CVE-2014-3506: Medium severity openssl vulnerability
A vulnerability in the processing of DTLS handshake messages was found that results in large amounts of memory being used. Once the Denial Of Service attack has ceased, the memory will be freed.
Other sources
d1both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via crafted DTLS handshake messages that trigger memory allocations corresponding to large length values.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3506?
CVE-2014-3506 has a severity rating of medium due to its potential to cause denial of service through excessive memory consumption during DTLS handshake messages.
How do I fix CVE-2014-3506?
To fix CVE-2014-3506, upgrade OpenSSL to version 0.9.8zb or later, or 1.0.0n or later, or 1.0.1 or later.
Which versions of OpenSSL are affected by CVE-2014-3506?
CVE-2014-3506 affects OpenSSL versions prior to 0.9.8zb, 1.0.0n, and 1.0.1.
Can CVE-2014-3506 lead to a system compromise?
No, CVE-2014-3506 primarily leads to denial of service and does not directly allow for system compromise.
Is CVE-2014-3506 specific to a certain protocol?
Yes, CVE-2014-3506 specifically affects the DTLS (Datagram Transport Layer Security) protocol implementation in OpenSSL.