Loading vulnerability…
OpenSSL Anonymous ECDH NULL Pointer Dereference Denial of Service
CVE-2014-3470 is a NULL pointer dereference in OpenSSL's ssl3_send_client_key_exchange function during anonymous Elliptic Curve Diffie-Hellman (ECDH) key exchange. A specially crafted TLS/SSL handshake can trigger use of a NULL certificate value, crashing the client process. Affected upstream versions are releases before 0.9.8za, the 1.0.0 branch before 1.0.0m, and the 1.0.1 branch before 1.0.1h. Exploitation requires an anonymous ECDH cipher suite to be enabled and used.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote attacker can cause denial of service by crashing an application using the vulnerable OpenSSL client implementation. The interruption affects the client process and any application functionality dependent on it. Arbitrary code execution, unauthorized access, and confidentiality or integrity compromise are not established for this vulnerability.
If you can’t patch tonight, do this now.
Disable anonymous ECDH cipher suites in affected client configurations until patched. Restrict connections to untrusted TLS endpoints where feasible. For affected IBM Security Network Protection XGS deployments, disabling outbound SSL Inspection is a vendor-listed workaround.
Patch, then assume compromise.
Install an OpenSSL release containing the fix: 0.9.8za, 1.0.0m, or 1.0.1h or later in the corresponding branch, or a vendor package containing a backported correction. Update bundled OpenSSL copies through the affected application's vendor-supported release or hotfix. For Red Hat Enterprise Linux 6, the supplied corrected package version is 1.0.1e-16.el6_5.14. Restart applications and services linked to OpenSSL, or reboot, to ensure the corrected library is loaded.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
45 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.