SSL 3.0: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Summary

Product

Vulnerabilities 1

• Low 3.4
  CVE-2014-3566 Public exploit EPSS 100%

  The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which ma…

  openssl openssl openjdk-7 wolfssl Debian Ubuntu
  Oct 15, 2014

Revision history

1. 2023-04-16 #78

   Neue Updates von IBM aufgenommen

2. 2023-02-19 #77

   Neue Updates von IBM aufgenommen

3. 2021-03-31 #76

   Neue Updates von Oracle Linux aufgenommen

4. 2019-08-18 #75

   Neue Updates von Oracle Linux aufgenommen

5. 2019-03-13 #74

   Neue Updates von Oracle Linux aufgenommen

6. 2017-02-19 #72

   New remediations available

7. 2017-02-19 #73

   Version nicht vorhanden

8. 2016-09-27 #71

   New remediations available

9. 2016-02-24 #70

   New remediations available

10. 2016-01-24 #69

    New remediations available

11. 2015-10-08 #67

    New remediations available

12. 2015-10-08 #68

    Version nicht vorhanden

13. 2015-08-04 #61

    New remediations available

14. 2015-08-04 #62

    Version nicht vorhanden

15. 2015-08-04 #63

    Version nicht vorhanden

16. 2015-08-04 #64

    Version nicht vorhanden

17. 2015-08-04 #65

    Version nicht vorhanden

18. 2015-08-04 #66

    Version nicht vorhanden

19. 2015-06-04 #59

    New remediations available

20. 2015-06-04 #60

    Version nicht vorhanden

21. 2015-05-10 #57

    New remediations available

22. 2015-05-10 #58

    Version nicht vorhanden

23. 2015-03-29 #56

    New remediations available

24. 2015-03-24 #54

    New remediations available

25. 2015-03-24 #55

    Version nicht vorhanden

References

• IBM Security Bulletin 867654 vom 2023-04-14
  https://www.ibm.com/support/pages/node/867654
• Microsoft Security Advisory 3009008 vom 2014-10-14
  https://technet.microsoft.com/en-us/library/security/3009008
• Splunk Product Security Announcement SP-CAAANKE vom 2014-10-14
  http://www.splunk.com/view/SP-CAAANKE
• OpenSSL Security Advisory "This POODLE Bites: Exploiting The SSL 3.0 Fallback"
  https://www.openssl.org/~bodo/ssl-poodle.pdf
• Mozilla Security Blog "The POODLE Attack and the End of SSL 3.0" vom 2014-10-14
  https://blog.mozilla.org/security/2014/10/14/the-poodle-attack-and-the-end-of-ssl-3-0/
• Google Online Security Blog "This POODLE bites: exploiting the SSL 3.0 fallback" vom 2014-10-14
  http://googleonlinesecurity.blogspot.de/2014/10/this-poodle-bites-exploiting-ssl-30.html
• F5 Security Advisory SOL15702 vom 2014-10-14
  https://support.f5.com/kb/en-us/solutions/public/15000/700/sol15702.html
• OpenSSL Security Advisory vom 2014-10-15
  https://www.openssl.org/news/secadv_20141015.txt
• IBM Security Bulletin #1687172 vom 2014-10-15
  http://www-01.ibm.com/support/docview.wss?uid=swg21687172
• Juniper Security Bulletin vom 2014-10-15
  http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10656
• Fortinet Security Advisory vom 2014-10-15
  http://www.fortiguard.com/advisory/SSL-v3--POODLE--Vulnerability/
• Debian Security Advisory DSA-3053-1 vom 2014-10-16
  https://www.debian.org/security/2014/dsa-3053
• Red Hat Security Advisory RHSA-2014:1653-1 vom 2014-10-16
  http://rhn.redhat.com/errata/RHSA-2014-1653.html
• Red Hat Security Advisory RHSA-2014:1652-1 vom 2014-10-16
  http://rhn.redhat.com/errata/RHSA-2014-1652.html
• CentOS Errata and Security Advisory 2014:1653
  http://lists.centos.org/pipermail/centos-announce/2014-October/020693.html
• CentOS Errata and Security Advisory 2014:1652
  http://lists.centos.org/pipermail/centos-announce/2014-October/020695.html
• SANS Institute Community vom 2014-10-16
  https://isc.sans.edu/forums/diary/POODLE+Turning+off+SSLv3+for+various+servers+and+client+/18837
• Cisco Security Advisory cisco-sa-20141015-poodle vom 2014-10-16
  http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141015-poodle
• Apple Security Advisory HT6531 vom 2014-10-16
  https://support.apple.com/kb/HT6531
• Apple Security Advisory HT6529 vom 2014-10-16
  https://support.apple.com/kb/HT6529
• Apple Security Advisory HT6527 vom 2014-10-16
  https://support.apple.com/kb/HT6527
• Apple Security Advisory HT6536 vom 2014-10-16
  https://support.apple.com/kb/HT6536
• Juniper Security Bulletin JSA10656 vom 2014-10-16
  http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10656&cat=SIRT_1&actp=LIST
• Eintrag in Blackberry Knowledge Base: Article ID: KB36397
  http://btsc.webapps.blackberry.com/btsc/dynamickc.do?externalId=KB36397&sliceID=1&command=show&forward=nonthreadedKC&kcId=KB36397
• Asterisk Project Security Advisory - AST-2014-011
  http://downloads.asterisk.org/pub/security/AST-2014-011.pdf
• CVE-2014-3566 vom 2014-10-20
  http://downloads.asterisk.org/pub/security/AST-2014-011.pdf
• Mandriva Security Advisory MDVSA-2014:203 vom 2014-10-23
  http://www.mandriva.com/de/support/security/advisories/advisory/MDVSA-2014%3A203/
• FSC-2014-8 vom 2014-10-24
  http://www.f-secure.com/en/web/labs_global/fsc-2014-8
• sa83 vom 2014-10-27
  https://kb.bluecoat.com/security-advisory/sa83
• IBM Security Bulletin #1687678 vom 2014-10-27
  http://www-01.ibm.com/support/docview.wss?uid=swg21687678
• CTX200238 vom 2014-10-29
  http://support.citrix.com/article/CTX200238
• IBM SECURITY ADVISORY vom 2014-10-29
  http://aix.software.ibm.com/aix/efixes/security/openssl_advisory11.asc
• Update des Microsoft Security Advisory 3009008
  https://technet.microsoft.com/en-us/library/security/3009008
• IBM Security Bulletin 1688137 vom 2014-10-31
  http://www-01.ibm.com/support/docview.wss?uid=swg21688137
• HP SECURITY BULLETIN
  https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04492722
• SUSE Security Update SUSE-SU-2014:1357 vom 2014-11-04
  http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00001.html
• NetBSD Security Advisory 2014-015 vom 2014-11-06
  http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-015.txt.asc
• Splunk Advisory SP-CAAANR7
  http://www.splunk.com/view/SP-CAAANR7
• Red Hat Security Advisory RHSA-2014:1877-1 vom 2014-11-19
  http://rhn.redhat.com/errata/RHSA-2014-1877.html
• Red Hat Security Advisory RHSA-2014:1876-1 vom 2014-11-19
  http://rhn.redhat.com/errata/RHSA-2014-1876.html
• Red Hat Security Advisory RHSA-2014:1882-1 vom 2014-11-20
  http://rhn.redhat.com/errata/RHSA-2014-1882.html
• Red Hat Security Advisory RHSA-2014:1881-2 vom 2014-11-20
  http://rhn.redhat.com/errata/RHSA-2014-1881.html
• Red Hat Security Advisory RHSA-2014:1880-1 vom 2014-11-20
  http://rhn.redhat.com/errata/RHSA-2014-1880.html
• Red Hat Security Advisory RHSA-2015:0012 vom 2015-01-06
  https://rhn.redhat.com/errata/RHSA-2015-0012.html
• Red Hat Security Advisory RHSA-2015:0011 vom 2015-01-06
  https://rhn.redhat.com/errata/RHSA-2015-0011.html
• Red Hat Security Advisory RHSA-2015:0010 vom 2015-01-06
  https://rhn.redhat.com/errata/RHSA-2015-0010.html
• SUSE Security Update SUSE-SU-2015:0010-1 vom 2015-01-05
  http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00000.html
• Debian Security Advisory DSA-3147-1 vom 2015-01-30
  https://www.debian.org/security/2015/dsa-3147
• Debian Security Advisory DSA-3144-1 vom 2015-01-30
  https://www.debian.org/security/2015/dsa-3144
• Red Hat Security Advisory RHSA-2015:0698-1 vom 2015-03-18
  http://rhn.redhat.com/errata/RHSA-2015-0698.html
• SUSE Security Update SUSE-SU-2015:0578-1 vom 2015-03-23
  https://www.suse.com/support/update/announcement/2015/suse-su-20150578-1.html
• HP Security Bulletin HPSBMU03263
  https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04574073
• Mandriva Security Advisory MDVSA-2015:062 vom 2015-03-27
  http://www.mandriva.com/de/support/security/advisories/advisory/MDVSA-2015%3A062/
• Debian Security Advisory DSA-3253-1 vom 2015-05-08
  https://www.debian.org/security/2015/dsa-3253
• HP Security Bulletin HPSBHF03300 rev.3 vom 2015-06-04
  https://h20565.www2.hp.com/hpsc/doc/public/display?calledBy=&docId=emr_na-c04616259&docLocale=en_US
• Red Hat Security Advisory vom 2015-08-04
  http://rhn.redhat.com/errata/RHSA-2015-1546.html
• Red Hat Security Advisory vom 2015-08-04
  http://rhn.redhat.com/errata/RHSA-2015-1545.html
• SUSE Security Update SUSE-SU-2014:1519-1 vom 2015-10-09
  https://www.suse.com/support/update/announcement/2014/suse-su-20141519-1.html
• SUSE Security Update SUSE-SU-2014:1361-1 vom 2016-01-22
  https://www.suse.com/support/update/announcement/2014/suse-su-20141361-1.html
• SUSE Security Update SUSE-SU-2014:1357-1 vom 2016-01-22
  https://www.suse.com/support/update/announcement/2014/suse-su-20141357-1.html
• Debian Security Advisory DSA-3489 vom 2016-02-24
  https://www.debian.org/security/2016/dsa-3489
• SUSE Security Update SUSE-SU-2016:2396-1 vom 2016-09-27
  https://www.suse.com/support/update/announcement/2016/suse-su-20162396-1.html
• NetApp Advisory NTAP-20141015-0001
  https://kb.netapp.com/support/s/article/ka51A000000079xQAA/cve-2014-3566-ssl-v3-0-nondeterministic-cbc-padding-vulnerability-in-multiple-netapp-products?language=en_US
• Oracle Linux Security Advisory ELSA-2019-4581 vom 2019-03-13
  http://linux.oracle.com/errata/ELSA-2019-4581.html
• Oracle Linux Security Advisory ELSA-2019-4747 vom 2019-08-16
  http://linux.oracle.com/errata/ELSA-2019-4747.html
• Oracle Linux Security Advisory ELSA-2021-9150 vom 2021-04-01
  https://linux.oracle.com/errata/ELSA-2021-9150.html
• IBM Security Bulletin 690369 vom 2023-02-20
  https://www.ibm.com/support/pages/node/690369