NetSight
IP …
high7.4

CVE-2014-0224

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-th…

Impact

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Affected products

VendorProductAffected versions
OpensslOpenssl
before 0.9.8za
from 1.0.0 before 1.0.0m
from 1.0.1 before 1.0.1h
RedhatJboss Enterprise Application Platform
Versions 5.2.0, 6.2.3
RedhatJboss Enterprise Web Platform
Version 5.2.0
RedhatJboss Enterprise Web Server
Version 2.0.1
RedhatStorage
Version 2.1
FedoraprojectFedora
Versions 19, 20
OpensuseOpensuse
Versions 13.1, 13.2
RedhatEnterprise Linux
Versions 4, 5, 6.0
Filezilla-ProjectFilezilla Server
before 0.9.45
SiemensApplication Processing Engine Firmware
before 2.0.2
SiemensCp1543-1 Firmware
before 1.1.25
SiemensS7-1500 Firmware
before 1.6

Weakness classification

CWE-326

References