CVE-2014-0160
En bref
- Sévérité
- HIGH 7.5
- Exploitation
- Exploitation connue (CISA KEV) · ajoutée le 2022-05-04
Exploitée selon l'ENISA depuis le 2022-05-04 - EPSS
- EPSS 100.00 % · centile 100 (2026-10-27)
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Analyzed
Description
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | CISA-ADP |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Faiblesses (CWE)
Références européennes
- ENISA EUVD · EUVD-2014-0217
- GCVE · GCVE-0-2014-0160
Avis du CERT-FR
- CERTFR-2014-AVI-213 — Vulnérabilité dans Microsoft Windows · cert.ssi.gouv.fr
- CERTFR-2014-AVI-201 — Multiples vulnérabilités dans les produits Apple · cert.ssi.gouv.fr
- CERTFR-2014-AVI-199 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2014-AVI-198 — Vulnérabilité dans Apache Tomcat · cert.ssi.gouv.fr
- CERTFR-2014-AVI-197 — Vulnérabilité dans les produits Huawei · cert.ssi.gouv.fr
- CERTFR-2014-AVI-181 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2014-AVI-180 — Vulnérabilité dans plusieurs produits F5 · cert.ssi.gouv.fr
- CERTFR-2014-AVI-179 — Vulnérabilité dans IBM AIX · cert.ssi.gouv.fr
- CERTFR-2014-AVI-178 — Vulnérabilité dans plusieurs produits Sophos · cert.ssi.gouv.fr
- CERTFR-2014-AVI-177 — Vulnérabilité dans plusieurs produits McAfee · cert.ssi.gouv.fr
- CERTFR-2014-AVI-169 — Vulnérabilité dans plusieurs produits Blue Coat · cert.ssi.gouv.fr
- CERTFR-2014-AVI-167 — Vulnérabilité dans OpenVPN Access Server · cert.ssi.gouv.fr
- CERTFR-2014-AVI-162 — Vulnérabilité dans plusieurs produits Juniper · cert.ssi.gouv.fr
- CERTFR-2014-AVI-161 — Vulnérabilité dans plusieurs produits Cisco · cert.ssi.gouv.fr
- CERTFR-2014-AVI-156 — Vulnérabilité dans OpenSSL · cert.ssi.gouv.fr
- CERTFR-2014-ALE-003 — Vulnérabilité dans OpenSSL · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*≥ 1.0.1 < 1.0.1gcpe:2.3:a:filezilla-project:filezilla_server:*:*:*:*:*:*:*:*< 0.9.44cpe:2.3:o:siemens:application_processing_engine_firmware:2.0:*:*:*:*:*:*:*cpe:2.3:o:siemens:cp_1543-1_firmware:1.1:*:*:*:*:*:*:*cpe:2.3:o:siemens:simatic_s7-1500_firmware:1.5:*:*:*:*:*:*:*cpe:2.3:o:siemens:simatic_s7-1500t_firmware:1.5:*:*:*:*:*:*:*cpe:2.3:a:siemens:elan-8.2:*:*:*:*:*:*:*:*< 8.3.3cpe:2.3:a:siemens:wincc_open_architecture:3.12:*:*:*:*:*:*:*cpe:2.3:o:intellian:v100_firmware:1.20:*:*:*:*:*:*:*cpe:2.3:o:intellian:v100_firmware:1.21:*:*:*:*:*:*:*cpe:2.3:o:intellian:v100_firmware:1.24:*:*:*:*:*:*:*cpe:2.3:o:intellian:v60_firmware:1.15:*:*:*:*:*:*:*cpe:2.3:o:intellian:v60_firmware:1.25:*:*:*:*:*:*:*cpe:2.3:a:mitel:micollab:6.0:*:*:*:*:*:*:*cpe:2.3:a:mitel:micollab:7.0:*:*:*:*:*:*:*cpe:2.3:a:mitel:micollab:7.1:*:*:*:*:*:*:*cpe:2.3:a:mitel:micollab:7.2:*:*:*:*:*:*:*cpe:2.3:a:mitel:micollab:7.3:*:*:*:*:*:*:*cpe:2.3:a:mitel:micollab:7.3.0.104:*:*:*:*:*:*:*cpe:2.3:a:mitel:mivoice:1.1.2.5:*:*:*:*:lync:*:*cpe:2.3:a:mitel:mivoice:1.1.3.3:*:*:*:*:skype_for_business:*:*cpe:2.3:a:mitel:mivoice:1.2.0.11:*:*:*:*:skype_for_business:*:*cpe:2.3:a:mitel:mivoice:1.3.2.2:*:*:*:*:skype_for_business:*:*cpe:2.3:a:mitel:mivoice:1.4.0.102:*:*:*:*:skype_for_business:*:*cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*cpe:2.3:a:redhat:gluster_storage:2.1:*:*:*:*:*:*:*cpe:2.3:a:redhat:storage:2.1:*:*:*:*:*:*:*cpe:2.3:a:redhat:virtualization:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:6.5:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:6.5:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*- +7 autres
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Références
- https://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html?sr=36517217
- http://www.securitytracker.com/id/1030077
- http://seclists.org/fulldisclosure/2014/Apr/90
- http://www.getchef.com/blog/2014/04/09/chef-server-heartbleed-cve-2014-0160-releases/
- http://www.debian.org/security/2014/dsa-2896
- http://marc.info/?l=bugtraq&m=139774054614965&w=2
- http://marc.info/?l=bugtraq&m=139889113431619&w=2
- http://rhn.redhat.com/errata/RHSA-2014-0396.html
- http://marc.info/?l=bugtraq&m=139835815211508&w=2
- http://marc.info/?l=bugtraq&m=141287864628122&w=2
- http://www.kb.cert.org/vuls/id/720951
- http://www.splunk.com/view/SP-CAAAMB3
- http://marc.info/?l=bugtraq&m=139905295427946&w=2
- http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0
- http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf
- http://marc.info/?l=bugtraq&m=139833395230364&w=2
- http://www-01.ibm.com/support/docview.wss?uid=swg21670161
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00004.html
- http://marc.info/?l=bugtraq&m=142660345230545&w=2
- http://seclists.org/fulldisclosure/2014/Apr/109
- http://marc.info/?l=bugtraq&m=140724451518351&w=2
- http://www.securitytracker.com/id/1030080
- http://secunia.com/advisories/57836
- http://www-01.ibm.com/support/docview.wss?uid=isg400001843
- http://marc.info/?l=bugtraq&m=139808058921905&w=2
- http://marc.info/?l=bugtraq&m=139758572430452&w=2
- http://www.securityfocus.com/bid/66690
- http://www.innominate.com/data/downloads/manuals/mdm_1.5.2.1_Release_Notes.pdf
- https://filezilla-project.org/versions.php?type=server
- http://marc.info/?l=bugtraq&m=139843768401936&w=2
- http://secunia.com/advisories/57483
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-heartbleed
- http://www.kerio.com/support/kerio-control/release-history
- http://advisories.mageia.org/MGASA-2014-0165.html
- http://www.blackberry.com/btsc/KB35882
- http://marc.info/?l=bugtraq&m=140075368411126&w=2
- http://marc.info/?l=bugtraq&m=139905351928096&w=2
- http://www.securitytracker.com/id/1030081
- http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131221.html
- http://www.securityfocus.com/archive/1/534161/100/0/threaded
- http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131291.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1084875
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html
- http://www-01.ibm.com/support/docview.wss?uid=isg400001841
- http://marc.info/?l=bugtraq&m=139824993005633&w=2
- http://www.securitytracker.com/id/1030079
- http://rhn.redhat.com/errata/RHSA-2014-0377.html
- http://marc.info/?l=bugtraq&m=139722163017074&w=2
- http://marc.info/?l=bugtraq&m=139889295732144&w=2
- +79 autres
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |