CVE-2014-3568: Medium severity openssl vulnerability

Q: What is the severity of CVE-2014-3568?

CVE-2014-3568 is classified as a high severity vulnerability due to its potential for remote exploitation.

Q: How do I fix CVE-2014-3568?

To fix CVE-2014-3568, upgrade OpenSSL to versions 0.9.8zc, 1.0.0o, or 1.0.1j or later.

Q: What types of attacks can CVE-2014-3568 facilitate?

CVE-2014-3568 allows remote attackers to bypass SSL 3.0 access restrictions, leading to possible man-in-the-middle attacks.

Q: Which versions of OpenSSL are affected by CVE-2014-3568?

CVE-2014-3568 affects OpenSSL versions prior to 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j.

Q: Is CVE-2014-3568 still a concern for modern systems?

Yes, CVE-2014-3568 is still a concern for systems running vulnerable versions of OpenSSL, even if they are not frequently updated.

Published Oct 19, 2014

Updated

OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j does not properly enforce the no-ssl3 build option, which allows remote attackers to bypass intended access restrictions via an SSL 3.0 handshake, related to s23clnt.c and s23srvr.c.

Affected Software

34 affected components

OpenSSL OpenSSL<=0.9.8zb

OpenSSL OpenSSL=1.0.0

OpenSSL OpenSSL=1.0.0-beta1

OpenSSL OpenSSL=1.0.0-beta2

OpenSSL OpenSSL=1.0.0-beta3

OpenSSL OpenSSL=1.0.0-beta4

OpenSSL OpenSSL=1.0.0-beta5

OpenSSL OpenSSL=1.0.0a

OpenSSL OpenSSL=1.0.0b

OpenSSL OpenSSL=1.0.0c

OpenSSL OpenSSL=1.0.0d

OpenSSL OpenSSL=1.0.0e

OpenSSL OpenSSL=1.0.0f

OpenSSL OpenSSL=1.0.0g

OpenSSL OpenSSL=1.0.0h

OpenSSL OpenSSL=1.0.0i

OpenSSL OpenSSL=1.0.0j

OpenSSL OpenSSL=1.0.0k

OpenSSL OpenSSL=1.0.0l

OpenSSL OpenSSL=1.0.0m

OpenSSL OpenSSL=1.0.0n

OpenSSL OpenSSL=1.0.1

OpenSSL OpenSSL=1.0.1-beta1

OpenSSL OpenSSL=1.0.1-beta2

OpenSSL OpenSSL=1.0.1-beta3

OpenSSL OpenSSL=1.0.1a

OpenSSL OpenSSL=1.0.1b

OpenSSL OpenSSL=1.0.1c

OpenSSL OpenSSL=1.0.1d

OpenSSL OpenSSL=1.0.1e

OpenSSL OpenSSL=1.0.1f

OpenSSL OpenSSL=1.0.1g

OpenSSL OpenSSL=1.0.1h

OpenSSL OpenSSL=1.0.1i

Remediation

Patch Available

https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=26a59d9b46574e457870197dffa802871b4c8fc7

Event History

Oct 19, 2014

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-3568?

CVE-2014-3568 is classified as a high severity vulnerability due to its potential for remote exploitation.

How do I fix CVE-2014-3568?