Skip to content

CVE-2014-0195 The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, wh...

MediumCVSS 6.8 EPSS 100.0% Framework module
Published
Updated
Exploit status
Public exploit available
Sign in for asset impact Search another CVE

Description

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.

Affected products

ProductAffected versionsFixed in
debian/openssl(Debian:12) < 1.0.1h-1 1.0.1h-1
debian/openssl(Debian:13) < 1.0.1h-1 1.0.1h-1
debian/openssl(Debian:14) < 1.0.1h-1 1.0.1h-1
OpenSSL >= 0.9.8, < 0.9.8za 0.9.8za
OpenSSL >= 1.0.0, < 1.0.0m 1.0.0m
OpenSSL >= 1.0.1, < 1.0.1h 1.0.1h
MariaDB Server >= 10.0.0, < 10.0.13 10.0.13
openSUSE leap = 42.1 No fix listed
opensuse = 13.2 No fix listed
fedoraproject fedora = 19 No fix listed
fedoraproject fedora = 20 No fix listed

References