Security Bulletin: Vulnerabilities in OpenSSL affect IBM PureApplication System (CVE-2014-3513, CVE-2014-3567, CVE-2014-3568)

Vulnerability Details

CVEID: CVE-2014-3513

DESCRIPTION:
OpenSSL is vulnerable to a denial of service, which is caused by a memory leak in the DTLS Secure Real-time Transport Protocol (SRTP) extension parsing code. By sending multiple specially crafted handshake messages, an attacker might exploit this vulnerability to exhaust all of the available memory of an SSL/TLS or DTLS server.

CVSS Base Score: 5.0
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/97035 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-3567

DESCRIPTION:
OpenSSL is vulnerable to a denial of service, which is caused by a memory leak when handling failed session ticket integrity checks. By sending an overly large number of invalid session tickets, an attacker might exploit this vulnerability to exhaust all of the available memory of an SSL/TLS or DTLS server.

CVSS Base Score: 5.0
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/97036 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-3568

DESCRIPTION:
OpenSSL might allow a remote attacker bypass security restrictions. When configured with "no-ssl3" as a build option, servers might accept and complete a SSL 3.0 handshake. An attacker might exploit this vulnerability to perform unauthorized actions.

CVSS Base Score: 2.6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/97037 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:N/I:P/A:N)