CVE-2014-3507: Medium severity openssl vulnerability
It was found that an attacker could force OpenSSL to leak memory and never free it via DTLS packets.
Other sources
Memory leak in d1both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via zero-length DTLS fragments that trigger improper handling of the return value of a certain insert function.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3507?
CVE-2014-3507 is rated as a medium severity vulnerability as it allows remote attackers to cause a denial of service through a memory leak.
How do I fix CVE-2014-3507?
To fix CVE-2014-3507, you should upgrade OpenSSL to version 0.9.8zb or later, 1.0.0n or later, or 1.0.1i or later.
What versions of OpenSSL are affected by CVE-2014-3507?
CVE-2014-3507 affects OpenSSL versions prior to 0.9.8zb, 1.0.0n, and 1.0.1i.
What type of threat does CVE-2014-3507 pose?
CVE-2014-3507 poses a threat of denial of service due to a memory leak vulnerability when processing DTLS packets.
Is CVE-2014-3507 exploitable remotely?
Yes, CVE-2014-3507 can be exploited remotely, allowing attackers to trigger the vulnerability without physical access.