CVE-2014-3571: Null Pointer Dereference
OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DTLS message that is processed with a different read operation for the handshake header than for the handshake body, related to the dtls1getrecord function in d1pkt.c and the ssl3readn function in s3pkt.c.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3571?
CVE-2014-3571 has a severity rating of Medium, as it allows remote attackers to cause a denial of service.
How do I fix CVE-2014-3571?
Fix CVE-2014-3571 by upgrading OpenSSL to version 0.9.8zd, 1.0.0p, or 1.0.1k or later.
Which versions of OpenSSL are affected by CVE-2014-3571?
CVE-2014-3571 affects OpenSSL versions prior to 0.9.8zd, 1.0.0p, and 1.0.1k.
Can CVE-2014-3571 be exploited remotely?
Yes, CVE-2014-3571 can be exploited remotely through a specially crafted DTLS message.
What kind of impact does CVE-2014-3571 have on applications?
CVE-2014-3571 can cause applications using affected OpenSSL versions to crash due to NULL pointer dereference.