NetSight
IP …
high7.5Known exploitedPublic exploit code

CVE-2014-0160

OpenSSL Information Disclosure Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-05-04. Federal due date: 2022-05-25.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

Affected products

VendorProductAffected versions
OpensslOpenssl
from 1.0.1 before 1.0.1g
Filezilla-ProjectFilezilla Server
before 0.9.44
SiemensApplication Processing Engine Firmware
Version 2.0
SiemensCp 1543-1 Firmware
Version 1.1
SiemensSimatic S7-1500 Firmware
Version 1.5
SiemensSimatic S7-1500t Firmware
Version 1.5
SiemensElan-8.2
before 8.3.3
SiemensWincc Open Architecture
Version 3.12
IntellianV100 Firmware
Versions 1.20, 1.21, 1.24
IntellianV60 Firmware
Versions 1.15, 1.25
MitelMicollab
Versions 6.0, 7.0, 7.1, 7.2, 7.3, 7.3.0.104
MitelMivoice
Versions 1.1.2.5, 1.1.3.3, 1.2.0.11, 1.3.2.2, 1.4.0.102

Weakness classification

CWE-125

References