CVE - CVE-2014-3511

CVE-ID
CVE-2014-3511	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MLIST:[syslog-ng-announce] 20140910 syslog-ng Premium Edition 5 LTS (5.0.6a) has been released URL:https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-September/000196.html CONFIRM:https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=280b1f1ad12131defcd986676a8fc9717aaa601b CONFIRM:https://www.openssl.org/news/secadv_20140806.txt CONFIRM:http://www.arubanetworks.com/support/alerts/aid-08182014.txt CONFIRM:http://www.tenable.com/security/tns-2014-06 CONFIRM:http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc CONFIRM:https://kc.mcafee.com/corporate/index?page=content&id=SB10084 CONFIRM:http://www.splunk.com/view/SP-CAAANHS CONFIRM:http://www-01.ibm.com/support/docview.wss?uid=swg21686997 CONFIRM:http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htm CONFIRM:http://www-01.ibm.com/support/docview.wss?uid=swg21682293 CONFIRM:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888 CONFIRM:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380 CONFIRM:http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15564.html CONFIRM:https://techzone.ergon.ch/CVE-2014-3511 CONFIRM:http://www-01.ibm.com/support/docview.wss?uid=swg21683389 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=1127504 CONFIRM:http://linux.oracle.com/errata/ELSA-2014-1052.html CONFIRM:http://www-01.ibm.com/support/docview.wss?uid=nas8N1020240 CONFIRM:https://support.citrix.com/article/CTX216642 DEBIAN:DSA-2998 URL:http://www.debian.org/security/2014/dsa-2998 FEDORA:FEDORA-2014-9301 URL:http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html FEDORA:FEDORA-2014-9308 URL:http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html FREEBSD:FreeBSD-SA-14:18 URL:https://www.freebsd.org/security/advisories/FreeBSD-SA-14:18.openssl.asc GENTOO:GLSA-201412-39 URL:http://security.gentoo.org/glsa/glsa-201412-39.xml HP:HPSBMU03260 URL:http://marc.info/?l=bugtraq&m=142495837901899&w=2 HP:SSRT101894 URL:http://marc.info/?l=bugtraq&m=142495837901899&w=2 HP:HPSBMU03216 URL:http://marc.info/?l=bugtraq&m=142350350616251&w=2 HP:SSRT101818 URL:http://marc.info/?l=bugtraq&m=142350350616251&w=2 HP:HPSBMU03267 URL:http://marc.info/?l=bugtraq&m=142624590206005&w=2 HP:HPSBHF03293 URL:http://marc.info/?l=bugtraq&m=142660345230545&w=2 HP:SSRT101846 URL:http://marc.info/?l=bugtraq&m=142660345230545&w=2 HP:HPSBMU03304 URL:http://marc.info/?l=bugtraq&m=142791032306609&w=2 HP:HPSBMU03261 URL:http://marc.info/?l=bugtraq&m=143290522027658&w=2 HP:HPSBMU03263 URL:http://marc.info/?l=bugtraq&m=143290437727362&w=2 NETBSD:NetBSD-SA2014-008 URL:ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc REDHAT:RHSA-2015:0197 URL:http://rhn.redhat.com/errata/RHSA-2015-0197.html REDHAT:RHSA-2015:0126 URL:http://rhn.redhat.com/errata/RHSA-2015-0126.html SUSE:openSUSE-SU-2014:1052 URL:http://lists.opensuse.org/opensuse-updates/2014-08/msg00036.html BID:69079 URL:http://www.securityfocus.com/bid/69079 SECTRACK:1030693 URL:http://www.securitytracker.com/id/1030693 SECUNIA:59887 URL:http://secunia.com/advisories/59887 SECUNIA:60377 URL:http://secunia.com/advisories/60377 SECUNIA:60810 URL:http://secunia.com/advisories/60810 SECUNIA:60890 URL:http://secunia.com/advisories/60890 SECUNIA:60917 URL:http://secunia.com/advisories/60917 SECUNIA:60921 URL:http://secunia.com/advisories/60921 SECUNIA:60938 URL:http://secunia.com/advisories/60938 SECUNIA:61775 URL:http://secunia.com/advisories/61775 SECUNIA:61959 URL:http://secunia.com/advisories/61959 SECUNIA:59756 URL:http://secunia.com/advisories/59756 SECUNIA:60803 URL:http://secunia.com/advisories/60803 SECUNIA:61017 URL:http://secunia.com/advisories/61017 SECUNIA:61043 URL:http://secunia.com/advisories/61043 SECUNIA:61100 URL:http://secunia.com/advisories/61100 SECUNIA:61139 URL:http://secunia.com/advisories/61139 SECUNIA:61184 URL:http://secunia.com/advisories/61184 SECUNIA:58962 URL:http://secunia.com/advisories/58962 SECUNIA:59700 URL:http://secunia.com/advisories/59700 SECUNIA:59710 URL:http://secunia.com/advisories/59710 SECUNIA:60022 URL:http://secunia.com/advisories/60022 SECUNIA:60684 URL:http://secunia.com/advisories/60684 SECUNIA:60221 URL:http://secunia.com/advisories/60221 SECUNIA:60493 URL:http://secunia.com/advisories/60493 XF:openssl-cve20143511-sec-bypass(95162) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/95162
Assigning CNA
N/A
Date Entry Created
20140514	Disclaimer: The entry creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20140514)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an entry on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: cve@mitre.org