CVE-2014-0195: Buffer Overflow
As per the upstream advisory:
A buffer overrun attack can be triggered by sending invalid DTLS fragments to an OpenSSL DTLS client or server. This is potentially exploitable to run arbitrary code on a vulnerable client or server.
Only applications using OpenSSL as a DTLS client or server affected.
OpenSSL 0.9.8 DTLS users should upgrade to 0.9.8za OpenSSL 1.0.0 DTLS users should upgrade to 1.0.0m. OpenSSL 1.0.1 DTLS users should upgrade to 1.0.1h.
Acknowledgements:
Red Hat would like to thank the OpenSSL project for reporting this issue. Upstream acknowledges Jüri Aedla as the original reporter of this issue.
Other sources
The dtls1reassemblefragment function in d1both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0195?
CVE-2014-0195 is considered a high-severity vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2014-0195?
To fix CVE-2014-0195, upgrade OpenSSL to versions 1.0.1h or later, or 0.9.8za or later.
Which versions of OpenSSL are affected by CVE-2014-0195?
CVE-2014-0195 affects OpenSSL versions 0.9.8 through 0.9.8za and 1.0.0 through 1.0.1g.
Is CVE-2014-0195 exploitable remotely?
Yes, CVE-2014-0195 can be exploited remotely by sending crafted DTLS fragments.
What types of applications are impacted by CVE-2014-0195?
Applications using OpenSSL as a DTLS client or server are impacted by CVE-2014-0195.