 1.0.0 beta5
Openssl Openssl	Version 1.0.0a
Openssl Openssl	Version 1.0.0b
Openssl Openssl	Version 1.0.0c
Openssl Openssl	Version 1.0.0d
Openssl Openssl	Version 1.0.0e
Openssl Openssl	Version 1.0.0f
Openssl Openssl	Version 1.0.0g
Openssl Openssl	Version 1.0.0h
Openssl Openssl	Version 1.0.0i
Openssl Openssl	Version 1.0.0j
Openssl Openssl	Version 1.0.0k
Openssl Openssl	Version 1.0.0l
Openssl Openssl	Version 1.0.0m
Openssl Openssl	Version 1.0.0n
Openssl Openssl	Version 1.0.1
Openssl Openssl	Version 1.0.1 beta1
Openssl Openssl	Version 1.0.1 beta2
Openssl Openssl	Version 1.0.1 beta3
Openssl Openssl	Version 1.0.1a
Openssl Openssl	Version 1.0.1b
Openssl Openssl	Version 1.0.1c
Openssl Openssl	Version 1.0.1d
Openssl Openssl	Version 1.0.1e
Openssl Openssl	Version 1.0.1f
Openssl Openssl	Version 1.0.1g
Openssl Openssl	Version 1.0.1h
Openssl Openssl	Version 1.0.1i

Related CWEs

CWE-310

References (82)

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-015.txt.asc (unsafe URL)

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00008.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00001.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00003.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=141477196830952&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142103967620673&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142495837901899&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142624590206005&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142791032306609&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142804214608580&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=143290437727362&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=143290522027658&w=2

Source: secalert@redhat.com

http://secunia.com/advisories/59627

Source: secalert@redhat.com

http://secunia.com/advisories/61058

Source: secalert@redhat.com

http://secunia.com/advisories/61073

Source: secalert@redhat.com

http://secunia.com/advisories/61130

Source: secalert@redhat.com

http://secunia.com/advisories/61207

Source: secalert@redhat.com

http://secunia.com/advisories/61819

Source: secalert@redhat.com

http://secunia.com/advisories/61959

Source: secalert@redhat.com

http://secunia.com/advisories/62030

Source: secalert@redhat.com

http://secunia.com/advisories/62070

Source: secalert@redhat.com

http://secunia.com/advisories/62124

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-201412-39.xml

Source: secalert@redhat.com

http://support.apple.com/HT204244

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21686997

Source: secalert@redhat.com

http://www.debian.org/security/2014/dsa-3053

Source: secalert@redhat.com

http://www.securityfocus.com/bid/70585

Source: secalert@redhat.com

http://www.securitytracker.com/id/1031053

Source: secalert@redhat.com

https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_openssl6

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/97037

Source: secalert@redhat.com

https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=26a59d9b46574e457870197dffa802871b4c8fc7

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380

Source: secalert@redhat.com

https://kc.mcafee.com/corporate/index?page=content&id=SB10091

Source: secalert@redhat.com

https://support.apple.com/HT205217

Source: secalert@redhat.com

https://support.citrix.com/article/CTX216642

Source: secalert@redhat.com

https://www.openssl.org/news/secadv_20141015.txt

Source: secalert@redhat.com

Vendor Advisory

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-015.txt.asc (unsafe URL)