CVE-2014-0221: Medium severity OpenSSL OpenSSL vulnerability
As per the upstream advisory:
By sending an invalid DTLS handshake to an OpenSSL DTLS client, the code can be made to recurse, eventually crashing in a DoS attack.
Only applications using OpenSSL as a DTLS client are affected.
OpenSSL 0.9.8 DTLS users should upgrade to 0.9.8za OpenSSL 1.0.0 DTLS users should upgrade to 1.0.0m. OpenSSL 1.0.1 DTLS users should upgrade to 1.0.1h. .
Acknowledgements:
Red Hat would like to thank the OpenSSL project for reporting this issue. Upstream acknowledges Imre Rad of Search-Lab as the original reporter of this issue.
Other sources
The dtls1getmessagefragment function in d1both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0221?
CVE-2014-0221 has been classified as a moderate severity vulnerability due to its potential for denial of service attacks.
How do I fix CVE-2014-0221?
To fix CVE-2014-0221, update your OpenSSL installation to the recommended version which includes patches for this vulnerability.
Which versions of OpenSSL are affected by CVE-2014-0221?
CVE-2014-0221 affects OpenSSL versions prior to 0.9.8za and 1.0.0m.
What type of attack can exploit CVE-2014-0221?
CVE-2014-0221 can be exploited to launch a denial of service (DoS) attack against OpenSSL DTLS clients.
Who is vulnerable to CVE-2014-0221?
Applications utilizing OpenSSL as a DTLS client are vulnerable to CVE-2014-0221.