Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2014-8176

Description

The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data.

POC

Reference

- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

- https://kc.mcafee.com/corporate/index?page=content&id=SB10122

Github

- https://github.com/ARPSyndicate/cvemon

- https://github.com/Live-Hack-CVE/CVE-2014-8176

- https://github.com/Samaritin/OSINT

- https://github.com/chnzzh/OpenSSL-CVE-lib

- https://github.com/xaviermerino/ECE1552