CVE-2014-3566 | BDVDB-2026-64880 Detail
Description#
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact none, availability impact none. Attack vector: network.
Weaknesses#
- CWE-329 Generation of Predictable IV with CBC Mode
References#
- http://marc.info/?l=bugtraq&m=142103967620673&w=2
- http://aix.software.ibm.com/aix/efixes/security/openssl_advisory11.asc
- http://www.securitytracker.com/id/1031090
- http://blog.nodejs.org/2014/10/23/node-v0-10-33-stable/
- http://rhn.redhat.com/errata/RHSA-2014-1880.html
- http://marc.info/?l=bugtraq&m=142804214608580&w=2
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04819635
- http://www.kb.cert.org/vuls/id/577193
- http://marc.info/?l=bugtraq&m=141577087123040&w=2
- http://marc.info/?l=bugtraq&m=141715130023061&w=2
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00008.html
- https://support.apple.com/kb/HT6542
- http://www.securitytracker.com/id/1031106
- http://marc.info/?l=bugtraq&m=141697638231025&w=2
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
Show all 40
- http://marc.info/?l=openssl-dev&m=141333049205629&w=2
- http://marc.info/?l=bugtraq&m=142350298616097&w=2
- http://marc.info/?l=bugtraq&m=142350743917559&w=2
- http://secunia.com/advisories/60056
- http://rhn.redhat.com/errata/RHSA-2014-1877.html
- http://marc.info/?l=bugtraq&m=141477196830952&w=2
- http://secunia.com/advisories/61130
- http://rhn.redhat.com/errata/RHSA-2015-1546.html
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00018.html
- https://support.apple.com/kb/HT6529
- https://www.openssl.org/news/secadv_20141015.txt
- http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html
- http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0
- http://rhn.redhat.com/errata/RHSA-2014-1920.html
- http://www.securitytracker.com/id/1031087
- http://marc.info/?l=bugtraq&m=143628269912142&w=2
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667
- https://bto.bluecoat.com/security-advisory/sa83
- http://marc.info/?l=bugtraq&m=141879378918327&w=2
- http://support.citrix.com/article/CTX200238
- http://secunia.com/advisories/61359
- https://support.apple.com/kb/HT6541
- http://www.securitytracker.com/id/1031093
- http://www.securitytracker.com/id/1031132
- http://www.debian.org/security/2015/dsa-3144
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.