CVE-2014-3508: Infoleak
It was found that OBJobj2txt may cause pretty printing functions such as X509nameoneline, X509nameprintex, and others, to leak information from the stack. If applications echo pretty printing output, then a remote attacker could exploit this flaw to read information from the stack. OpenSSL clients and servers are not affected by this flaw; only applications that echo pretty printing output are affected.
Other sources
The OBJobj2txt function in crypto/objects/objdat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of '\0' characters, which allows context-dependent attackers to obtain sensitive information from process stack memory by reading output from X509nameoneline, X509nameprintex, and unspecified other functions.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3508?
CVE-2014-3508 is considered a medium severity vulnerability due to the potential for remote information leakage.
How do I fix CVE-2014-3508?
To fix CVE-2014-3508, update affected OpenSSL versions to 1.0.1h or later, or 0.9.8za or later.
What versions are affected by CVE-2014-3508?
CVE-2014-3508 affects OpenSSL versions 0.9.8 to 0.9.8y and 1.0.0 to 1.0.1g.
Can CVE-2014-3508 be exploited remotely?
Yes, CVE-2014-3508 can be exploited remotely if applications echo pretty printing output.
What applications are vulnerable to CVE-2014-3508?
Applications using OpenSSL's pretty printing functions like X509_name_oneline or X509_name_print_ex are vulnerable to CVE-2014-3508.