CVE-2014-0224 | BDVDB-2026-61978 Detail
Description#
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://secunia.com/advisories/59342
- http://secunia.com/advisories/59669
- http://secunia.com/advisories/59525
- http://marc.info/?l=bugtraq&m=140604261522465&w=2
- http://secunia.com/advisories/59004
- http://secunia.com/advisories/59530
- http://www-01.ibm.com/support/docview.wss?uid=swg21675626
- http://secunia.com/advisories/59824
- http://secunia.com/advisories/59282
- http://www.novell.com/support/kb/doc.php?id=7015300
- http://secunia.com/advisories/59215
- https://bugzilla.redhat.com/show_bug.cgi?id=1103586
- http://secunia.com/advisories/59990
- http://secunia.com/advisories/59264
- http://secunia.com/advisories/59454
Show all 40
- http://secunia.com/advisories/58492
- http://secunia.com/advisories/59186
- http://secunia.com/advisories/59188
- http://secunia.com/advisories/59126
- http://marc.info/?l=bugtraq&m=140672208601650&w=2
- http://marc.info/?l=bugtraq&m=140784085708882&w=2
- http://www.novell.com/support/kb/doc.php?id=7015264
- http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15325.html
- http://secunia.com/advisories/59306
- http://rhn.redhat.com/errata/RHSA-2014-0627.html
- http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0
- http://marc.info/?l=bugtraq&m=140544599631400&w=2
- http://rhn.redhat.com/errata/RHSA-2014-0626.html
- http://secunia.com/advisories/59190
- http://secunia.com/advisories/58639
- http://www-01.ibm.com/support/docview.wss?uid=swg21678289
- http://www.ibm.com/support/docview.wss?uid=swg21676877
- http://secunia.com/advisories/59446
- http://secunia.com/advisories/59529
- http://secunia.com/advisories/59445
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- http://secunia.com/advisories/59589
- http://secunia.com/advisories/59894
- http://secunia.com/advisories/59325
- http://secunia.com/advisories/59354
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.