CVE-2014-5139: Null Pointer Dereference

Published Aug 13, 2014

Updated

The sslsetclientdisabled function in t1lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client application crash) via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite with the client.

Affected Software

12 affected components

OpenSSL OpenSSL=1.0.1

OpenSSL OpenSSL=1.0.1-beta1

OpenSSL OpenSSL=1.0.1-beta2

OpenSSL OpenSSL=1.0.1-beta3

OpenSSL OpenSSL=1.0.1a

OpenSSL OpenSSL=1.0.1b

OpenSSL OpenSSL=1.0.1c

OpenSSL OpenSSL=1.0.1d

OpenSSL OpenSSL=1.0.1e

OpenSSL OpenSSL=1.0.1f

OpenSSL OpenSSL=1.0.1g

OpenSSL OpenSSL=1.0.1h

Event History

Aug 13, 2014

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-5139?

CVE-2014-5139 is classified as a high severity vulnerability due to its potential to cause a denial of service.

How do I fix CVE-2014-5139?

To fix CVE-2014-5139, you should upgrade OpenSSL to version 1.0.1i or later.

What types of systems are affected by CVE-2014-5139?

CVE-2014-5139 affects all versions of OpenSSL 1.0.1 prior to 1.0.1i, including beta releases.

What is the impact of CVE-2014-5139 on applications?

CVE-2014-5139 can lead to client application crashes due to a null pointer dereference.

Is CVE-2014-5139 related to any specific ciphersuites?

Yes, CVE-2014-5139 is specifically related to SRP ciphersuites in the SSL ServerHello message.