Severity: : Medium
  CVE Kennungen: : CVE-2014-3470
  Advisory Date: 21 lipca 2015

  DESCRIPTION

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value. nvd: Per: http://cwe.mitre.org/data/definitions/476.html "CWE-476: NULL Pointer Dereference"

  INFORMATION EXPOSURE

Apply associated Trend Micro DPI Rules.

  SOLUTION

  Trend Micro Deep Security DPI Rule Number: 1006162
  Trend Micro Deep Security DPI Rule Name: 1006162 - OpenSSL Anonymous ECDH Denial Of Service Vulnerability

  AFFECTED SOFTWARE AND VERSION:

  • fedoraproject fedora
  • openssl openssl 0.9.8
  • openssl openssl 0.9.8a
  • openssl openssl 0.9.8b
  • openssl openssl 0.9.8c
  • openssl openssl 0.9.8d
  • openssl openssl 0.9.8e
  • openssl openssl 0.9.8f
  • openssl openssl 0.9.8g
  • openssl openssl 0.9.8h
  • openssl openssl 0.9.8i
  • openssl openssl 0.9.8j
  • openssl openssl 0.9.8k
  • openssl openssl 0.9.8l
  • openssl openssl 0.9.8m
  • openssl openssl 0.9.8n
  • openssl openssl 0.9.8o
  • openssl openssl 0.9.8p
  • openssl openssl 0.9.8q
  • openssl openssl 0.9.8r
  • openssl openssl 0.9.8s
  • openssl openssl 0.9.8t
  • openssl openssl 0.9.8u
  • openssl openssl 0.9.8v
  • openssl openssl 0.9.8w
  • openssl openssl 0.9.8x
  • openssl openssl 0.9.8y
  • openssl openssl 1.0.0
  • openssl openssl 1.0.0a
  • openssl openssl 1.0.0b
  • openssl openssl 1.0.0c
  • openssl openssl 1.0.0d
  • openssl openssl 1.0.0e
  • openssl openssl 1.0.0f
  • openssl openssl 1.0.0g
  • openssl openssl 1.0.0h
  • openssl openssl 1.0.0i
  • openssl openssl 1.0.0j
  • openssl openssl 1.0.0k
  • openssl openssl 1.0.0l
  • openssl openssl 1.0.1
  • openssl openssl 1.0.1a
  • openssl openssl 1.0.1b
  • openssl openssl 1.0.1c
  • openssl openssl 1.0.1d
  • openssl openssl 1.0.1e
  • openssl openssl 1.0.1f
  • openssl openssl 1.0.1g
  • redhat enterprise_linux 5
  • redhat enterprise_linux 6
  • redhat storage 2.1