Loading vulnerability…
OpenSSL SSL_MODE_RELEASE_BUFFERS NULL Pointer Dereference Denial of Service
CVE-2014-0198 is a NULL pointer dereference vulnerability in the do_ssl3_write() function in OpenSSL 1.x through 1.0.1g. When SSL_MODE_RELEASE_BUFFERS is enabled, the function improperly manages a buffer pointer during certain recursive calls. A remote attacker can supply SSL/TLS traffic that triggers an alert condition, causing a NULL pointer dereference and crashing the application. Affected applications may act as SSL/TLS clients or servers.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation disrupts availability by crashing an application or service using vulnerable OpenSSL functionality. Depending on the application's process model, the crash may terminate multiple connections or produce a partial or complete service outage. For affected Siemens SIMATIC S7-1500 devices, the identified impact is a web-server crash; interruption of PLC control operations is not established. This vulnerability does not establish confidentiality or integrity compromise, arbitrary code execution, or unauthorized access.
If you can’t patch tonight, do this now.
Where application configuration permits, disable SSL_MODE_RELEASE_BUFFERS to remove the required vulnerable mode. Restrict network access to affected services to trusted systems while updates are pending. For affected IBM Security Network Protection XGS deployments, disabling outbound SSL Inspection is a documented workaround. These measures do not replace installation of the appropriate security update.
Patch, then assume compromise.
Install a vendor-supported OpenSSL update containing the CVE-2014-0198 fix, or update the product that bundles the library. OpenSSL 1.0.1h includes the fix; vendor-backported fixes may retain an earlier upstream version number. Historical fixed packages include Debian wheezy 1.0.1e-2+deb7u9, Debian jessie/sid 1.0.1g-4, and Red Hat Enterprise Linux 6 package 1.0.1e-16.el6_5.14. Product-specific fixes include HP OneView 1.10, HP Insight Control server migration 7.3.3, and IBM SDK for Node.js 1.1.0.4. Restart all applications and services linked to the updated library, or reboot, to ensure the patched code is loaded.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
36 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.