K15722 : OpenSSL DTLS SRTP Memory Leak CVE-2014-3513

Security Advisory Description

A flaw in the DTLS SRTP extension parsing code allows an attacker, who ends a carefully crafted handshake message, to cause OpenSSL to fail to free up to 64k of memory causing a memory leak. This could be exploited in a Denial of Service attack. This issue affects OpenSSL 1.0.1 server implementations for both SSL/TLS and DTLS regardless of whether SRTP is used or configured. Implementations of OpenSSL that have been compiled with OPENSSL_NO_SRTP defined are not affected. (CVE-2014-3513)

Impact

This vulnerability may put a host at risk of a denial-of-service (DoS) attack.