CVE-2014-0160: OpenSSL Information Disclosure Vulnerability
A missing bounds check was found in the way OpenSSL handled TLS heartbeat extension packets. This flaw could be used to reveal up to 64k of memory from a connected client or server. Only 1.0.1 releases of OpenSSL are affected including 1.0.1f (and 1.0.2 betas) The following upstream commit introduced TLS/DTLS heatbeat support and also this issue: http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4817504
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0160?
CVE-2014-0160 is rated as critical due to its potential to leak sensitive information from the affected system.
How do I fix CVE-2014-0160?
To fix CVE-2014-0160, upgrade OpenSSL to version 1.0.1g or higher as all versions prior to this are vulnerable.
What systems are affected by CVE-2014-0160?
CVE-2014-0160 affects OpenSSL versions prior to 1.0.1g, along with various applications that utilize this vulnerable library.
Can CVE-2014-0160 be exploited remotely?
Yes, CVE-2014-0160 can be exploited remotely by attackers using specially crafted Heartbeat packets to extract sensitive information.
Is CVE-2014-0160 specific to OpenSSL only?
While CVE-2014-0160 primarily affects OpenSSL, it can also impact other applications and platforms that use vulnerable versions of the library.