MNBSD-2014-9: OpenSSL DTLS memory consumption, memory leak, and information disclosure

Description

Several OpenSSL DTLS-related issues were fixed: a crafted DTLS handshake message could cause excessive memory consumption, a crafted DTLS packet could leak memory, a flaw in OBJ_obj2txt could leak stack information via pretty-printing functions, and DTLS clients enabling anonymous (EC)DH ciphersuites were subject to a denial of service. Impacts are denial of service and information disclosure.

Affected Versions

openssl

Recommendations

No specific recommendations provided.

References

• https://www.freebsd.org/security/advisories/FreeBSD-SA-14:18.openssl.asc
• https://www.cve.org/CVERecord?id=CVE-2014-3506
• https://www.cve.org/CVERecord?id=CVE-2014-3507
• https://www.cve.org/CVERecord?id=CVE-2014-3508
• https://www.cve.org/CVERecord?id=CVE-2014-3510

Additional Information

Aliases: CVE-2014-3506, CVE-2014-3507, CVE-2014-3508, CVE-2014-3510

Published: September 09, 2014
Last Modified: September 09, 2014