CVE-2014-3568

OpenSSL < 0.9.8zc, 1.0.0 < 1.0.0o, 1.0.1 < 1.0.1j - SSL 3.0 Handshake Access Bypass

Title source: llm
STIX 2.1

Description

OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j does not properly enforce the no-ssl3 build option, which allows remote attackers to bypass intended access restrictions via an SSL 3.0 handshake, related to s23_clnt.c and s23_srvr.c.

References (41)

Core 41
Core References
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=142103967620673&w=2
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=142804214608580&w=2
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=141477196830952&w=2
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62070
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/70585
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=142791032306609&w=2
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-201412-39.xml
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-3053
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=142495837901899&w=2
Vendor Advisory vendor-advisory x_refsource_netbsd
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-015.txt.asc
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62124
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=143290437727362&w=2
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/61959
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=142624590206005&w=2
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=143290522027658&w=2
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/61058
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62030
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1031053
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/61819
Various Sources x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21686997
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/61130
Vendor Advisory x_refsource_confirm
https://www.openssl.org/news/secadv_20141015.txt
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/61073
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT205217
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/97037
Vendor Advisory x_refsource_confirm
http://support.apple.com/HT204244
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/61207
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/59627
Vendor Advisory x_refsource_confirm
https://support.citrix.com/article/CTX216642

Scores

EPSS 0.0469
EPSS Percentile 89.5%

Details

CWE
CWE-310
Status published
Products (26)
openssl/openssl 1.0.0 (6 CPE variants)
openssl/openssl 1.0.0a
openssl/openssl 1.0.0b
openssl/openssl 1.0.0c
openssl/openssl 1.0.0d
openssl/openssl 1.0.0e
openssl/openssl 1.0.0f
openssl/openssl 1.0.0g
openssl/openssl 1.0.0h
openssl/openssl 1.0.0i
... and 16 more
Published Oct 19, 2014
Tracked Since Feb 18, 2026