ID

VAR-201410-1418

CVE

CVE-2014-3566

TITLE

OpenSSL CVE-2014-3566 Man In The Middle Information Disclosure Vulnerability

DESCRIPTION

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. OpenSSL is prone to an information disclosure vulnerability. An attacker can exploit this issue to perform man-in-the-middle attacks and obtain sensitive information. Successful exploits will lead to other attacks. The following versions are vulnerable: OpenSSL 0.9.8 prior to 0.9.8zc OpenSSL 1.0.0 prior to 1.0.0o OpenSSL 1.0.1 prior to 1.0.1j. SSL protocol is the abbreviation of Secure Socket Layer protocol (Secure Socket Layer) developed by Netscape, which provides security and data integrity guarantee for Internet communication. The vulnerability is caused by the program's use of non-deterministic CBC padding. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04776510 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04776510 Version: 1 HPSBMU03416 rev.1 - HP Data Protector, Remote Disclosure of Information NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2015-08-28 Last Updated: 2015-08-28 Potential Security Impact: Remote disclosure of information Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY A potential security vulnerability has been identified with HP Data Protector. This is the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" also known as "Poodle", which could be exploited remotely to allow disclosure of information. References: CVE-2014-3566 (SSRT102185) SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP Storage Data Protector Cell Manager v8 before v8.13_206 and v9 before v9.03MMR running on HP-UX 11i, Windows Server 2008/2008R2/2012/2012R2, Redhat, CentOS, Oracle Linux, and SUSE Linux_x64. BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2014-3566 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP has provided the following patches to resolve these vulnerabilities. Customers running v8.10 and earlier should upgrade to v8.13_206 GRP, from the following location: https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetsea rch/document/KM00711729 Customers running v9.0 should upgrade to v9.03MMR, from the following location: https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetsea rch/document/KM01029738 HISTORY Version:1 (rev.1) - 28 August 2015 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/ Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2015 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. HP Application Lifecycle Management all supported versions. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201507-14 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Oracle JRE/JDK: Multiple vulnerabilities Date: July 10, 2015 Bugs: #537214 ID: 201507-14 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in Oracle JRE/JDK, allowing both local and remote attackers to compromise various Java components. Please review the CVE identifiers referenced below for details. Impact ====== An context-dependent attacker may be able to influence the confidentiality, integrity, and availability of Java applications/runtime. Workaround ========== There is no workaround at this time. Resolution ========== All Oracle JRE 8 users should upgrade to the latest stable version: <code> # emerge --sync # emerge --ask --oneshot --verbose ">=dev-java/oracle-jre-bin-1.8.0.31 All Oracle JDK 8 users should upgrade to the latest stable version: <code> # emerge --sync # emerge --ask --oneshot --verbose ">=dev-java/oracle-jdk-bin-1.8.0.31 All Oracle JRE 7 users should upgrade to the latest version: <code> # emerge --sync # emerge --ask --oneshot --verbose ">=dev-java/oracle-jre-bin-1.7.0.76 All Oracle JDK 7 users should upgrade to the latest stable version: <code> # emerge --sync # emerge --ask --oneshot --verbose ">=dev-java/oracle-jdk-bin-1.7.0.76 References ========== [ 1 ] CVE-2014-3566 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3566 [ 2 ] CVE-2014-6549 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6549 [ 3 ] CVE-2014-6585 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6585 [ 4 ] CVE-2014-6587 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6587 [ 5 ] CVE-2014-6591 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6591 [ 6 ] CVE-2014-6593 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6593 [ 7 ] CVE-2014-6601 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6601 [ 8 ] CVE-2015-0383 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0383 [ 9 ] CVE-2015-0395 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0395 [ 10 ] CVE-2015-0400 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0400 [ 11 ] CVE-2015-0403 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0403 [ 12 ] CVE-2015-0406 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0406 [ 13 ] CVE-2015-0407 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0407 [ 14 ] CVE-2015-0408 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0408 [ 15 ] CVE-2015-0410 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0410 [ 16 ] CVE-2015-0412 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0412 [ 17 ] CVE-2015-0413 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0413 [ 18 ] CVE-2015-0421 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0421 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201507-14 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: java-1.7.0-ibm security update Advisory ID: RHSA-2014:1876-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-1876.html Issue date: 2014-11-19 CVE Names: CVE-2014-3065 CVE-2014-3566 CVE-2014-4288 CVE-2014-6456 CVE-2014-6457 CVE-2014-6458 CVE-2014-6476 CVE-2014-6492 CVE-2014-6493 CVE-2014-6502 CVE-2014-6503 CVE-2014-6506 CVE-2014-6511 CVE-2014-6512 CVE-2014-6515 CVE-2014-6527 CVE-2014-6531 CVE-2014-6532 CVE-2014-6558 ===================================================================== 1. Summary: Updated java-1.7.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, ppc, s390x, x86_64 3. Description: IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2014-3065, CVE-2014-3566, CVE-2014-4288, CVE-2014-6456, CVE-2014-6457, CVE-2014-6458, CVE-2014-6476, CVE-2014-6492, CVE-2014-6493, CVE-2014-6502, CVE-2014-6503, CVE-2014-6506, CVE-2014-6511, CVE-2014-6512, CVE-2014-6515, CVE-2014-6527, CVE-2014-6531, CVE-2014-6532, CVE-2014-6558) The CVE-2014-6512 issue was discovered by Florian Weimer of Red Hat Product Security. Note: With this update, the IBM SDK now disables the SSL 3.0 protocol to address the CVE-2014-3566 issue (also known as POODLE). Refer to the IBM article linked to in the References section for additional details about this change and instructions on how to re-enable SSL 3.0 support if needed. All users of java-1.7.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 7 SR8 release. All running instances of IBM Java must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1071210 - CVE-2014-6512 OpenJDK: DatagramSocket connected socket missing source check (Libraries, 8039509) 1150155 - CVE-2014-6506 OpenJDK: insufficient permission checks when setting resource bundle on system logger (Libraries, 8041564) 1150651 - CVE-2014-6531 OpenJDK: insufficient ResourceBundle name check (Libraries, 8044274) 1150669 - CVE-2014-6502 OpenJDK: LogRecord use of incorrect CL when loading ResourceBundle (Libraries, 8042797) 1151046 - CVE-2014-6457 OpenJDK: Triple Handshake attack against TLS/SSL connections (JSSE, 8037066) 1151063 - CVE-2014-6558 OpenJDK: CipherInputStream incorrect exception handling (Security, 8037846) 1151517 - CVE-2014-6511 ICU: Layout Engine ContextualSubstitution missing boundary checks (JDK 2D, 8041540) 1152756 - CVE-2014-6532 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) 1152757 - CVE-2014-6503 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) 1152758 - CVE-2014-6456 Oracle JDK: unspecified vulnerability fixed in 7u71 and 8u25 (Deployment) 1152759 - CVE-2014-6492 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) 1152760 - CVE-2014-6493 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) 1152761 - CVE-2014-4288 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) 1152763 - CVE-2014-6458 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) 1152765 - CVE-2014-6476 Oracle JDK: unspecified vulnerability fixed in 7u71 and 8u25 (Deployment) 1152766 - CVE-2014-6515 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) 1152767 - CVE-2014-6527 Oracle JDK: unspecified vulnerability fixed in 7u71 and 8u25 (Deployment) 1152789 - CVE-2014-3566 SSL/TLS: Padding Oracle On Downgraded Legacy Encryption attack 1162554 - CVE-2014-3065 IBM JDK: privilege escalation via shared class cache 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: java-1.7.0-ibm-1.7.0.8.0-1jpp.1.el5.i386.rpm java-1.7.0-ibm-demo-1.7.0.8.0-1jpp.1.el5.i386.rpm java-1.7.0-ibm-devel-1.7.0.8.0-1jpp.1.el5.i386.rpm java-1.7.0-ibm-jdbc-1.7.0.8.0-1jpp.1.el5.i386.rpm java-1.7.0-ibm-plugin-1.7.0.8.0-1jpp.1.el5.i386.rpm java-1.7.0-ibm-src-1.7.0.8.0-1jpp.1.el5.i386.rpm x86_64: java-1.7.0-ibm-1.7.0.8.0-1jpp.1.el5.i386.rpm java-1.7.0-ibm-1.7.0.8.0-1jpp.1.el5.x86_64.rpm java-1.7.0-ibm-demo-1.7.0.8.0-1jpp.1.el5.i386.rpm java-1.7.0-ibm-demo-1.7.0.8.0-1jpp.1.el5.x86_64.rpm java-1.7.0-ibm-devel-1.7.0.8.0-1jpp.1.el5.i386.rpm java-1.7.0-ibm-devel-1.7.0.8.0-1jpp.1.el5.x86_64.rpm java-1.7.0-ibm-jdbc-1.7.0.8.0-1jpp.1.el5.i386.rpm java-1.7.0-ibm-jdbc-1.7.0.8.0-1jpp.1.el5.x86_64.rpm java-1.7.0-ibm-plugin-1.7.0.8.0-1jpp.1.el5.i386.rpm java-1.7.0-ibm-plugin-1.7.0.8.0-1jpp.1.el5.x86_64.rpm java-1.7.0-ibm-src-1.7.0.8.0-1jpp.1.el5.i386.rpm java-1.7.0-ibm-src-1.7.0.8.0-1jpp.1.el5.x86_64.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: java-1.7.0-ibm-1.7.0.8.0-1jpp.1.el5.i386.rpm java-1.7.0-ibm-demo-1.7.0.8.0-1jpp.1.el5.i386.rpm java-1.7.0-ibm-devel-1.7.0.8.0-1jpp.1.el5.i386.rpm java-1.7.0-ibm-jdbc-1.7.0.8.0-1jpp.1.el5.i386.rpm java-1.7.0-ibm-plugin-1.7.0.8.0-1jpp.1.el5.i386.rpm java-1.7.0-ibm-src-1.7.0.8.0-1jpp.1.el5.i386.rpm ppc: java-1.7.0-ibm-1.7.0.8.0-1jpp.1.el5.ppc.rpm java-1.7.0-ibm-1.7.0.8.0-1jpp.1.el5.ppc64.rpm java-1.7.0-ibm-demo-1.7.0.8.0-1jpp.1.el5.ppc.rpm java-1.7.0-ibm-demo-1.7.0.8.0-1jpp.1.el5.ppc64.rpm java-1.7.0-ibm-devel-1.7.0.8.0-1jpp.1.el5.ppc.rpm java-1.7.0-ibm-devel-1.7.0.8.0-1jpp.1.el5.ppc64.rpm java-1.7.0-ibm-jdbc-1.7.0.8.0-1jpp.1.el5.ppc.rpm java-1.7.0-ibm-jdbc-1.7.0.8.0-1jpp.1.el5.ppc64.rpm java-1.7.0-ibm-plugin-1.7.0.8.0-1jpp.1.el5.ppc.rpm java-1.7.0-ibm-src-1.7.0.8.0-1jpp.1.el5.ppc.rpm java-1.7.0-ibm-src-1.7.0.8.0-1jpp.1.el5.ppc64.rpm s390x: java-1.7.0-ibm-1.7.0.8.0-1jpp.1.el5.s390.rpm java-1.7.0-ibm-1.7.0.8.0-1jpp.1.el5.s390x.rpm java-1.7.0-ibm-demo-1.7.0.8.0-1jpp.1.el5.s390.rpm java-1.7.0-ibm-demo-1.7.0.8.0-1jpp.1.el5.s390x.rpm java-1.7.0-ibm-devel-1.7.0.8.0-1jpp.1.el5.s390.rpm java-1.7.0-ibm-devel-1.7.0.8.0-1jpp.1.el5.s390x.rpm java-1.7.0-ibm-jdbc-1.7.0.8.0-1jpp.1.el5.s390.rpm java-1.7.0-ibm-jdbc-1.7.0.8.0-1jpp.1.el5.s390x.rpm java-1.7.0-ibm-src-1.7.0.8.0-1jpp.1.el5.s390.rpm java-1.7.0-ibm-src-1.7.0.8.0-1jpp.1.el5.s390x.rpm x86_64: java-1.7.0-ibm-1.7.0.8.0-1jpp.1.el5.i386.rpm java-1.7.0-ibm-1.7.0.8.0-1jpp.1.el5.x86_64.rpm java-1.7.0-ibm-demo-1.7.0.8.0-1jpp.1.el5.i386.rpm java-1.7.0-ibm-demo-1.7.0.8.0-1jpp.1.el5.x86_64.rpm java-1.7.0-ibm-devel-1.7.0.8.0-1jpp.1.el5.i386.rpm java-1.7.0-ibm-devel-1.7.0.8.0-1jpp.1.el5.x86_64.rpm java-1.7.0-ibm-jdbc-1.7.0.8.0-1jpp.1.el5.i386.rpm java-1.7.0-ibm-jdbc-1.7.0.8.0-1jpp.1.el5.x86_64.rpm java-1.7.0-ibm-plugin-1.7.0.8.0-1jpp.1.el5.i386.rpm java-1.7.0-ibm-plugin-1.7.0.8.0-1jpp.1.el5.x86_64.rpm java-1.7.0-ibm-src-1.7.0.8.0-1jpp.1.el5.i386.rpm java-1.7.0-ibm-src-1.7.0.8.0-1jpp.1.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2014-3065 https://access.redhat.com/security/cve/CVE-2014-3566 https://access.redhat.com/security/cve/CVE-2014-4288 https://access.redhat.com/security/cve/CVE-2014-6456 https://access.redhat.com/security/cve/CVE-2014-6457 https://access.redhat.com/security/cve/CVE-2014-6458 https://access.redhat.com/security/cve/CVE-2014-6476 https://access.redhat.com/security/cve/CVE-2014-6492 https://access.redhat.com/security/cve/CVE-2014-6493 https://access.redhat.com/security/cve/CVE-2014-6502 https://access.redhat.com/security/cve/CVE-2014-6503 https://access.redhat.com/security/cve/CVE-2014-6506 https://access.redhat.com/security/cve/CVE-2014-6511 https://access.redhat.com/security/cve/CVE-2014-6512 https://access.redhat.com/security/cve/CVE-2014-6515 https://access.redhat.com/security/cve/CVE-2014-6527 https://access.redhat.com/security/cve/CVE-2014-6531 https://access.redhat.com/security/cve/CVE-2014-6532 https://access.redhat.com/security/cve/CVE-2014-6558 https://access.redhat.com/security/updates/classification/#critical https://www.ibm.com/developerworks/java/jdk/alerts/ https://www-01.ibm.com/support/docview.wss?uid=swg21688165 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFUbOWGXlSAg2UNWIIRAhPmAJ96YO5JFEg4GS1MkDIeXQkRxbN0hACgoUiY ehbScogUJnSordhBH11LgWQ= =ko7F -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . The update is available from HPE Software Depot: https://h20392.www2.hpe.com/ portal/swdepot/displayProductInfo.do?productNumber=HPVPRhttps://www.hpe.com Note: HPE recommends customers using OV4VC 7.8.1 and earlier should upgrade to OV4VC 7.8.2. This addresses all SSL security vulnerabilities reported through March 28, 2016. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-10-16-2 Security Update 2014-005 Security Update 2014-005 is now available and addresses the following: Secure Transport Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5 Impact: An attacker may be able to decrypt data protected by SSL Description: There are known attacks on the confidentiality of SSL 3.0 when a cipher suite uses a block cipher in CBC mode. An attacker could force the use of SSL 3.0, even when the server would support a better TLS version, by blocking TLS 1.0 and higher connection attempts. This issue was addressed by disabling CBC cipher suites when TLS connection attempts fail. CVE-ID CVE-2014-3566 : Bodo Moeller, Thai Duong, and Krzysztof Kotowicz of Google Security Team Note: Security Update 2014-005 includes the security content of OS X bash Update 1.0

AFFECTED PRODUCTS