CVE-2015-0206: Buffer Overflow

Published Jan 9, 2015

Updated

Memory leak in the dtls1bufferrecord function in d1pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate records for the next epoch, leading to failure of replay detection.

Affected Software

25 affected components

OpenSSL OpenSSL=1.0.0a

OpenSSL OpenSSL=1.0.0b

OpenSSL OpenSSL=1.0.0c

OpenSSL OpenSSL=1.0.0d

OpenSSL OpenSSL=1.0.0e

OpenSSL OpenSSL=1.0.0f

OpenSSL OpenSSL=1.0.0g

OpenSSL OpenSSL=1.0.0h

OpenSSL OpenSSL=1.0.0i

OpenSSL OpenSSL=1.0.0j

OpenSSL OpenSSL=1.0.0k

OpenSSL OpenSSL=1.0.0l

OpenSSL OpenSSL=1.0.0m

OpenSSL OpenSSL=1.0.0n

OpenSSL OpenSSL=1.0.0o

OpenSSL OpenSSL=1.0.1a

OpenSSL OpenSSL=1.0.1b

OpenSSL OpenSSL=1.0.1c

OpenSSL OpenSSL=1.0.1d

OpenSSL OpenSSL=1.0.1e

OpenSSL OpenSSL=1.0.1f

OpenSSL OpenSSL=1.0.1g

OpenSSL OpenSSL=1.0.1h

OpenSSL OpenSSL=1.0.1i

OpenSSL OpenSSL=1.0.1j

Event History

Jan 9, 2015

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-0206?

CVE-2015-0206 has been classified as a medium severity vulnerability due to its potential for denial of service via memory consumption.

How do I fix CVE-2015-0206?

To mitigate CVE-2015-0206, upgrade OpenSSL to version 1.0.0p or 1.0.1k or later.

What systems are affected by CVE-2015-0206?

CVE-2015-0206 affects OpenSSL versions 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k across various systems.

What type of attack does CVE-2015-0206 enable?

CVE-2015-0206 allows remote attackers to conduct denial of service attacks through memory leaks.

Is authentication required to exploit CVE-2015-0206?

No, CVE-2015-0206 can be exploited without authentication, making it a serious concern for vulnerable systems.