Overview

OpenSSL is vulnerable to a man-in-the-middle attack.

Description

The OpenSSL security advisory states:

SSL/TLS MITM vulnerability (CVE-2014-0224)
===========================================

An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. This can be exploited by a Man-in-the-middle (MITM) attack where the attacker can decrypt and modify traffic from the attacked client and server.

The attack can only be performed between a vulnerable client and server. OpenSSL clients are vulnerable in all versions of OpenSSL. Servers are only known to be vulnerable in OpenSSL 1.0.1 and 1.0.2-beta1. Users of OpenSSL servers earlier than 1.0.1 are advised to upgrade as a precaution.

OpenSSL 0.9.8 SSL/TLS users (client and/or server) should upgrade to 0.9.8za.
OpenSSL 1.0.0 SSL/TLS users (client and/or server) should upgrade to 1.0.0m.
OpenSSL 1.0.1 SSL/TLS users (client and/or server) should upgrade to 1.0.1h.

Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for discovering and researching this issue. This issue was reported to OpenSSL on 1st May 2014 via JPCERT/CC.

The fix was developed by Stephen Henson of the OpenSSL core team partly based on an original patch from KIKUCHI Masashi.

Additional details may be found in the OpenSSL security advisory. This vulnerability is one of many that has been fixed in the latest release.

Masashi Kikuchi has written a technical blog post about the vulnerability.

---

Impact

A remote attacker with a man-in-the-middle vantage point on the network may be able to decrypt or modify traffic between a client and server.

---

Solution

Apply an Update

OpenSSL 0.9.8 SSL/TLS users (client and/or server) should upgrade to 0.9.8za.
OpenSSL 1.0.0 SSL/TLS users (client and/or server) should upgrade to 1.0.0m.
OpenSSL 1.0.1 SSL/TLS users (client and/or server) should upgrade to 1.0.1h.

---

Vendor Information

978508

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Attachmate __ Affected

Notified: June 02, 2014 Updated: August 19, 2014

Status

Affected

Vendor Statement

`Some Attachmate products with specific versions are affected by the
CVE-2014-0224 OpenSSL "CCS’ MITM vulnerability when TLS protocol
connections are used. All affected products now have either new versions
or hot fixes available to fix this issue.

Security Updates technical notes are available for specific products:
Security Updates and Reflection
<http://support.attachmate.com/techdocs/1708.html&gt;
Security Updates and Reflection for Secure IT
<http://support.attachmate.com/techdocs/2288.html&gt;
Security Updates and EXTRA!
<http://support.attachmate.com/techdocs/2501.html&gt;
Security Updates and Reflection 2014 or Reflection 2011
<http://support.attachmate.com/techdocs/2502.html&gt;
Security Updates and Verastream
<http://support.attachmate.com/techdocs/2700.html&gt;`

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <http://support.attachmate.com/techdocs/1708.html&gt;
• <http://support.attachmate.com/techdocs/2288.html&gt;
• <http://support.attachmate.com/techdocs/2501.html&gt;
• <http://support.attachmate.com/techdocs/2502.html&gt;
• <http://support.attachmate.com/techdocs/2700.html&gt;

Debian GNU/Linux __ Affected

Notified: June 02, 2014 Updated: June 06, 2014

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see the following URL for more information.

Vendor References

• <https://www.debian.org/security/2014/dsa-2950&gt;

Fedora Project __ Affected

Notified: June 02, 2014 Updated: June 06, 2014

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see the following URL for more information.

Vendor References

• <https://admin.fedoraproject.org/updates/openssl-1.0.1e-38.fc19&gt;

FreeBSD Project __ Affected

Notified: June 02, 2014 Updated: June 05, 2014

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see the following URL for more information.

Vendor References

• <http://www.freebsd.org/security/advisories/FreeBSD-SA-14:14.openssl.asc&gt;

Global Technology Associates, Inc. __ Affected

Notified: June 02, 2014 Updated: June 19, 2014

Status

Affected

Vendor Statement

We have determined that GTA firewalls running the following versions of GB-OS are vulnerable and should be upgraded to the indicated version listed below.

GB-OS version 6.1.0 to 6.1.7 are vulnerable and should upgrade to GB-OS 6.1.8
GB-OS version 6.0.0 to 6.0.8 are vulnerable and should upgrade to GB-OS 6.0.9

Customers using GTA firewalls with an unsupported version of GB-OS should upgrade to a currently supported version.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Hewlett-Packard Company __ Affected

Notified: June 02, 2014 Updated: August 21, 2014

Status

Affected

Vendor Statement

`Note: the current version of the following document is available here:
<https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04401858&gt;

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c04401858
Version: 1

HPSBMU03101 rev.1 - HP Asset Manager, CloudSystem Chargeback, running
OpenSSL, Remote Disclosure of Information or Unauthorized Access

NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.

Release Date: 2014-08-19
Last Updated: 2014-08-19

Potential Security Impact: Remote disclosure of information or unauthorized
access

Source: Hewlett-Packard Company, HP Software Security Response Team

VULNERABILITY SUMMARY
A potential security vulnerability has been identified with HP Asset Manager
and CloudSystem Chargeback running OpenSSL. The vulnerability could be
exploited remotely to allow disclosure information or unauthorized access.

This OpenSSL vulnerability was detected in specific OpenSSL versions. OpenSSL
is a 3rd party product that is embedded with some HP Software products. This
bulletin notifies HP Software customers about products affected by this
OpenSSL vulnerability.

Note: OpenSSL vulnerabilities, are found in the OpenSSL product cryptographic
software library product. This weakness potentially allows Man in the Middle
(MITM) attack where the attacker can decrypt and modify traffic from the
attacked client and server. The impacted products appear in the list below
are vulnerable due to embedding of OpenSSL standard release software.

References:

CVE-2014-0224 (SSRT101672)

SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.

HP Asset Manager - v9.4x, v9.3x, v5.2x
HP CloudSystem Chargeback v9.40

BACKGROUND

CVSS 2.0 Base Metrics

Reference Base Vector Base Score
CVE-2014-0224 (AV:N/AC:M/Au:N/C:P/I:P/A:P) 6.8

Information on CVSS is documented
in HP Customer Notice: HPSN-2008-002

RESOLUTION

HP has provided the following patch to resolve the vulnerability in HP Asset
Manager and HP CloudSystem Chargeback.

HP Asset Manager / CloudSystem Chargeback v9.40
Install patch v9.40.P4

For Windows(en)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00376&gt;

For Windows(de)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00377&gt;

For Windows(es)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00378&gt;

For Windows(fr)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00379&gt;

For Windows(it)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00380&gt;

For Windows(ja)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00381&gt;

For Windows(ko)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00382&gt;

For Windows(nl)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00383&gt;

For Windows(pt)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00384&gt;

For Windows(ru)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00385&gt;

For Windows(zh)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00386&gt;

For Linux(en)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00387&gt;

For Linux(de)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00388&gt;

For Linux(es)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00389&gt;

For Linux(fr)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00390&gt;

For Linux(it)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00391&gt;

For Linux(ja)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00392&gt;

For Linux(ko)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00393&gt;

For Linux(nl)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00394&gt;

For Linux(pt)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00395&gt;

For Linux(ru)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00396&gt;

For Linux(zh)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00397&gt;

HP Asset Manager v9.41
Install patch v9.41.P1

For Windows(en)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00423&gt;

For windows(de)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00424&gt;

For Windows(es)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00425&gt;

For Windows(fr)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00426&gt;

For Windows(it)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00427&gt;

For Windows(ja)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00428&gt;

For Windows(ko)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00429&gt;

For Windows(nl)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00430&gt;

For Windows(pt)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00431&gt;

For Windows(ru)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00432&gt;

For Windows(zh)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00433&gt;

For Linux(en)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00434&gt;

For Linux(de)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00435&gt;

For Linux(es)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00436&gt;

For Linux(fr)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00437&gt;

For Linux(it)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00438&gt;

For Linux(ja)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00439&gt;

For Linux(ko)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00440&gt;

For Linux(nl)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00441&gt;

For Linux(pt)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00442&gt;

For Linux(ru)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00443&gt;

For Linux(zh)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00444&gt;

HP Asset Manager v9.3x
Install patch v9.32.P2

For Windows(en)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00398&gt;

For Windows(de)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00399&gt;

For Windows(es)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00400&gt;

For Windows(fr)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00401&gt;

For Windows(it)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00402&gt;

For Windows(ja)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00403&gt;

For Windows(ko)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00404&gt;

For Windows(nl)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00405&gt;

For Windows(pt)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00406&gt;

For Windows(ru)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00407&gt;

For Windows(zh)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00408&gt;

For Linux(en)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00409&gt;

For Linux (de)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00410&gt;

For Linux (es)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00411&gt;

For Linux (fr)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00412&gt;

For Linux (it)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00413&gt;

For Linux (ja)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00414&gt;

For Linux (ko)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00415&gt;

For Linux (nl)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00416&gt;

For Linux (pt)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00417&gt;

For Linux (ru)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00418&gt;

For Linux (zh)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00419&gt;

For AIX ANSI (en de es fr it nl pt)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00420&gt;

For HPUX ANSI (en de es fr it nl pt)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00421&gt;

For Solaris ANSI (en de es fr it nl pt)
<http://support.openview.hp.com/selfsolve/document/LID/AMGR_00422&gt;

HP Asset Manager v5.2x
upgrade to v9.41.P1

HISTORY
Version:1 (rev.1) - 19 August 2014 Initial release

Third Party Security Patches: Third party security patches that are to be
installed on systems running HP software products should be applied in
accordance with the customer’s patch management policy.

Support: For issues about implementing the recommendations of this Security
Bulletin, contact normal HP Services support channel. For other issues about
the content of this Security Bulletin, send e-mail to [email protected].

Report: To report a potential security vulnerability with any HP supported
product, send Email to: [email protected]

Subscribe: To initiate a subscription to receive future HP Security Bulletin
alerts via Email:
<http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins&gt;

Security Bulletin Archive: A list of recently released Security Bulletins is
available here:
<https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/&gt;

Software Product Category: The Software Product Category is represented in
the title by the two characters following HPSB.

3C = 3COM
3P = 3rd Party Software
GN = HP General Software
HF = HP Hardware and Firmware
MP = MPE/iX
MU = Multi-Platform Software
NS = NonStop Servers
OV = OpenVMS
PI = Printing and Imaging
PV = ProCurve
ST = Storage Software
TU = Tru64 UNIX
UX = HP-UX

Copyright 2014 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors
or omissions contained herein. The information provided is provided “as is”
without warranty of any kind. To the extent permitted by law, neither HP or
its affiliates, subcontractors or suppliers will be liable for
incidental,special or consequential damages including downtime cost; lost
profits; damages relating to the procurement of substitute products or
services; or damages for loss of data, or software restoration. The
information in this document is subject to change without notice.
Hewlett-Packard Company and the names of Hewlett-Packard products referenced
herein are trademarks of Hewlett-Packard Company in the United States and
other countries. Other product and company names mentioned herein may be
trademarks of their respective owners.`

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04401858&gt;

IBM Corporation __ Affected

Notified: June 02, 2014 Updated: June 16, 2014

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see the links below for more information.

Vendor References

• <http://www-01.ibm.com/support/docview.wss?uid=swg21676041&gt;
• <http://www-01.ibm.com/support/docview.wss?uid=swg21676062&gt;
• <http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc&gt;
• <http://www-01.ibm.com/support/docview.wss?uid=swg21675821&gt;

NEC Corporation __ Affected

Notified: June 02, 2014 Updated: June 09, 2014

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see the following link for more information.

Vendor References

• <http://jpn.nec.com/security-info/av14-002.html&gt;

NEC Corporation __ Affected

Updated: October 26, 2015

Status

Affected

Vendor Statement

We provide information on this issue at the following URL:

<<http://jpn.nec.com/security-info/secinfo/nv15-011.html&gt;&gt;(only in Japanese)
<<http://jpn.nec.com/security-info/av14-002.html&gt;&gt;(only in Japanese)

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <http://jpn.nec.com/security-info/secinfo/nv15-011.html&gt;
• <http://jpn.nec.com/security-info/av14-002.html&gt;

NVIDIA __ Affected

Notified: June 02, 2014 Updated: September 10, 2014

Status

Affected

Vendor Statement

Please see <http://nvidia.custhelp.com/app/answers/detail/a_id/3566> for NVIDIA’s statement on this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <http://nvidia.custhelp.com/app/answers/detail/a_id/3566&gt;

OpenSSL __ Affected

Notified: May 09, 2014 Updated: June 05, 2014

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see the following URL for more information.

Vendor References

• <https://www.openssl.org/news/secadv_20140605.txt&gt;

Oracle Corporation __ Affected

Notified: June 02, 2014 Updated: June 16, 2014

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see the links below for more information.

Vendor References

• <http://linux.oracle.com/errata/ELSA-2014-0625.html&gt;

Red Hat, Inc. __ Affected

Notified: June 02, 2014 Updated: June 05, 2014

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see the following URL for more information.

Vendor References

• <https://rhn.redhat.com/errata/RHSA-2014-0625.html&gt;

SUSE Linux __ Affected

Notified: June 02, 2014 Updated: June 09, 2014

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see the following links for more information.

Vendor References

• <http://support.novell.com/security/cve/CVE-2014-0224.html&gt;
• <http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00003.html&gt;

Ubuntu __ Affected

Notified: June 02, 2014 Updated: June 05, 2014

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see the following URL for more information.

Vendor References

• <http://www.ubuntu.com/usn/usn-2232-1/&gt;

VMware __ Affected

Notified: June 02, 2014 Updated: June 16, 2014

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see the links below for more information.

Vendor References

• <http://www.vmware.com/security/advisories/VMSA-2014-0006.html&gt;

ACCESS Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

AT&T Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Alcatel-Lucent Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Apple Inc. Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Aruba Networks, Inc. Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Avaya, Inc. Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Barracuda Networks Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Belkin, Inc. Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Blue Coat Systems Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Brocade Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

CA Technologies Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Charlotte’s Web Networks Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Check Point Software Technologies Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Cisco Systems, Inc. Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Cray Inc. Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

D-Link Systems, Inc. Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

DragonFly BSD Project Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

EMC Corporation Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Engarde Secure Linux Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Enterasys Networks Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Ericsson Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Extreme Networks Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

F5 Networks, Inc. Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Force10 Networks, Inc. Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Fortinet, Inc. Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Foundry Networks, Inc. Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Fujitsu Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Gentoo Linux Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Google Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Hitachi Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Intel Corporation Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Internet Security Systems, Inc. Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Intoto Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Juniper Networks, Inc. Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Mandriva S. A. Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

MarkLogic Corporation Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

McAfee Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Microsoft Corporation Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

NetBSD Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Nokia Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Novell, Inc. Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

OpenBSD Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

OpenVPN Technologies Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Opengear Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Openwall GNU/*/Linux Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Palo Alto Networks Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Process Software Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Q1 Labs Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

QNX Software Systems Inc. Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

SafeNet Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Slackware Linux Inc. Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

SmoothWall Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Snort Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Sony Corporation Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Sophos, Inc. Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Sourcefire Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Stonesoft Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Symantec Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

TippingPoint Technologies Inc. Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Turbolinux Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Unisys Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Watchguard Technologies, Inc. Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Wind River Systems, Inc. Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

ZyXEL Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

eSoft, Inc. Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

m0n0wall Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

netfilter Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

pfSENSE Unknown

Notified: June 02, 2014 Updated: June 02, 2014

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

View all 84 vendors __View less vendors __

CVSS Metrics

Group	Score	Vector
Base	6.4	AV:A/AC:M/Au:N/C:C/I:P/A:N
Temporal	5	E:POC/RL:OF/RC:C
Environmental	8.1	CDP:H/TD:H/CR:H/IR:M/AR:L

References

• <https://www.openssl.org/news/secadv_20140605.txt&gt;
• <http://ccsinjection.lepidum.co.jp/&gt;
• <http://ccsinjection.lepidum.co.jp/blog/2014-06-05/CCS-Injection-en/index.html&gt;
• <https://plus.google.com/app/basic/stream/z12xhp3hbzbhhjgfm22ncvtbeua1dpaa004&gt;

Acknowledgements

Thanks to KIKUCHI Masashi for reporting this vulnerability.

This document was written by Jared Allar.

Other Information

CVE IDs:	CVE-2014-0224
Date Public:	2014-06-05 Date First Published: