• Trend Micro
  • About TrendLabs Security Intelligence Blog
Search:
  • Home
  • Categories
    • Ransomware
    • Vulnerabilities
    • Exploits
    • Targeted Attacks
    • Deep Web
    • Mobile
    • Internet of Things
    • Malware
    • Bad Sites
    • Spam
    • Botnets
    • Social
    • Open source
Home   »   Vulnerabilities   »   Security Advisory: Patch Systems with the Latest Security Updates from OpenSSL

Security Advisory: Patch Systems with the Latest Security Updates from OpenSSL

  • Posted on:June 6, 2014 at 9:38 am
  • Posted in:Vulnerabilities
  • Author:
    Bernadette Irinco (Technical Communications)
0

OpenSSL has recently released six security updates addressing vulnerabilities found in OpenSSL. As of this writing, there is no reported exploit leveraging these vulnerabilities in the wild. The security patches cover the following vulnerabilities:

  • SSL/TLS MITM vulnerability (CVE-2014-0224)
  • DTLS recursion flaw (CVE-2014-0221)
  • DTLS invalid fragment vulnerability (CVE-2014-0195)
  • SSL_MODE_RELEASE_BUFFERS NULL pointer dereference (CVE-2014-0198)
  • SSL_MODE_RELEASE_BUFFERS session injection or denial of service (CVE-2010-5298)
  • Anonymous ECDH denial of service (CVE-2014-3470)

When SSL/TLS MITM vulnerability is exploited via man-in-the-middle attacks, it can allow remote attacker to change traffic from any vulnerable client and server. Note that both client and server have to be vulnerable for this vulnerability to be exploited successfully, making this less serious than the Heartbleed vulnerability. Another notable bulletin is DTLS invalid fragment vulnerability, which can execute arbitrary code if exploited, thus compromising the security of the system. In addition, the DTLS recursion flaw (CVE-2014-0221) can be abused by remote attackers to cause denial-of-service (DoS) attacks.

Accordingly, servers with OpenSSL 1.0.1 and 1.0.2-beta1 are vulnerable. OpenSSL servers earlier than 1.0.1 are also encouraged to upgrade to the following versions:

  • OpenSSL 0.9.8 SSL/TLS users should upgrade to 0.9.8za
  • OpenSSL 1.0.0 SSL/TLS users should upgrade to 1.0.0m
  • OpenSSL 1.0.1 SSL/TLS users should upgrade to 1.0.1h

While these OpenSSL vulnerabilities are different from the Heartbleed bug which affected a number of websites and mobile applications, they also pose security risks to users. As such, web administrators are strongly advised  to patch their systems with the latest security updates from OpenSSL to mitigate the risks of possible threats leveraging these vulnerabilities.

We will update this entry for any developments on the OpenSSL vulnerabilities.

Update as of 12:14 PM, June 6, 2014

Trend Micro Deep Security protects users from these vulnerabilities via the following DPI rules:

  • 1006088 – OpenSSL SSL/TLS Man In The Middle Security Bypass Vulnerability
  • 1006090 – Detected Fragmented DTLS Request
  • 1006084 – GnuTLS “read_server_hello()” Memory Corruption Vulnerability

Update as of 5:17 PM, June 6, 2014

Note that the following DPI rule protects against SSL/TLS MITM vulnerability (CVE-2014-0224):

  • 1006088 – OpenSSL SSL/TLS Man In The Middle Security Bypass Vulnerability

On the other hand, DPI rule “1006091 – Detected Fragmented DTLS Message”  addresses the  following vulnerabilities:

  • DTLS invalid fragment vulnerability (CVE-2014-0195)
  • DTLS recursion flaw (CVE-2014-0221)

Users are also protected from vulnerability covered under CVE-2014-3466, which can allow denial of service or execution of arbitrary code when exploited via this DPI rule:

  • 1006084 – GnuTLS “read_server_hello()” Memory Corruption Vulnerability
Learn how to protect Enterprises, Small Businesses, and Home Users from ransomware:
ENTERPRISE »
SMALL BUSINESS»
HOME»
Tags: CVE-2010-5298CVE-2014-0195CVE-2014-0198CVE-2014-0221CVE-2014-0224CVE-2014-3466CVE-2014-3470denial-of-service attackDoS attackDTLSman-in-the-middle attackMITMOpenSSLsecurity advisorySSL/TLSTrend Micro Deep Securityvulnerability

Security Predictions for 2020

  • Cybersecurity in 2020 will be viewed through many lenses — from differing attacker motivations and cybercriminal arsenal to technological developments and global threat intelligence — only so defenders can keep up with the broad range of threats.
    Read our security predictions for 2020.

Business Process Compromise

  • Attackers are starting to invest in long-term operations that target specific processes enterprises rely on. They scout for vulnerable practices, susceptible systems and operational loopholes that they can leverage or abuse. To learn more, read our Security 101: Business Process Compromise.

Recent Posts

  • Our New Blog
  • How Unsecure gRPC Implementations Can Compromise APIs, Applications
  • XCSSET Mac Malware: Infects Xcode Projects, Performs UXSS Attack on Safari, Other Browsers, Leverages Zero-day Exploits
  • August Patch Tuesday Fixes Critical IE, Important Windows Vulnerabilities Exploited in the Wild
  • Water Nue Phishing Campaign Targets C-Suite’s Office 365 Accounts

Popular Posts

Sorry. No data so far.

Stay Updated

  • Home and Home Office
  • |
  • For Business
  • |
  • Security Intelligence
  • |
  • About Trend Micro
  • Asia Pacific Region (APAC): Australia / New Zealand, 中国, 日本, 대한민국, 台灣
  • Latin America Region (LAR): Brasil, México
  • North America Region (NABU): United States, Canada
  • Europe, Middle East, & Africa Region (EMEA): France, Deutschland / Österreich / Schweiz, Italia, Россия, España, United Kingdom / Ireland
  • Privacy Statement
  • Legal Policies
  • Copyright © Trend Micro Incorporated. All rights reserved.