CVE-2014-3616
Ubuntu Security Notice USN-2351-1
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks.
nginx 0.5.6 hasta 1.7.4, cuando utiliza el mismo ssl_session_cache o ssl_session_ticket_key compartido para múltiples servidores, puede reutilizar una sesión SSL en caché para un contexto no relacionado, lo que permite a atacantes remotos con ciertos privilegios realizar ataques de 'confusión de anfitriones virtuales'.
A bug in the experimental SPDY implementation in nginx was found, which might allow an attacker to cause a heap memory buffer overflow in a worker process by using a specially crafted request, potentially resulting in arbitrary code execution. Antoine Delignat-Lavaud and Karthikeyan Bhargavan discovered that it was possible to reuse cached SSL sessions in unrelated contexts, allowing virtual host confusion attacks in some configurations by an attacker in a privileged network position.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2014-05-14 CVE Reserved
- 2014-09-22 CVE Published
- 2024-08-06 CVE Updated
- 2025-05-25 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-613: Insufficient Session Expiration
CAPEC
References (2)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html | 2021-11-10 | |
http://www.debian.org/security/2014/dsa-3029 | 2021-11-10 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
F5 Search vendor "F5" | Nginx Search vendor "F5" for product "Nginx" | >= 0.5.6 < 1.6.2 Search vendor "F5" for product "Nginx" and version " >= 0.5.6 < 1.6.2" | - |
Affected
| ||||||
F5 Search vendor "F5" | Nginx Search vendor "F5" for product "Nginx" | >= 1.7.0 < 1.7.5 Search vendor "F5" for product "Nginx" and version " >= 1.7.0 < 1.7.5" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 7.0 Search vendor "Debian" for product "Debian Linux" and version "7.0" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
|