CVE-2014-3470

Severity CVSS v4.0:

Pending analysis

Type:

CWE-476 NULL Pointer Dereference

Publication date:

05/06/2014

Last modified:

12/04/2025

Description

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.

Impact

Vector 2.0

AV:N/AC:M/Au:N/C:N/I:N/A:P CVSS v2.0 Severity and Metrics:

Base Score: 4.30 MEDIUM
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Attack Vector (AV): Network
Attack Complexity (AC): Medium
Authentication (Au): None
Confidentiality (C): None
Integrity (I): None
Availability (A): Physical

Base Score 2.0

4.30

Severity 2.0

MEDIUM

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:openssl:openssl::::::::		0.9.8za (excluding)
cpe:2.3:a:openssl:openssl::::::::	1.0.0 (including)	1.0.0m (excluding)
cpe:2.3:a:openssl:openssl::::::::	1.0.1 (including)	1.0.1h (excluding)
cpe:2.3:a:redhat:storage:2.1:::::::*
cpe:2.3:o:fedoraproject:fedora::::::::
cpe:2.3:o:redhat:enterprise_linux:5:::::::*
cpe:2.3:o:redhat:enterprise_linux:6.0:::::::*
cpe:2.3:a:mariadb:mariadb::::::::	10.0.0 (including)	10.0.13 (excluding)
cpe:2.3:o:fedoraproject:fedora:19:::::::*
cpe:2.3:o:fedoraproject:fedora:20:::::::*
cpe:2.3:o:opensuse:leap:42.1:::::::*
cpe:2.3:o:opensuse:opensuse:13.2:::::::*
cpe:2.3:o:suse:linux_enterprise_desktop:12:-::::::
cpe:2.3:o:suse:linux_enterprise_server:12:-::::::
cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:-::::::

To consult the complete list of CPE names with products and versions, see this page

CPE	From	Up to
cpe:2.3:a:openssl:openssl::::::::		0.9.8za (excluding)
cpe:2.3:a:openssl:openssl::::::::	1.0.0 (including)	1.0.0m (excluding)
cpe:2.3:a:openssl:openssl::::::::	1.0.1 (including)	1.0.1h (excluding)
cpe:2.3:a:redhat:storage:2.1:::::::*
cpe:2.3:o:fedoraproject:fedora::::::::
cpe:2.3:o:redhat:enterprise_linux:5:::::::*
cpe:2.3:o:redhat:enterprise_linux:6.0:::::::*
cpe:2.3:a:mariadb:mariadb::::::::	10.0.0 (including)	10.0.13 (excluding)
cpe:2.3:o:fedoraproject:fedora:19:::::::*
cpe:2.3:o:fedoraproject:fedora:20:::::::*
cpe:2.3:o:opensuse:leap:42.1:::::::*
cpe:2.3:o:opensuse:opensuse:13.2:::::::*
cpe:2.3:o:suse:linux_enterprise_desktop:12:-::::::
cpe:2.3:o:suse:linux_enterprise_server:12:-::::::
cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:-::::::

CVE-2014-3470

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools