CVE-2014-0160
OpenSSL Information Disclosure Vulnerability
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
15
*Multiple Sources
Exploited in Wild
Yes
*KEV
Decision
-
*SSVC
Descriptions
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
Las implementaciones de (1) TLS y (2) DTLS en OpenSSL 1.0.1 en versiones anteriores a 1.0.1g no manejan adecuadamente paquetes Heartbeat Extension, lo que permite a atacantes remotos obtener información sensible desde la memoria de proceso a través de paquetes manipulados que desencadenan una sobrelectura del buffer, según lo demostrado mediante la lectura de claves privadas, relacionado con d1_both.c y t1_lib.c, también conocido como bug Heartbleed.
An information disclosure flaw was found in the way OpenSSL handled TLS and DTLS Heartbeat Extension packets. A malicious TLS or DTLS client or server could send a specially crafted TLS or DTLS Heartbeat packet to disclose a limited portion of memory per request from a connected client or server. Note that the disclosed portions of memory could potentially include sensitive information such as private keys.
Streamworks Job Scheduler Release 7 has all agents using the same X.509 certificates and keys issued by the vendor for authentication. The processing server component does not check received messages properly for authenticity. Agents installed on servers do not check received messages properly for authenticity. Agents and processing servers are vulnerable to the TLS Heartbleed attack.
The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2013-12-03 CVE Reserved
- 2014-04-07 CVE Published
- 2014-04-08 First Exploit
- 2022-05-04 Exploited in Wild
- 2022-05-25 KEV Due Date
- 2024-08-06 CVE Updated
- 2024-08-30 EPSS Updated
CWE
- CWE-125: Out-of-bounds Read
- CWE-201: Insertion of Sensitive Information Into Sent Data
CAPEC
References (138)
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Siemens Search vendor "Siemens" | Application Processing Engine Firmware Search vendor "Siemens" for product "Application Processing Engine Firmware" | 2.0 Search vendor "Siemens" for product "Application Processing Engine Firmware" and version "2.0" | - |
Affected
| in | Siemens Search vendor "Siemens" | Application Processing Engine Search vendor "Siemens" for product "Application Processing Engine" | - | - |
Safe
|
| Siemens Search vendor "Siemens" | Cp 1543-1 Firmware Search vendor "Siemens" for product "Cp 1543-1 Firmware" | 1.1 Search vendor "Siemens" for product "Cp 1543-1 Firmware" and version "1.1" | - |
Affected
| in | Siemens Search vendor "Siemens" | Cp 1543-1 Search vendor "Siemens" for product "Cp 1543-1" | - | - |
Safe
|
| Siemens Search vendor "Siemens" | Simatic S7-1500 Firmware Search vendor "Siemens" for product "Simatic S7-1500 Firmware" | 1.5 Search vendor "Siemens" for product "Simatic S7-1500 Firmware" and version "1.5" | - |
Affected
| in | Siemens Search vendor "Siemens" | Simatic S7-1500 Search vendor "Siemens" for product "Simatic S7-1500" | - | - |
Safe
|
| Siemens Search vendor "Siemens" | Simatic S7-1500t Firmware Search vendor "Siemens" for product "Simatic S7-1500t Firmware" | 1.5 Search vendor "Siemens" for product "Simatic S7-1500t Firmware" and version "1.5" | - |
Affected
| in | Siemens Search vendor "Siemens" | Simatic S7-1500t Search vendor "Siemens" for product "Simatic S7-1500t" | - | - |
Safe
|
| Intellian Search vendor "Intellian" | V100 Firmware Search vendor "Intellian" for product "V100 Firmware" | 1.20 Search vendor "Intellian" for product "V100 Firmware" and version "1.20" | - |
Affected
| in | Intellian Search vendor "Intellian" | V100 Search vendor "Intellian" for product "V100" | - | - |
Safe
|
| Intellian Search vendor "Intellian" | V100 Firmware Search vendor "Intellian" for product "V100 Firmware" | 1.21 Search vendor "Intellian" for product "V100 Firmware" and version "1.21" | - |
Affected
| in | Intellian Search vendor "Intellian" | V100 Search vendor "Intellian" for product "V100" | - | - |
Safe
|
| Intellian Search vendor "Intellian" | V100 Firmware Search vendor "Intellian" for product "V100 Firmware" | 1.24 Search vendor "Intellian" for product "V100 Firmware" and version "1.24" | - |
Affected
| in | Intellian Search vendor "Intellian" | V100 Search vendor "Intellian" for product "V100" | - | - |
Safe
|
| Intellian Search vendor "Intellian" | V60 Firmware Search vendor "Intellian" for product "V60 Firmware" | 1.15 Search vendor "Intellian" for product "V60 Firmware" and version "1.15" | - |
Affected
| in | Intellian Search vendor "Intellian" | V60 Search vendor "Intellian" for product "V60" | - | - |
Safe
|
| Intellian Search vendor "Intellian" | V60 Firmware Search vendor "Intellian" for product "V60 Firmware" | 1.25 Search vendor "Intellian" for product "V60 Firmware" and version "1.25" | - |
Affected
| in | Intellian Search vendor "Intellian" | V60 Search vendor "Intellian" for product "V60" | - | - |
Safe
|
| Ricon Search vendor "Ricon" | S9922l Firmware Search vendor "Ricon" for product "S9922l Firmware" | 16.10.3\(3794\) Search vendor "Ricon" for product "S9922l Firmware" and version "16.10.3\(3794\)" | - |
Affected
| in | Ricon Search vendor "Ricon" | S9922l Search vendor "Ricon" for product "S9922l" | 1.0 Search vendor "Ricon" for product "S9922l" and version "1.0" | - |
Safe
|
| Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | >= 1.0.1 < 1.0.1g Search vendor "Openssl" for product "Openssl" and version " >= 1.0.1 < 1.0.1g" | - |
Affected
| ||||||
| Filezilla-project Search vendor "Filezilla-project" | Filezilla Server Search vendor "Filezilla-project" for product "Filezilla Server" | < 0.9.44 Search vendor "Filezilla-project" for product "Filezilla Server" and version " < 0.9.44" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Elan-8.2 Search vendor "Siemens" for product "Elan-8.2" | < 8.3.3 Search vendor "Siemens" for product "Elan-8.2" and version " < 8.3.3" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Wincc Open Architecture Search vendor "Siemens" for product "Wincc Open Architecture" | 3.12 Search vendor "Siemens" for product "Wincc Open Architecture" and version "3.12" | - |
Affected
| ||||||
| Mitel Search vendor "Mitel" | Micollab Search vendor "Mitel" for product "Micollab" | 6.0 Search vendor "Mitel" for product "Micollab" and version "6.0" | - |
Affected
| ||||||
| Mitel Search vendor "Mitel" | Micollab Search vendor "Mitel" for product "Micollab" | 7.0 Search vendor "Mitel" for product "Micollab" and version "7.0" | - |
Affected
| ||||||
| Mitel Search vendor "Mitel" | Micollab Search vendor "Mitel" for product "Micollab" | 7.1 Search vendor "Mitel" for product "Micollab" and version "7.1" | - |
Affected
| ||||||
| Mitel Search vendor "Mitel" | Micollab Search vendor "Mitel" for product "Micollab" | 7.2 Search vendor "Mitel" for product "Micollab" and version "7.2" | - |
Affected
| ||||||
| Mitel Search vendor "Mitel" | Micollab Search vendor "Mitel" for product "Micollab" | 7.3 Search vendor "Mitel" for product "Micollab" and version "7.3" | - |
Affected
| ||||||
| Mitel Search vendor "Mitel" | Micollab Search vendor "Mitel" for product "Micollab" | 7.3.0.104 Search vendor "Mitel" for product "Micollab" and version "7.3.0.104" | - |
Affected
| ||||||
| Mitel Search vendor "Mitel" | Mivoice Search vendor "Mitel" for product "Mivoice" | 1.1.2.5 Search vendor "Mitel" for product "Mivoice" and version "1.1.2.5" | lync |
Affected
| ||||||
| Mitel Search vendor "Mitel" | Mivoice Search vendor "Mitel" for product "Mivoice" | 1.1.3.3 Search vendor "Mitel" for product "Mivoice" and version "1.1.3.3" | skype_for_business |
Affected
| ||||||
| Mitel Search vendor "Mitel" | Mivoice Search vendor "Mitel" for product "Mivoice" | 1.2.0.11 Search vendor "Mitel" for product "Mivoice" and version "1.2.0.11" | skype_for_business |
Affected
| ||||||
| Mitel Search vendor "Mitel" | Mivoice Search vendor "Mitel" for product "Mivoice" | 1.3.2.2 Search vendor "Mitel" for product "Mivoice" and version "1.3.2.2" | skype_for_business |
Affected
| ||||||
| Mitel Search vendor "Mitel" | Mivoice Search vendor "Mitel" for product "Mivoice" | 1.4.0.102 Search vendor "Mitel" for product "Mivoice" and version "1.4.0.102" | skype_for_business |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Opensuse Search vendor "Opensuse" for product "Opensuse" | 12.3 Search vendor "Opensuse" for product "Opensuse" and version "12.3" | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Opensuse Search vendor "Opensuse" for product "Opensuse" | 13.1 Search vendor "Opensuse" for product "Opensuse" and version "13.1" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 12.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.04" | esm |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 12.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.10" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 13.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "13.10" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 19 Search vendor "Fedoraproject" for product "Fedora" and version "19" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 20 Search vendor "Fedoraproject" for product "Fedora" and version "20" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Gluster Storage Search vendor "Redhat" for product "Gluster Storage" | 2.1 Search vendor "Redhat" for product "Gluster Storage" and version "2.1" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Storage Search vendor "Redhat" for product "Storage" | 2.1 Search vendor "Redhat" for product "Storage" and version "2.1" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Virtualization Search vendor "Redhat" for product "Virtualization" | 6.0 Search vendor "Redhat" for product "Virtualization" and version "6.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Desktop Search vendor "Redhat" for product "Enterprise Linux Desktop" | 6.0 Search vendor "Redhat" for product "Enterprise Linux Desktop" and version "6.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server" | 6.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "6.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Server Aus Search vendor "Redhat" for product "Enterprise Linux Server Aus" | 6.5 Search vendor "Redhat" for product "Enterprise Linux Server Aus" and version "6.5" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Server Eus Search vendor "Redhat" for product "Enterprise Linux Server Eus" | 6.5 Search vendor "Redhat" for product "Enterprise Linux Server Eus" and version "6.5" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Server Tus Search vendor "Redhat" for product "Enterprise Linux Server Tus" | 6.5 Search vendor "Redhat" for product "Enterprise Linux Server Tus" and version "6.5" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Workstation Search vendor "Redhat" for product "Enterprise Linux Workstation" | 6.0 Search vendor "Redhat" for product "Enterprise Linux Workstation" and version "6.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 6.0 Search vendor "Debian" for product "Debian Linux" and version "6.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 7.0 Search vendor "Debian" for product "Debian Linux" and version "7.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
| Broadcom Search vendor "Broadcom" | Symantec Messaging Gateway Search vendor "Broadcom" for product "Symantec Messaging Gateway" | 10.6.0 Search vendor "Broadcom" for product "Symantec Messaging Gateway" and version "10.6.0" | - |
Affected
| ||||||
| Broadcom Search vendor "Broadcom" | Symantec Messaging Gateway Search vendor "Broadcom" for product "Symantec Messaging Gateway" | 10.6.1 Search vendor "Broadcom" for product "Symantec Messaging Gateway" and version "10.6.1" | - |
Affected
| ||||||
| Splunk Search vendor "Splunk" | Splunk Search vendor "Splunk" for product "Splunk" | >= 6.0.0 < 6.0.3 Search vendor "Splunk" for product "Splunk" and version " >= 6.0.0 < 6.0.3" | enterprise |
Affected
| ||||||