CVE-2014-0160: OpenSSL Information Disclosure Vulnerability
A missing bounds check was found in the way OpenSSL handled TLS heartbeat extension packets. This flaw could be used to reveal up to 64k of memory from a connected client or server.
Only 1.0.1 releases of OpenSSL are affected including 1.0.1f (and 1.0.2 betas)
The following upstream commit introduced TLS/DTLS heatbeat support and also this issue:
http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4817504
Other sources
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1both.c and t1lib.c, aka the Heartbleed bug.
The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/opensslto a version that resolves this vulnerability.Fixed in 1.0.1 - Upgrade
Upgrade
opensslto a version that resolves this vulnerability.Fixed in 1.0.1g - Compensating control
Mitigate the Heartbleed issue by preventing remote TLS/DTLS heartbeat traffic (e.g., block/disable TLS/DTLS heartbeat at the network path until OpenSSL is upgraded).
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0160?
CVE-2014-0160 is rated as critical due to its potential to leak sensitive information from the affected system.
How do I fix CVE-2014-0160?
To fix CVE-2014-0160, upgrade OpenSSL to version 1.0.1g or higher as all versions prior to this are vulnerable.
What systems are affected by CVE-2014-0160?
CVE-2014-0160 affects OpenSSL versions prior to 1.0.1g, along with various applications that utilize this vulnerable library.
Can CVE-2014-0160 be exploited remotely?
Yes, CVE-2014-0160 can be exploited remotely by attackers using specially crafted Heartbeat packets to extract sensitive information.
Is CVE-2014-0160 specific to OpenSSL only?
While CVE-2014-0160 primarily affects OpenSSL, it can also impact other applications and platforms that use vulnerable versions of the library.