CVE-2014-0198: Null Pointer Dereference
The dossl3write function in s3pkt.c in OpenSSL 1.x through 1.0.1g, when SSLMODERELEASEBUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that trigger an alert condition.
Other sources
The OpenBSD Project reports:
An attacker can trigger generation of an SSL alert which could cause a null pointer dereference.
External references: http://ftp.openbsd.org/pub/OpenBSD/patches/5.5/common/005openssl.patch.sig https://rt.openssl.org/Ticket/Display.html?user=guest&pass=guest&id=3321
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0198?
CVE-2014-0198 has a severity rating that indicates it can cause denial of service due to a NULL pointer dereference.
How do I fix CVE-2014-0198?
To fix CVE-2014-0198, upgrade OpenSSL to version 1.0.1h or later.
What versions of OpenSSL are affected by CVE-2014-0198?
OpenSSL versions from 1.0.0 through 1.0.1g are affected by CVE-2014-0198.
Can CVE-2014-0198 be exploited remotely?
Yes, CVE-2014-0198 allows remote attackers to trigger a denial of service condition.
What should I do if I'm using a vulnerable version of OpenSSL related to CVE-2014-0198?
If using a vulnerable version related to CVE-2014-0198, it is important to apply the security updates and patches provided by your distribution.