製品・ソフトウェアに関する情報

JVN脆弱性詳細

OpenSSL の DTLS の実装の d1_both.c におけるサービス運用妨害 (DoS) の脆弱性

Title	OpenSSL の DTLS の実装の d1_both.c におけるサービス運用妨害 (DoS) の脆弱性
Summary	OpenSSL の DTLS の実装の d1_both.c には、メモリリークにより、サービス運用妨害 (メモリ消費) 状態にされる脆弱性が存在します。
Possible impacts	第三者により、特定の insert 関数の戻り値の不適切な処理を誘発する zero-length DTLS フラグメントを介して、サービス運用妨害 (メモリ消費) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Aug. 6, 2014, midnight
Registration Date	Aug. 15, 2014, 4:48 p.m.
Last Update	June 9, 2015, 6 p.m.

CVSS2.0 : 警告
Score	5
Vector	AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected System

ヒューレット・パッカード

HP Virtual Connect 8Gb 24ポートファイバーチャネルモジュール 3.00 未満 (VC (バーチャルコネクト) 4.40 未満)

OpenSSL Project

OpenSSL 0.9.8 以上 0.9.8zb 未満

OpenSSL 1.0.0 以上 1.0.0n 未満

OpenSSL 1.0.1 以上 1.0.1i 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-3507	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3507
National Vulnerability Database (NVD)
2	CVE-2014-3507	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3507

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-399	https://jvndb.jvn.jp/ja/cwe/CWE-399.html

ベンダー情報

No	Name	URL
HP Security Bulletin
1	HPSBHF03293	http://marc.info/?l=bugtraq&m=142660345230545&w=2
2	HPSBOV03099 SSRT101686	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04426586
3	HPSBUX03095 SSRT101674	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04404655
IBM Support Document
4	1682293	http://www-01.ibm.com/support/docview.wss?uid=swg21682293
5	1686997	http://www-01.ibm.com/support/docview.wss?uid=swg21686997
OpenSSL Project
6	Fix memory leak from zero-length DTLS fragments.	https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=d0a4b7d1a2948fce38515b8d862f43e7ba0ebf74
OpenSSL Security Advisory
7	DTLS memory leak from zero-length fragments (CVE-2014-3507)	https://www.openssl.org/news/secadv_20140806.txt
Security Advisory
8	Huawei-SA-20141008-OpenSSL	http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htm

Change Log

No	Changed Details	Date of change
0	[2014年08月15日] 掲載 [2014年11月14日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：ヒューレット・パッカード (HPSBUX03095 SSRT101674) を追加ベンダ情報：ヒューレット・パッカード (HPSBOV03099 SSRT101686) を追加 [2014年11月28日] ベンダ情報：IBM (1682293) を追加ベンダ情報：IBM (1686997) を追加ベンダ情報：Huawei (Huawei-SA-20141008-OpenSSL) を追加 [2015年06月09日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：ヒューレット・パッカード (HPSBHF03293) を追加	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2014-3507

Summary	Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via zero-length DTLS fragments that trigger improper handling of the return value of a certain insert function.
Publication Date	Aug. 14, 2014, 8:55 a.m.
Registration Date	Jan. 26, 2021, 3:10 p.m.
Last Update	Nov. 21, 2024, 11:08 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:openssl:openssl:0.9.8b:::::::*
cpe:2.3:a:openssl:openssl:0.9.8m:::::::*
cpe:2.3:a:openssl:openssl:1.0.1:beta2::::::
cpe:2.3:a:openssl:openssl:0.9.8c:::::::*
cpe:2.3:a:openssl:openssl:1.0.0c:::::::*
cpe:2.3:a:openssl:openssl:1.0.0i:::::::*
cpe:2.3:a:openssl:openssl:1.0.0:beta1::::::
cpe:2.3:a:openssl:openssl:1.0.1h:::::::*
cpe:2.3:a:openssl:openssl:0.9.8n:::::::*
cpe:2.3:a:openssl:openssl:1.0.0:beta2::::::
cpe:2.3:a:openssl:openssl:0.9.8p:::::::*
cpe:2.3:a:openssl:openssl:1.0.0m:::::::*
cpe:2.3:a:openssl:openssl:1.0.1c:::::::*
cpe:2.3:a:openssl:openssl:0.9.8e:::::::*
cpe:2.3:a:openssl:openssl:0.9.8u:::::::*
cpe:2.3:a:openssl:openssl:0.9.8za:::::::*
cpe:2.3:a:openssl:openssl:1.0.1g:::::::*
cpe:2.3:a:openssl:openssl:0.9.8g:::::::*
cpe:2.3:a:openssl:openssl:1.0.0h:::::::*
cpe:2.3:a:openssl:openssl:0.9.8k:::::::*
cpe:2.3:a:openssl:openssl:0.9.8m:beta1::::::
cpe:2.3:a:openssl:openssl:0.9.8d:::::::*
cpe:2.3:a:openssl:openssl:1.0.0:beta3::::::
cpe:2.3:a:openssl:openssl:1.0.0e:::::::*
cpe:2.3:a:openssl:openssl:1.0.1:beta3::::::
cpe:2.3:a:openssl:openssl:1.0.0f:::::::*
cpe:2.3:a:openssl:openssl:0.9.8j:::::::*
cpe:2.3:a:openssl:openssl:1.0.0d:::::::*
cpe:2.3:a:openssl:openssl:1.0.0j:::::::*
cpe:2.3:a:openssl:openssl:0.9.8s:::::::*
cpe:2.3:a:openssl:openssl:1.0.1a:::::::*
cpe:2.3:a:openssl:openssl:1.0.1:beta1::::::
cpe:2.3:a:openssl:openssl:0.9.8l:::::::*
cpe:2.3:a:openssl:openssl:1.0.1d:::::::*
cpe:2.3:a:openssl:openssl:1.0.0k:::::::*
cpe:2.3:a:openssl:openssl:0.9.8r:::::::*
cpe:2.3:a:openssl:openssl:0.9.8t:::::::*
cpe:2.3:a:openssl:openssl:1.0.0:beta4::::::
cpe:2.3:a:openssl:openssl:0.9.8a:::::::*
cpe:2.3:a:openssl:openssl:1.0.0:::::::*
cpe:2.3:a:openssl:openssl:1.0.1b:::::::*
cpe:2.3:a:openssl:openssl:0.9.8o:::::::*
cpe:2.3:a:openssl:openssl:0.9.8q:::::::*
cpe:2.3:a:openssl:openssl:0.9.8w:::::::*
cpe:2.3:a:openssl:openssl:1.0.1e:::::::*
cpe:2.3:a:openssl:openssl:1.0.0:beta5::::::
cpe:2.3:a:openssl:openssl:0.9.8:::::::*
cpe:2.3:a:openssl:openssl:1.0.1f:::::::*
cpe:2.3:a:openssl:openssl:1.0.0l:::::::*
cpe:2.3:a:openssl:openssl:0.9.8v:::::::*
cpe:2.3:a:openssl:openssl:0.9.8i:::::::*
cpe:2.3:a:openssl:openssl:0.9.8f:::::::*
cpe:2.3:a:openssl:openssl:0.9.8y:::::::*
cpe:2.3:a:openssl:openssl:1.0.0a:::::::*
cpe:2.3:a:openssl:openssl:0.9.8h:::::::*
cpe:2.3:a:openssl:openssl:0.9.8x:::::::*
cpe:2.3:a:openssl:openssl:1.0.0b:::::::*
cpe:2.3:a:openssl:openssl:1.0.1:::::::*
cpe:2.3:a:openssl:openssl:1.0.0g:::::::*

Related information, measures and tools

No	URL	タグ
1	ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc
2	ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc
3	http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc
4	http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc
5	http://linux.oracle.com/errata/ELSA-2014-1052.html
6	http://linux.oracle.com/errata/ELSA-2014-1052.html
7	http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html
8	http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html
9	http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html
10	http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html
11	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html
12	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html
13	http://lists.opensuse.org/opensuse-updates/2014-08/msg00036.html
14	http://lists.opensuse.org/opensuse-updates/2014-08/msg00036.html
15	http://marc.info/?l=bugtraq&m=140853041709441&w=2
16	http://marc.info/?l=bugtraq&m=140853041709441&w=2
17	http://marc.info/?l=bugtraq&m=140853041709441&w=2
18	http://marc.info/?l=bugtraq&m=140853041709441&w=2
19	http://marc.info/?l=bugtraq&m=141077370928502&w=2
20	http://marc.info/?l=bugtraq&m=141077370928502&w=2
21	http://marc.info/?l=bugtraq&m=142660345230545&w=2
22	http://marc.info/?l=bugtraq&m=142660345230545&w=2
23	http://marc.info/?l=bugtraq&m=142660345230545&w=2
24	http://marc.info/?l=bugtraq&m=142660345230545&w=2
25	http://secunia.com/advisories/58962
26	http://secunia.com/advisories/58962
27	http://secunia.com/advisories/59700
28	http://secunia.com/advisories/59700
29	http://secunia.com/advisories/59710
30	http://secunia.com/advisories/59710
31	http://secunia.com/advisories/59743
32	http://secunia.com/advisories/59743
33	http://secunia.com/advisories/59756
34	http://secunia.com/advisories/59756
35	http://secunia.com/advisories/60022
36	http://secunia.com/advisories/60022
37	http://secunia.com/advisories/60221
38	http://secunia.com/advisories/60221
39	http://secunia.com/advisories/60493
40	http://secunia.com/advisories/60493
41	http://secunia.com/advisories/60684
42	http://secunia.com/advisories/60684
43	http://secunia.com/advisories/60778
44	http://secunia.com/advisories/60778
45	http://secunia.com/advisories/60803
46	http://secunia.com/advisories/60803
47	http://secunia.com/advisories/60824
48	http://secunia.com/advisories/60824
49	http://secunia.com/advisories/60917
50	http://secunia.com/advisories/60917
51	http://secunia.com/advisories/60921
52	http://secunia.com/advisories/60921
53	http://secunia.com/advisories/60938
54	http://secunia.com/advisories/60938
55	http://secunia.com/advisories/61017
56	http://secunia.com/advisories/61017
57	http://secunia.com/advisories/61040
58	http://secunia.com/advisories/61040
59	http://secunia.com/advisories/61100
60	http://secunia.com/advisories/61100
61	http://secunia.com/advisories/61184
62	http://secunia.com/advisories/61184
63	http://secunia.com/advisories/61250
64	http://secunia.com/advisories/61250
65	http://secunia.com/advisories/61775
66	http://secunia.com/advisories/61775
67	http://secunia.com/advisories/61959
68	http://secunia.com/advisories/61959
69	http://security.gentoo.org/glsa/glsa-201412-39.xml
70	http://security.gentoo.org/glsa/glsa-201412-39.xml
71	http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15573.html
72	http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15573.html
73	http://www.debian.org/security/2014/dsa-2998
74	http://www.debian.org/security/2014/dsa-2998
75	http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htm
76	http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htm
77	http://www.mandriva.com/security/advisories?name=MDVSA-2014:158
78	http://www.mandriva.com/security/advisories?name=MDVSA-2014:158
79	http://www.securityfocus.com/bid/69078
80	http://www.securityfocus.com/bid/69078
81	http://www.securitytracker.com/id/1030693
82	http://www.securitytracker.com/id/1030693
83	http://www-01.ibm.com/support/docview.wss?uid=nas8N1020240
84	http://www-01.ibm.com/support/docview.wss?uid=nas8N1020240
85	http://www-01.ibm.com/support/docview.wss?uid=swg21682293
86	http://www-01.ibm.com/support/docview.wss?uid=swg21682293
87	http://www-01.ibm.com/support/docview.wss?uid=swg21683389
88	http://www-01.ibm.com/support/docview.wss?uid=swg21683389
89	http://www-01.ibm.com/support/docview.wss?uid=swg21686997
90	http://www-01.ibm.com/support/docview.wss?uid=swg21686997
91	https://bugzilla.redhat.com/show_bug.cgi?id=1127502
92	https://bugzilla.redhat.com/show_bug.cgi?id=1127502
93	https://exchange.xforce.ibmcloud.com/vulnerabilities/95161
94	https://exchange.xforce.ibmcloud.com/vulnerabilities/95161
95	https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=d0a4b7d1a2948fce38515b8d862f43e7ba0ebf74
96	https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=d0a4b7d1a2948fce38515b8d862f43e7ba0ebf74
97	https://kc.mcafee.com/corporate/index?page=content&id=SB10109
98	https://kc.mcafee.com/corporate/index?page=content&id=SB10109
99	https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-September/000196.html
100	https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-September/000196.html
101	https://www.freebsd.org/security/advisories/FreeBSD-SA-14:18.openssl.asc
102	https://www.freebsd.org/security/advisories/FreeBSD-SA-14:18.openssl.asc
103	https://www.openssl.org/news/secadv_20140806.txt	Vendor Advisory
104	https://www.openssl.org/news/secadv_20140806.txt	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-399	リソース管理の問題	https://cwe.mitre.org/data/definitions/399.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:openssl:openssl:0.9.8b:::::::*
cpe:2.3:a:openssl:openssl:0.9.8m:::::::*
cpe:2.3:a:openssl:openssl:1.0.1:beta2::::::
cpe:2.3:a:openssl:openssl:0.9.8c:::::::*
cpe:2.3:a:openssl:openssl:1.0.0c:::::::*
cpe:2.3:a:openssl:openssl:1.0.0i:::::::*
cpe:2.3:a:openssl:openssl:1.0.0:beta1::::::
cpe:2.3:a:openssl:openssl:1.0.1h:::::::*
cpe:2.3:a:openssl:openssl:0.9.8n:::::::*
cpe:2.3:a:openssl:openssl:1.0.0:beta2::::::
cpe:2.3:a:openssl:openssl:0.9.8p:::::::*
cpe:2.3:a:openssl:openssl:1.0.0m:::::::*
cpe:2.3:a:openssl:openssl:1.0.1c:::::::*
cpe:2.3:a:openssl:openssl:0.9.8e:::::::*
cpe:2.3:a:openssl:openssl:0.9.8u:::::::*
cpe:2.3:a:openssl:openssl:0.9.8za:::::::*
cpe:2.3:a:openssl:openssl:1.0.1g:::::::*
cpe:2.3:a:openssl:openssl:0.9.8g:::::::*
cpe:2.3:a:openssl:openssl:1.0.0h:::::::*
cpe:2.3:a:openssl:openssl:0.9.8k:::::::*
cpe:2.3:a:openssl:openssl:0.9.8m:beta1::::::
cpe:2.3:a:openssl:openssl:0.9.8d:::::::*
cpe:2.3:a:openssl:openssl:1.0.0:beta3::::::
cpe:2.3:a:openssl:openssl:1.0.0e:::::::*
cpe:2.3:a:openssl:openssl:1.0.1:beta3::::::
cpe:2.3:a:openssl:openssl:1.0.0f:::::::*
cpe:2.3:a:openssl:openssl:0.9.8j:::::::*
cpe:2.3:a:openssl:openssl:1.0.0d:::::::*
cpe:2.3:a:openssl:openssl:1.0.0j:::::::*
cpe:2.3:a:openssl:openssl:0.9.8s:::::::*
cpe:2.3:a:openssl:openssl:1.0.1a:::::::*
cpe:2.3:a:openssl:openssl:1.0.1:beta1::::::
cpe:2.3:a:openssl:openssl:0.9.8l:::::::*
cpe:2.3:a:openssl:openssl:1.0.1d:::::::*
cpe:2.3:a:openssl:openssl:1.0.0k:::::::*
cpe:2.3:a:openssl:openssl:0.9.8r:::::::*
cpe:2.3:a:openssl:openssl:0.9.8t:::::::*
cpe:2.3:a:openssl:openssl:1.0.0:beta4::::::
cpe:2.3:a:openssl:openssl:0.9.8a:::::::*
cpe:2.3:a:openssl:openssl:1.0.0:::::::*
cpe:2.3:a:openssl:openssl:1.0.1b:::::::*
cpe:2.3:a:openssl:openssl:0.9.8o:::::::*
cpe:2.3:a:openssl:openssl:0.9.8q:::::::*
cpe:2.3:a:openssl:openssl:0.9.8w:::::::*
cpe:2.3:a:openssl:openssl:1.0.1e:::::::*
cpe:2.3:a:openssl:openssl:1.0.0:beta5::::::
cpe:2.3:a:openssl:openssl:0.9.8:::::::*
cpe:2.3:a:openssl:openssl:1.0.1f:::::::*
cpe:2.3:a:openssl:openssl:1.0.0l:::::::*
cpe:2.3:a:openssl:openssl:0.9.8v:::::::*
cpe:2.3:a:openssl:openssl:0.9.8i:::::::*
cpe:2.3:a:openssl:openssl:0.9.8f:::::::*
cpe:2.3:a:openssl:openssl:0.9.8y:::::::*
cpe:2.3:a:openssl:openssl:1.0.0a:::::::*
cpe:2.3:a:openssl:openssl:0.9.8h:::::::*
cpe:2.3:a:openssl:openssl:0.9.8x:::::::*
cpe:2.3:a:openssl:openssl:1.0.0b:::::::*
cpe:2.3:a:openssl:openssl:1.0.1:::::::*
cpe:2.3:a:openssl:openssl:1.0.0g:::::::*