CVE-2014-3570

Published: Jan 9, 2015Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to crypto/bn/asm/mips.pl, crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c.

Affected (26)

Products: Openssl: Openssl

Openssl

1 product

Openssl

Configuration A

26 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Up to 0.9.8zc
Openssl Openssl	Version 1.0.0a
Openssl Openssl	Version 1.0.0b
Openssl Openssl	Version 1.0.0c
Openssl Openssl	Version 1.0.0d
Openssl Openssl	Version 1.0.0e
Openssl Openssl	Version 1.0.0f
Openssl Openssl	Version 1.0.0g
Openssl Openssl	Version 1.0.0h
Openssl Openssl	Version 1.0.0i
Openssl Openssl	Version 1.0.0j
Openssl Openssl	Version 1.0.0k
Openssl Openssl	Version 1.0.0l
Openssl Openssl	Version 1.0.0m
Openssl Openssl	Version 1.0.0n
Openssl Openssl	Version 1.0.0o
Openssl Openssl	Version 1.0.1a
Openssl Openssl	Version 1.0.1b
Openssl Openssl	Version 1.0.1c
Openssl Openssl	Version 1.0.1d
Openssl Openssl	Version 1.0.1e
Openssl Openssl	Version 1.0.1f
Openssl Openssl	Version 1.0.1g
Openssl Openssl	Version 1.0.1h
Openssl Openssl	Version 1.0.1i
Openssl Openssl	Version 1.0.1j

Related CWEs

CWE-310

References (82)

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10679

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147938.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148363.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00021.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00026.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142496179803395&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142496289803847&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142720981827617&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142721102728110&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142895206924048&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=143748090628601&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=144050155601375&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=144050205101530&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=144050254401665&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=144050297101809&w=2

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2015-0066.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2015-0849.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-1650.html

Source: secalert@redhat.com

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150310-ssl

Source: secalert@redhat.com

http://www.debian.org/security/2015/dsa-3125

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2015:019

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2015:062

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/71939

Source: secalert@redhat.com

http://www.securitytracker.com/id/1033378

Source: secalert@redhat.com

https://bto.bluecoat.com/security-advisory/sa88

Source: secalert@redhat.com

https://github.com/openssl/openssl/commit/a7a44ba55cb4f884c6bc9ceac90072dea38e66d0

Source: secalert@redhat.com

https://kc.mcafee.com/corporate/index?page=content&id=SB10102

Source: secalert@redhat.com

https://kc.mcafee.com/corporate/index?page=content&id=SB10108

Source: secalert@redhat.com

https://support.apple.com/HT204659

Source: secalert@redhat.com

https://support.citrix.com/article/CTX216642

Source: secalert@redhat.com

https://www.openssl.org/news/secadv_20150108.txt

Source: secalert@redhat.com

Vendor Advisory

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10679