8.1 High
AI Score
Confidence
High
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.967 High
EPSS
Percentile
99.6%
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment. (CVE-2014-0195)
Impact
An attacker may be able to exploit an OpenSSL Datagram Transport Layer Security (DTLS) client or server by sending invalid DTLS fragments. As a result, the attacker may be able to run arbitrary code or cause a denial-of-service (DoS).
Server-side impact for F5 products
The server-side components are vulnerable in the event that an attacker is able to launch an attack from a client to an affected server component. BIG-IP 11.3.0 and earlier contains the following vulnerable server-side code:
Virtual servers using a ClientSSL profile configured to use ciphers from the COMPAT SSL stack are vulnerable to this attack. The BIG-IP ClientSSL profile enables the BIG-IP system to accept and terminate client requests that are sent using the SSL protocol. In this context, the BIG-IP system functions as an SSL server, handling incoming SSL traffic.
Note: NATIVE SSL ciphers on affected versions are not vulnerable. However, some vulnerability scanners may generate false positive reports when run against BIG-IP virtual servers that are configured to use ciphers supported by the NATIVE SSL stack. This includes all ciphers enabled by the default cipher string.
Client-side impact for F5 products
The client-side components are vulnerable in the event that an attacker is able to launch an attack from a server to an affected client component. BIG-IP 11.5.1 and earlier contains the following vulnerable server-side code:
Virtual servers using a ServerSSL profile configured to use ciphers from the COMPAT SSL stack are vulnerable to this attack. The BIG-IP ServerSSL profile enables the BIG-IP system to initiate secure connections to SSL servers using the SSL protocol. In this context, the BIG-IP system functions as an SSL client, initiating outbound SSL traffic.
An example here is when you use openssl s_client or configure a DTLS monitor to initiate SSL connections.