Wind River Support Network


LIN7-2575 : Security Advisory - openssl - CVE-2014-3569

Created: Dec 30, 2014    Updated: Sep 8, 2018
Resolved Date: Jan 4, 2015
Found In Version: 7.0
Fix Version:
Severity: Standard
Applicable for: Wind River Linux 7
Component/s: Userspace


The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshake to a no-ssl3 application with certain error handling.  NOTE: this issue became relevant after the CVE-2014-3568 fix.<a href=>CWE-476: NULL Pointer Dereference</a>

Other Downloads


Live chat