CVE-2014-3470: Null Pointer Dereference
As per the upstream advisory:
OpenSSL TLS clients enabling anonymous ECDH ciphersuites are subject to a denial of service attack.
OpenSSL 1.0.0 users should upgrade to 1.0.0m. OpenSSL 1.0.1 users should upgrade to 1.0.1h.
Acknowledgements:
Red Hat would like to thank the OpenSSL project for reporting this issue. Upstream acknowledges Felix Gröbert and Ivan Fratrić of Google as the original reporters of this issue.
Other sources
The ssl3sendclientkeyexchange function in s3clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3470?
CVE-2014-3470 is considered a medium severity vulnerability due to its potential for denial of service attacks.
How do I fix CVE-2014-3470?
To fix CVE-2014-3470, upgrade OpenSSL to version 1.0.0m or 1.0.1h, depending on your current version.
Which OpenSSL versions are affected by CVE-2014-3470?
OpenSSL versions between 0.9.8 and 1.0.1h are affected by CVE-2014-3470.
Can CVE-2014-3470 be exploited remotely?
Yes, CVE-2014-3470 can be remotely exploited by attackers to induce a denial of service.
What applications can be impacted by CVE-2014-3470?
Applications relying on affected OpenSSL versions for secure communications may be impacted by CVE-2014-3470.