CVE Listesine Dön
CVE-2014-0160 CISA KEV · Aktif Sömürülüyor

openssl: information disclosure in handling of TLS heartbeat extension packets

CVSS Skor

5.0

EPSS İhtimal

%100.0

Risk Skoru

10.0

Yayın

12 yıl önce

Overview (Genel Bakış)Public Exploits (0)Newsroom (Haberler)Vulnerability Timeline
Resmî yama doğrulandı

Etkilenen ürün ve sürüm için yayımlanan güvenlik güncellemesini uygulayın.

Envanterimdeki Etkisi

Yalnızca hesabınıza eklediğiniz kişisel ürünler değerlendirilir; kurumsal envanter burada görünmez.

Oturum kontrol ediliyor…

Zafiyet Açıklaması

DayBreach CVE AI Araştırması

CVE-2014-0160 için toplanan üretici, dağıtım, yama ve güvenlik kaynağı kayıtlarını karşılaştırıp kanıt bağlantılı bir açıklama hazırlayalım.

An information disclosure flaw was found in the way OpenSSL handled TLS and DTLS Heartbeat Extension packets. A malicious TLS or DTLS client or server could send a specially crafted TLS or DTLS Heartbeat packet to disclose a limited portion of memory per request from a connected client or server. Note that the disclosed portions of memory could potentially include sensitive information such as private keys.

IMPACT — Etkilenen Ürünler ve Yazılımlar

Affected Products

The following products are affected by CVE-2014-0160 vulnerability. Even if our threat engine is aware of the exact versions of the products that are affected, the information is represented below.

IDVENDORPRODUCTACTION
1Red Hat6Client-6.5.z:openssl-0:1.0.1e-16.el6_5.7.i686 İncele
2Red Hat6Client-6.5.z:openssl-0:1.0.1e-16.el6_5.7.src İncele
3Red Hat6Client-6.5.z:openssl-0:1.0.1e-16.el6_5.7.x86_64 İncele
4Red Hat6Client-6.5.z:openssl-debuginfo-0:1.0.1e-16.el6_5.7.i686 İncele
5Red Hat6Client-6.5.z:openssl-debuginfo-0:1.0.1e-16.el6_5.7.x86_64 İncele
6Red Hat6Client-optional-6.5.z:openssl-0:1.0.1e-16.el6_5.7.src İncele
7Red Hat6Client-optional-6.5.z:openssl-debuginfo-0:1.0.1e-16.el6_5.7.i686 İncele
8Red Hat6Client-optional-6.5.z:openssl-debuginfo-0:1.0.1e-16.el6_5.7.x86_64 İncele
9Red Hat6Client-optional-6.5.z:openssl-devel-0:1.0.1e-16.el6_5.7.i686 İncele
10Red Hat6Client-optional-6.5.z:openssl-devel-0:1.0.1e-16.el6_5.7.x86_64 İncele
11Red Hat6Client-optional-6.5.z:openssl-perl-0:1.0.1e-16.el6_5.7.i686 İncele
12Red Hat6Client-optional-6.5.z:openssl-perl-0:1.0.1e-16.el6_5.7.x86_64 İncele
13Red Hat6Client-optional-6.5.z:openssl-static-0:1.0.1e-16.el6_5.7.i686 İncele
14Red Hat6Client-optional-6.5.z:openssl-static-0:1.0.1e-16.el6_5.7.x86_64 İncele
15Red Hat6ComputeNode-6.5.z:openssl-0:1.0.1e-16.el6_5.7.i686 İncele
16Red Hat6ComputeNode-6.5.z:openssl-0:1.0.1e-16.el6_5.7.src İncele
17Red Hat6ComputeNode-6.5.z:openssl-0:1.0.1e-16.el6_5.7.x86_64 İncele
18Red Hat6ComputeNode-6.5.z:openssl-debuginfo-0:1.0.1e-16.el6_5.7.i686 İncele
19Red Hat6ComputeNode-6.5.z:openssl-debuginfo-0:1.0.1e-16.el6_5.7.x86_64 İncele
20Red Hat6ComputeNode-optional-6.5.z:openssl-0:1.0.1e-16.el6_5.7.src İncele
21Red Hat6ComputeNode-optional-6.5.z:openssl-debuginfo-0:1.0.1e-16.el6_5.7.i686 İncele
22Red Hat6ComputeNode-optional-6.5.z:openssl-debuginfo-0:1.0.1e-16.el6_5.7.x86_64 İncele
23Red Hat6ComputeNode-optional-6.5.z:openssl-devel-0:1.0.1e-16.el6_5.7.i686 İncele
24Red Hat6ComputeNode-optional-6.5.z:openssl-devel-0:1.0.1e-16.el6_5.7.x86_64 İncele
25Red Hat6ComputeNode-optional-6.5.z:openssl-perl-0:1.0.1e-16.el6_5.7.x86_64 İncele
26Red Hat6ComputeNode-optional-6.5.z:openssl-static-0:1.0.1e-16.el6_5.7.x86_64 İncele
27Red Hat6Server-6.5.z:openssl-0:1.0.1e-16.el6_5.7.i686 İncele
28Red Hat6Server-6.5.z:openssl-0:1.0.1e-16.el6_5.7.ppc İncele
29Red Hat6Server-6.5.z:openssl-0:1.0.1e-16.el6_5.7.ppc64 İncele
30Red Hat6Server-6.5.z:openssl-0:1.0.1e-16.el6_5.7.s390 İncele
31Red Hat6Server-6.5.z:openssl-0:1.0.1e-16.el6_5.7.s390x İncele
32Red Hat6Server-6.5.z:openssl-0:1.0.1e-16.el6_5.7.src İncele
33Red Hat6Server-6.5.z:openssl-0:1.0.1e-16.el6_5.7.x86_64 İncele
34Red Hat6Server-6.5.z:openssl-debuginfo-0:1.0.1e-16.el6_5.7.i686 İncele
35Red Hat6Server-6.5.z:openssl-debuginfo-0:1.0.1e-16.el6_5.7.ppc İncele
36Red Hat6Server-6.5.z:openssl-debuginfo-0:1.0.1e-16.el6_5.7.ppc64 İncele
37Red Hat6Server-6.5.z:openssl-debuginfo-0:1.0.1e-16.el6_5.7.s390 İncele
38Red Hat6Server-6.5.z:openssl-debuginfo-0:1.0.1e-16.el6_5.7.s390x İncele
39Red Hat6Server-6.5.z:openssl-debuginfo-0:1.0.1e-16.el6_5.7.x86_64 İncele
40Red Hat6Server-6.5.z:openssl-devel-0:1.0.1e-16.el6_5.7.i686 İncele
41Red Hat6Server-6.5.z:openssl-devel-0:1.0.1e-16.el6_5.7.ppc İncele
42Red Hat6Server-6.5.z:openssl-devel-0:1.0.1e-16.el6_5.7.ppc64 İncele
43Red Hat6Server-6.5.z:openssl-devel-0:1.0.1e-16.el6_5.7.s390 İncele
44Red Hat6Server-6.5.z:openssl-devel-0:1.0.1e-16.el6_5.7.s390x İncele
45Red Hat6Server-6.5.z:openssl-devel-0:1.0.1e-16.el6_5.7.x86_64 İncele
46Red Hat6Server-RHEV-Hypervisor:rhev-hypervisor6-0:6.5-20140118.1.3.2.el6_5.noarch İncele
47Red Hat6Server-RHEV-Hypervisor:rhev-hypervisor6-0:6.5-20140407.0.el6ev.noarch İncele
48Red Hat6Server-RHEV-S-3.3:rhevm-spice-client-0:3.3-12.el6_5.src İncele
49Red Hat6Server-RHEV-S-3.3:rhevm-spice-client-x64-cab-0:3.3-12.el6_5.noarch İncele
50Red Hat6Server-RHEV-S-3.3:rhevm-spice-client-x64-msi-0:3.3-12.el6_5.noarch İncele
51Red Hat6Server-RHEV-S-3.3:rhevm-spice-client-x86-cab-0:3.3-12.el6_5.noarch İncele
52Red Hat6Server-RHEV-S-3.3:rhevm-spice-client-x86-msi-0:3.3-12.el6_5.noarch İncele
53Red Hat6Server-RHS-6.4.z:openssl-0:1.0.1e-16.el6_5.7.src İncele
54Red Hat6Server-RHS-6.4.z:openssl-0:1.0.1e-16.el6_5.7.x86_64 İncele
55Red Hat6Server-RHS-6.4.z:openssl-debuginfo-0:1.0.1e-16.el6_5.7.x86_64 İncele
56Red Hat6Server-RHS-6.4.z:openssl-devel-0:1.0.1e-16.el6_5.7.x86_64 İncele
57Red Hat6Server-RHS-6.4.z:openssl-perl-0:1.0.1e-16.el6_5.7.x86_64 İncele
58Red Hat6Server-RHS-6.4.z:openssl-static-0:1.0.1e-16.el6_5.7.x86_64 İncele
59Red Hat6Server-optional-6.5.z:openssl-0:1.0.1e-16.el6_5.7.src İncele
60Red Hat6Server-optional-6.5.z:openssl-debuginfo-0:1.0.1e-16.el6_5.7.i686 İncele
61Red Hat6Server-optional-6.5.z:openssl-debuginfo-0:1.0.1e-16.el6_5.7.ppc64 İncele
62Red Hat6Server-optional-6.5.z:openssl-debuginfo-0:1.0.1e-16.el6_5.7.s390x İncele
63Red Hat6Server-optional-6.5.z:openssl-debuginfo-0:1.0.1e-16.el6_5.7.x86_64 İncele
64Red Hat6Server-optional-6.5.z:openssl-perl-0:1.0.1e-16.el6_5.7.i686 İncele
65Red Hat6Server-optional-6.5.z:openssl-perl-0:1.0.1e-16.el6_5.7.ppc64 İncele
66Red Hat6Server-optional-6.5.z:openssl-perl-0:1.0.1e-16.el6_5.7.s390x İncele
67Red Hat6Server-optional-6.5.z:openssl-perl-0:1.0.1e-16.el6_5.7.x86_64 İncele
68Red Hat6Server-optional-6.5.z:openssl-static-0:1.0.1e-16.el6_5.7.i686 İncele
69Red Hat6Server-optional-6.5.z:openssl-static-0:1.0.1e-16.el6_5.7.ppc64 İncele
70Red Hat6Server-optional-6.5.z:openssl-static-0:1.0.1e-16.el6_5.7.s390x İncele
71Red Hat6Server-optional-6.5.z:openssl-static-0:1.0.1e-16.el6_5.7.x86_64 İncele
72Red Hat6Workstation-6.5.z:openssl-0:1.0.1e-16.el6_5.7.i686 İncele
73Red Hat6Workstation-6.5.z:openssl-0:1.0.1e-16.el6_5.7.src İncele
74Red Hat6Workstation-6.5.z:openssl-0:1.0.1e-16.el6_5.7.x86_64 İncele
75Red Hat6Workstation-6.5.z:openssl-debuginfo-0:1.0.1e-16.el6_5.7.i686 İncele
76Red Hat6Workstation-6.5.z:openssl-debuginfo-0:1.0.1e-16.el6_5.7.x86_64 İncele
77Red Hat6Workstation-6.5.z:openssl-devel-0:1.0.1e-16.el6_5.7.i686 İncele
78Red Hat6Workstation-6.5.z:openssl-devel-0:1.0.1e-16.el6_5.7.x86_64 İncele
79Red Hat6Workstation-optional-6.5.z:openssl-0:1.0.1e-16.el6_5.7.src İncele
80Red Hat6Workstation-optional-6.5.z:openssl-debuginfo-0:1.0.1e-16.el6_5.7.i686 İncele
81Red Hat6Workstation-optional-6.5.z:openssl-debuginfo-0:1.0.1e-16.el6_5.7.x86_64 İncele
82Red Hat6Workstation-optional-6.5.z:openssl-perl-0:1.0.1e-16.el6_5.7.i686 İncele
83Red Hat6Workstation-optional-6.5.z:openssl-perl-0:1.0.1e-16.el6_5.7.x86_64 İncele
84Red Hat6Workstation-optional-6.5.z:openssl-static-0:1.0.1e-16.el6_5.7.i686 İncele
85Red Hat6Workstation-optional-6.5.z:openssl-static-0:1.0.1e-16.el6_5.7.x86_64 İncele
86opensslopenssl İncele
Total Affected Vendor: 2|Products: 86

RED HAT CSAF/VEX — Ürün Etki Kontrolü

Bu CVE benim Red Hat ürünümü etkiliyor mu?

Sonuçlar doğrudan Red Hat CSAF VEX ürün durumundan gelir; tahmin değildir.

Etkilenmiyor

Red Hat VEX kaydına göre bu ürün etkilenmiyor.

Red Hat düzeltmeleri

Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 To upgrade Hypervisors in Red Hat Enterprise Virtualization environments using the disk image provided by this package, refer to: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Hypervisor_Deployment_Guide/chap-Deployment_Guide-Upgrading_Red_Hat_Enterprise_Virtualization_Hypervisors.html This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 To upgrade Hypervisors in Red Hat Enterprise Virtualization environments using the disk image provided by this package, refer to: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Hypervisor_Deployment_Guide/chap-Deployment_Guide-Upgrading_Red_Hat_Enterprise_Virtualization_Hypervisors.html Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

SCORING — CVSS Çoklu Kaynak Skoru

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from various sources for each CVE.

SCOREVERSIONSEVERITYVECTORSOURCE
5.0cvss_v2—AV:N/AC:L/Au:N/C:P/I:N/A:NRed Hat

Yama ve İyileştirme Rehberi (Solution)

Solution & Remediation Advisory

Yama doğrulandı

10 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

redhat

Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

Kaynağı aç
redhat

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 To upgrade Hypervisors in Red Hat Enterprise Virtualization environments using the disk image provided by this package, refer to: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Hypervisor_Deployment_Guide/chap-Deployment_Guide-Upgrading_Red_Hat_Enterprise_Virtualization_Hypervisors.html

Kaynağı aç
redhat

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 To upgrade Hypervisors in Red Hat Enterprise Virtualization environments using the disk image provided by this package, refer to: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Hypervisor_Deployment_Guide/chap-Deployment_Guide-Upgrading_Red_Hat_Enterprise_Virtualization_Hypervisors.html

Kaynağı aç
redhat

Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

Kaynağı aç
redhat

Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

Kaynağı aç
reference

Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

Kaynağı aç
reference

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 To upgrade Hypervisors in Red Hat Enterprise Virtualization environments using the disk image provided by this package, refer to: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Hypervisor_Deployment_Guide/chap-Deployment_Guide-Upgrading_Red_Hat_Enterprise_Virtualization_Hypervisors.html

Kaynağı aç
reference

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 To upgrade Hypervisors in Red Hat Enterprise Virtualization environments using the disk image provided by this package, refer to: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Hypervisor_Deployment_Guide/chap-Deployment_Guide-Upgrading_Red_Hat_Enterprise_Virtualization_Hypervisors.html

Kaynağı aç
reference

Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

Kaynağı aç
reference

Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

Kaynağı aç
canonical

Apply updates per vendor instructions.

Etkilenen ürün ve sürümü yukarıdaki kaynak kanıtlarıyla doğrulayın.
İnternete açık servislerde erişimi kısıtlayın ve ağ segmentasyonu uygulayın.
Kanıtta belirtilen resmî güncellemeyi yalnızca eşleşen ürün ve sürüme uygulayın.
Sunucu günlüklerini ve ağ uçlarını anormal çalıştırma belirtileri için izleyin.

Public exploit ve aktif sömürü durumu

Doğrulanmış exploit istihbaratı

Bu CVE CISA KEV kataloğunda aktif sömürülen olarak işaretli; ancak henüz doğrulanmış, indirilebilir bir public PoC veya Metasploit modülü bulunamadı. Aktif sömürü kanıtı public exploit kodu bulunduğu anlamına gelmez.

Zafiyet Dağılımı ve Saldırı Kalıpları (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2014-0160 is associated with the following CWEs:

CWE-805: Common Weakness Enumeration Entry CWE-805

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2014-0160 weaknesses.

CAPEC-66: SQL InjectionCAPEC-126: Path TraversalCAPEC-28: OS Command Injection

Saldırı Vektörü ve Erişilebilirlik Karakteristiği

ErişimAğ üzerinden
Yetki—
Kullanıcı—

Resmi Kaynaklar ve Danışma Bültenleri

Canonical URLvendor-advisoryRHBZ#1084875vendor-advisoryRHSB-heartbleedvendor-advisoryhttps://www.cve.org/CVERecord?id=CVE-2014-0160vendor-advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2014-0160vendor-advisoryhttp://www.openssl.org/news/secadv_20140407.txtvendor-advisoryhttps://www.cisa.gov/known-exploited-vulnerabilities-catalogvendor-advisoryBefore applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258patchThis update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 To upgrade Hypervisors in Red Hat Enterprise Virtualization environments using the disk image provided by this package, refer to: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Hypervisor_Deployment_Guide/chap-Deployment_Guide-Upgrading_Red_Hat_Enterprise_Virtualization_Hypervisors.htmlpatchThis update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 To upgrade Hypervisors in Red Hat Enterprise Virtualization environments using the disk image provided by this package, refer to: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Hypervisor_Deployment_Guide/chap-Deployment_Guide-Upgrading_Red_Hat_Enterprise_Virtualization_Hypervisors.htmlpatch

CVSS Vektör Radar Grafiği

5.0 / 10
Attack VectorNetworkComplexityLowPrivilegesHighUser Interact.RequiredConfidentialityLowIntegrityNoneAvailabilityNone

Vulnerability Scoring Details

AV:N/AC:L/Au:N/C:P/I:N/A:N
Attack VectorNetwork (Ağ)
Attack ComplexityLow (Düşük)
Privileges Required—
User Interaction—
Confidentiality (Gizlilik)Low (Düşük)
Integrity (Bütünlük)None (Yok)
Availability (Erişilebilirlik)None (Yok)

Yama doğrulandı

10 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

Üreticiyi takip et

RH
Red Hat logo
Red Hat
O
openssl logo
openssl

Zafiyet Türü (CWE & CAPEC)

CWE-805

İlgili Benzer Açıklar

Bu açığı API ile alın

Etkilenen ürünler, sürüm aralıkları, istismar durumu ve yama bilgisi tek istekte; ücretsiz anahtarla.

Ücretsiz anahtar alBelgeler
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.enginteksut.com.tr/api/v1/intel/cves/CVE-2014-0160"