CVE-2011-0014: Medium severity openssl vulnerability

Published Feb 18, 2011

Updated

ssl/t1lib.c in OpenSSL 0.9.8h through 0.9.8q and 1.0.0 through 1.0.0c allows remote attackers to cause a denial of service (crash), and possibly obtain sensitive information in applications that use OpenSSL, via a malformed ClientHello handshake message that triggers an out-of-bounds memory access, aka "OCSP stapling vulnerability."

Affected Software

19 affected components

OpenSSL OpenSSL=0.9.8m

OpenSSL OpenSSL=0.9.8n

OpenSSL OpenSSL=0.9.8p

OpenSSL OpenSSL=0.9.8k

OpenSSL OpenSSL=0.9.8j

OpenSSL OpenSSL=0.9.8l

OpenSSL OpenSSL=0.9.8o

OpenSSL OpenSSL=0.9.8q

OpenSSL OpenSSL=0.9.8i

OpenSSL OpenSSL=0.9.8h

OpenSSL OpenSSL=1.0.0c

OpenSSL OpenSSL=1.0.0-beta1

OpenSSL OpenSSL=1.0.0-beta2

OpenSSL OpenSSL=1.0.0-beta3

OpenSSL OpenSSL=1.0.0-beta4

OpenSSL OpenSSL=1.0.0

OpenSSL OpenSSL=1.0.0-beta5

OpenSSL OpenSSL=1.0.0a

OpenSSL OpenSSL=1.0.0b

Remediation

Patch Available

http://www.openssl.org/news/secadv_20110208.txt

Event History

Feb 18, 2011

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-0014?

CVE-2011-0014 is classified as a medium severity vulnerability due to the potential for denial of service and exposure of sensitive information.

How do I fix CVE-2011-0014?

To mitigate CVE-2011-0014, upgrade to OpenSSL version 1.0.0d or later, which addresses this vulnerability.

What are the risks of CVE-2011-0014?

The risks of CVE-2011-0014 include application crashes and the potential for unauthorized access to sensitive data.

Which versions of OpenSSL are affected by CVE-2011-0014?

OpenSSL versions 0.9.8h through 0.9.8q and 1.0.0 through 1.0.0c are vulnerable to CVE-2011-0014.

Can CVE-2011-0014 be exploited remotely?

Yes, CVE-2011-0014 can be exploited remotely via a malformed ClientHello handshake message.