Wind River Support Network

HomeDefectsLIN7-78

Fixed

LIN7-78 : Security Advisory - openssl - CVE-2014-0160

Created: May 19, 2014 Updated: Mar 31, 2016

Resolved Date: Jun 5, 2014

Found In Version: 7.0.0.0.LB08

Fix Version: 7.0

Severity: Critical

Applicable for: Wind River Linux 7

Component/s: Userspace

Description

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug. 

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160