CVE-2014-5139

Published: Aug 13, 2014Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client application crash) via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite with the client.

Affected (12)

Products: Openssl: Openssl

Openssl

1 product

Openssl

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 1.0.1
Openssl Openssl	Version 1.0.1 beta1
Openssl Openssl	Version 1.0.1 beta2
Openssl Openssl	Version 1.0.1 beta3
Openssl Openssl	Version 1.0.1a
Openssl Openssl	Version 1.0.1b
Openssl Openssl	Version 1.0.1c
Openssl Openssl	Version 1.0.1d
Openssl Openssl	Version 1.0.1e
Openssl Openssl	Version 1.0.1f
Openssl Openssl	Version 1.0.1g
Openssl Openssl	Version 1.0.1h

References (94)

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc (unsafe URL)

Source: cret@cert.org

http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc

Source: cret@cert.org

http://lists.opensuse.org/opensuse-updates/2014-08/msg00036.html

Source: cret@cert.org

http://marc.info/?l=bugtraq&m=142350350616251&w=2

Source: cret@cert.org

http://marc.info/?l=bugtraq&m=142495837901899&w=2

Source: cret@cert.org

http://marc.info/?l=bugtraq&m=142624590206005&w=2

Source: cret@cert.org

http://marc.info/?l=bugtraq&m=142624619906067

Source: cret@cert.org

http://marc.info/?l=bugtraq&m=142624619906067&w=2

Source: cret@cert.org

http://marc.info/?l=bugtraq&m=142624679706236&w=2

Source: cret@cert.org

http://marc.info/?l=bugtraq&m=142624719706349&w=2

Source: cret@cert.org

http://marc.info/?l=bugtraq&m=142660345230545&w=2

Source: cret@cert.org

http://marc.info/?l=bugtraq&m=142791032306609&w=2

Source: cret@cert.org

http://marc.info/?l=bugtraq&m=143290437727362&w=2

Source: cret@cert.org

http://marc.info/?l=bugtraq&m=143290522027658&w=2

Source: cret@cert.org

http://secunia.com/advisories/59700

Source: cret@cert.org

http://secunia.com/advisories/59710

Source: cret@cert.org

http://secunia.com/advisories/59756

Source: cret@cert.org

http://secunia.com/advisories/60022

Source: cret@cert.org

http://secunia.com/advisories/60221

Source: cret@cert.org

http://secunia.com/advisories/60493

Source: cret@cert.org

http://secunia.com/advisories/60803

Source: cret@cert.org

http://secunia.com/advisories/60810

Source: cret@cert.org

http://secunia.com/advisories/60917

Source: cret@cert.org

http://secunia.com/advisories/60921

Source: cret@cert.org

http://secunia.com/advisories/61017

Source: cret@cert.org

http://secunia.com/advisories/61100

Source: cret@cert.org

http://secunia.com/advisories/61171

Source: cret@cert.org

http://secunia.com/advisories/61184

Source: cret@cert.org

http://secunia.com/advisories/61392

Source: cret@cert.org

http://secunia.com/advisories/61775

Source: cret@cert.org

http://secunia.com/advisories/61959

Source: cret@cert.org

http://security.gentoo.org/glsa/glsa-201412-39.xml

Source: cret@cert.org

http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15567.html

Source: cret@cert.org

http://www-01.ibm.com/support/docview.wss?uid=nas8N1020240

Source: cret@cert.org

http://www-01.ibm.com/support/docview.wss?uid=swg21682293

Source: cret@cert.org

http://www-01.ibm.com/support/docview.wss?uid=swg21683389

Source: cret@cert.org

http://www-01.ibm.com/support/docview.wss?uid=swg21686997

Source: cret@cert.org

http://www.debian.org/security/2014/dsa-2998

Source: cret@cert.org

http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htm

Source: cret@cert.org

http://www.securityfocus.com/bid/69077

Source: cret@cert.org

http://www.securitytracker.com/id/1030693

Source: cret@cert.org

http://www.tenable.com/security/tns-2014-06

Source: cret@cert.org

https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=80bd7b41b30af6ee96f519e629463583318de3b0

Source: cret@cert.org

https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=83764a989dcc87fbea337da5f8f86806fe767b7e

Source: cret@cert.org

https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-September/000196.html

Source: cret@cert.org

https://www.freebsd.org/security/advisories/FreeBSD-SA-14:18.openssl.asc

Source: cret@cert.org

https://www.openssl.org/news/secadv_20140806.txt

Source: cret@cert.org

Vendor Advisory

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc (unsafe URL)