漏洞描述
The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
secunia.comhttp://secunia.com/advisories/59189↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21677828↗www.vmware.comhttp://www.vmware.com/security/advisories/VMSA-2014-0012.html↗marc.infohttp://marc.info/?l=bugtraq&m=140317760000786&w=2↗www-947.ibm.comhttp://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095754↗www.blackberry.comhttp://www.blackberry.com/btsc/KB36051↗secunia.comhttp://secunia.com/advisories/59528↗secunia.comhttp://secunia.com/advisories/59460↗secunia.comhttp://secunia.com/advisories/59120↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=isg400001841↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676889↗support.citrix.comhttp://support.citrix.com/article/CTX140876↗www.huawei.comhttp://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm↗secunia.comhttp://secunia.com/advisories/59287↗marc.infohttp://marc.info/?l=bugtraq&m=140482916501310&w=2↗secunia.comhttp://secunia.com/advisories/59027↗lists.fedoraproject.orghttp://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=isg400001843↗secunia.comhttp://secunia.com/advisories/59514↗www.oracle.comhttp://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21683332↗www.novell.comhttps://www.novell.com/support/kb/doc.php?id=7015271↗www.securityfocus.comhttp://www.securityfocus.com/bid/67901↗secunia.comhttp://secunia.com/advisories/59306↗secunia.comhttp://secunia.com/advisories/59126↗kc.mcafee.comhttps://kc.mcafee.com/corporate/index?page=content&id=SB10075↗marc.infohttp://marc.info/?l=bugtraq&m=140499827729550&w=2↗secunia.comhttp://secunia.com/advisories/58939↗secunia.comhttp://secunia.com/advisories/59162↗tools.cisco.comhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140605-openssl↗secunia.comhttp://secunia.com/advisories/59450↗marc.infohttp://marc.info/?l=bugtraq&m=140448122410568&w=2↗linux.oracle.comhttp://linux.oracle.com/errata/ELSA-2014-1053.html↗secunia.comhttp://secunia.com/advisories/59284↗secunia.comhttp://secunia.com/advisories/59310↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html↗secunia.comhttp://secunia.com/advisories/59721↗secunia.comhttp://secunia.com/advisories/59451↗www.openssl.orghttp://www.openssl.org/news/secadv_20140605.txt↗secunia.comhttp://secunia.com/advisories/59221↗www-947.ibm.comhttp://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095756↗secunia.comhttp://secunia.com/advisories/59655↗lists.fedoraproject.orghttp://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html↗marc.infohttp://marc.info/?l=bugtraq&m=140621259019789&w=2↗secunia.comhttp://secunia.com/advisories/60687↗www-947.ibm.comhttp://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095757↗www14.software.ibm.comhttp://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=6060&myns=phmc&mync=E↗www.mandriva.comhttp://www.mandriva.com/security/advisories?name=MDVSA-2014:105↗secunia.comhttp://secunia.com/advisories/58615↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676035↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676879↗marc.infohttp://marc.info/?l=bugtraq&m=140389355508263&w=2↗secunia.comhttp://secunia.com/advisories/59300↗secunia.comhttp://secunia.com/advisories/59666↗secunia.comhttp://secunia.com/advisories/60571↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676071↗secunia.comhttp://secunia.com/advisories/59669↗www.mandriva.comhttp://www.mandriva.com/security/advisories?name=MDVSA-2014:106↗secunia.comhttp://secunia.com/advisories/59441↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21678289↗www.ibm.comhttp://www.ibm.com/support/docview.wss?uid=swg21676793↗marc.infohttp://marc.info/?l=bugtraq&m=140491231331543&w=2↗secunia.comhttp://secunia.com/advisories/61254↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676062↗www.novell.comhttp://www.novell.com/support/kb/doc.php?id=7015264↗secunia.comhttp://secunia.com/advisories/59364↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html↗secunia.comhttp://secunia.com/advisories/59895↗www.fortiguard.comhttp://www.fortiguard.com/advisory/FG-IR-14-018/↗www.novell.comhttp://www.novell.com/support/kb/doc.php?id=7015300↗secunia.comhttp://secunia.com/advisories/59990↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21677695↗www.securityfocus.comhttp://www.securityfocus.com/archive/1/534161/100/0/threaded↗marc.infohttp://marc.info/?l=bugtraq&m=140266410314613&w=2↗security.gentoo.orghttp://security.gentoo.org/glsa/glsa-201407-05.xml↗marc.infohttp://marc.info/?l=bugtraq&m=140431828824371&w=2↗www.oracle.comhttp://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html↗seclists.orghttp://seclists.org/fulldisclosure/2014/Dec/23↗secunia.comhttp://secunia.com/advisories/58337↗secunia.comhttp://secunia.com/advisories/58713↗secunia.comhttp://secunia.com/advisories/59454↗aix.software.ibm.comhttp://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc↗secunia.comhttp://secunia.com/advisories/59167↗www.oracle.comhttp://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html↗secunia.comhttp://secunia.com/advisories/59342↗marc.infohttp://marc.info/?l=bugtraq&m=140752315422991&w=2↗www.securitytracker.comhttp://www.securitytracker.com/id/1030337↗www-947.ibm.comhttp://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095755↗kb.bluecoat.comhttps://kb.bluecoat.com/index?page=content&id=SA80↗secunia.comhttp://secunia.com/advisories/59413↗secunia.comhttp://secunia.com/advisories/59490↗www.mandriva.comhttp://www.mandriva.com/security/advisories?name=MDVSA-2015:062↗secunia.comhttp://secunia.com/advisories/58977↗secunia.comhttp://secunia.com/advisories/59491↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21673137↗www.ibm.comhttp://www.ibm.com/support/docview.wss?uid=swg21676226↗git.openssl.orghttps://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=d3152655d5319ce883c8e3ac4b99f8de4c59d846↗secunia.comhttp://secunia.com/advisories/59301↗support.apple.comhttp://support.apple.com/kb/HT6443↗www.ibm.comhttp://www.ibm.com/support/docview.wss?uid=swg21676356↗secunia.comhttp://secunia.com/advisories/59429↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21677527↗secunia.comhttp://secunia.com/advisories/59437↗marc.infohttp://marc.info/?l=bugtraq&m=140389274407904&w=2↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21675821↗www.ibm.comhttp://www.ibm.com/support/docview.wss?uid=swg24037783↗bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1103593↗www.vmware.comhttp://www.vmware.com/security/advisories/VMSA-2014-0006.html↗marc.infohttp://marc.info/?l=bugtraq&m=140904544427729&w=2↗secunia.comhttp://secunia.com/advisories/58945↗secunia.comhttp://secunia.com/advisories/59192↗secunia.comhttp://secunia.com/advisories/59495↗www.oracle.comhttp://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html↗h20566.www2.hpe.comhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946↗secunia.comhttp://secunia.com/advisories/59365↗secunia.comhttp://secunia.com/advisories/59659↗secunia.comhttp://secunia.com/advisories/58714↗secunia.comhttp://secunia.com/advisories/59784↗rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2014-1021.html↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21678167↗kb.juniper.nethttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676419↗secunia.comhttp://secunia.com/advisories/59175↗secunia.comhttp://secunia.com/advisories/59449↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=nas8N1020163↗www14.software.ibm.comhttp://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=6061&myns=phmc&mync=E↗secunia.comhttp://secunia.com/advisories/59518↗