NetSight
IP …
medium4.3

CVE-2014-3470

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher …

Impact

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.

Affected products

VendorProductAffected versions
OpensslOpenssl
before 0.9.8za
from 1.0.0 before 1.0.0m
from 1.0.1 before 1.0.1h
RedhatStorage
Version 2.1
FedoraprojectFedora
All versions
Versions 19, 20
RedhatEnterprise Linux
Versions 5, 6.0
MariadbMariadb
from 10.0.0 before 10.0.13
OpensuseLeap
Version 42.1
OpensuseOpensuse
Version 13.2
SuseLinux Enterprise Desktop
Version 12
SuseLinux Enterprise Server
Version 12
SuseLinux Enterprise Software Development Kit
Version 12
SuseLinux Enterprise Workstation Extension
Version 12

Weakness classification

CWE-476

References