漏洞描述
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
secunia.comhttp://secunia.com/advisories/59669↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21678167↗www.vmware.comhttp://www.vmware.com/security/advisories/VMSA-2014-0006.html↗secunia.comhttp://secunia.com/advisories/59365↗www14.software.ibm.comhttp://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=6061&myns=phmc&mync=E↗secunia.comhttp://secunia.com/advisories/58939↗marc.infohttp://marc.info/?l=bugtraq&m=140431828824371&w=2↗secunia.comhttp://secunia.com/advisories/59518↗secunia.comhttp://secunia.com/advisories/59189↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676615↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=isg400001841↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html↗secunia.comhttp://secunia.com/advisories/59364↗bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1103600↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676879↗kb.juniper.nethttp://kb.juniper.net/InfoCenter/index?page=content&id=KB29195↗marc.infohttp://marc.info/?l=bugtraq&m=140499827729550&w=2↗www.ibm.comhttp://www.ibm.com/support/docview.wss?uid=swg24037783↗www.mandriva.comhttp://www.mandriva.com/security/advisories?name=MDVSA-2014:105↗www.ibm.comhttp://www.ibm.com/support/docview.wss?uid=swg21676356↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg24037761↗secunia.comhttp://secunia.com/advisories/59655↗secunia.comhttp://secunia.com/advisories/59495↗secunia.comhttp://secunia.com/advisories/59162↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21677695↗secunia.comhttp://secunia.com/advisories/59451↗www-947.ibm.comhttp://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095755↗secunia.comhttp://secunia.com/advisories/59192↗www.mandriva.comhttp://www.mandriva.com/security/advisories?name=MDVSA-2015:062↗secunia.comhttp://secunia.com/advisories/59342↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676035↗secunia.comhttp://secunia.com/advisories/60571↗www.splunk.comhttp://www.splunk.com/view/SP-CAAAM2D↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676071↗secunia.comhttp://secunia.com/advisories/59514↗secunia.comhttp://secunia.com/advisories/59310↗secunia.comhttp://secunia.com/advisories/59340↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676501↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html↗secunia.comhttp://secunia.com/advisories/59450↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21673137↗www.blackberry.comhttp://www.blackberry.com/btsc/KB36051↗secunia.comhttp://secunia.com/advisories/59666↗secunia.comhttp://secunia.com/advisories/59916↗marc.infohttp://marc.info/?l=bugtraq&m=140904544427729&w=2↗www.novell.comhttp://www.novell.com/support/kb/doc.php?id=7015264↗secunia.comhttp://secunia.com/advisories/59191↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21675626↗marc.infohttp://marc.info/?l=bugtraq&m=140448122410568&w=2↗h20566.www2.hpe.comhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946↗www14.software.ibm.comhttp://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=6060&myns=phmc&mync=E↗secunia.comhttp://secunia.com/advisories/59440↗secunia.comhttp://secunia.com/advisories/59449↗support.apple.comhttp://support.apple.com/kb/HT6443↗secunia.comhttp://secunia.com/advisories/59300↗secunia.comhttp://secunia.com/advisories/59442↗secunia.comhttp://secunia.com/advisories/58337↗secunia.comhttp://secunia.com/advisories/59491↗aix.software.ibm.comhttp://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc↗lists.fedoraproject.orghttp://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html↗secunia.comhttp://secunia.com/advisories/59264↗secunia.comhttp://secunia.com/advisories/59438↗secunia.comhttp://secunia.com/advisories/58714↗secunia.comhttp://secunia.com/advisories/59659↗www.ibm.comhttp://www.ibm.com/support/docview.wss?uid=swg21676793↗www-947.ibm.comhttp://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095756↗secunia.comhttp://secunia.com/advisories/58977↗www.mandriva.comhttp://www.mandriva.com/security/advisories?name=MDVSA-2014:106↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=nas8N1020163↗tools.cisco.comhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140605-openssl↗secunia.comhttp://secunia.com/advisories/58713↗secunia.comhttp://secunia.com/advisories/59167↗marc.infohttp://marc.info/?l=bugtraq&m=140266410314613&w=2↗marc.infohttp://marc.info/?l=bugtraq&m=140621259019789&w=2↗marc.infohttp://marc.info/?l=bugtraq&m=140389355508263&w=2↗secunia.comhttp://secunia.com/advisories/59784↗marc.infohttp://marc.info/?l=bugtraq&m=140482916501310&w=2↗support.f5.comhttp://support.f5.com/kb/en-us/solutions/public/15000/300/sol15342.html↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21678289↗www-947.ibm.comhttp://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095757↗secunia.comhttp://secunia.com/advisories/59301↗secunia.comhttp://secunia.com/advisories/59126↗www.oracle.comhttp://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html↗secunia.comhttp://secunia.com/advisories/59362↗secunia.comhttp://secunia.com/advisories/59525↗marc.infohttp://marc.info/?l=bugtraq&m=140491231331543&w=2↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21677527↗www.huawei.comhttp://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm↗cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/pdf/ssa-234763.pdf↗secunia.comhttp://secunia.com/advisories/58579↗support.citrix.comhttp://support.citrix.com/article/CTX140876↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676062↗secunia.comhttp://secunia.com/advisories/59460↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676655↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676529↗kc.mcafee.comhttps://kc.mcafee.com/corporate/index?page=content&id=SB10075↗lists.fedoraproject.orghttp://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html↗security.gentoo.orghttp://security.gentoo.org/glsa/glsa-201407-05.xml↗www.securityfocus.comhttp://www.securityfocus.com/bid/67898↗secunia.comhttp://secunia.com/advisories/59431↗secunia.comhttp://secunia.com/advisories/58667↗secunia.comhttp://secunia.com/advisories/58742↗secunia.comhttp://secunia.com/advisories/59223↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21683332↗www.openssl.orghttp://www.openssl.org/news/secadv_20140605.txt↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21675821↗marc.infohttp://marc.info/?l=bugtraq&m=140389274407904&w=2↗secunia.comhttp://secunia.com/advisories/59287↗www-947.ibm.comhttp://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095754↗www.novell.comhttps://www.novell.com/support/kb/doc.php?id=7015271↗secunia.comhttp://secunia.com/advisories/58945↗secunia.comhttp://secunia.com/advisories/59282↗secunia.comhttp://secunia.com/advisories/58615↗secunia.comhttp://secunia.com/advisories/59490↗seclists.orghttp://seclists.org/fulldisclosure/2014/Dec/23↗marc.infohttp://marc.info/?l=bugtraq&m=140752315422991&w=2↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=isg400001843↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21677828↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676419↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676889↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21677836↗www.novell.comhttp://www.novell.com/support/kb/doc.php?id=7015300↗secunia.comhttp://secunia.com/advisories/59441↗secunia.comhttp://secunia.com/advisories/59120↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html↗secunia.comhttp://secunia.com/advisories/59721↗marc.infohttp://marc.info/?l=bugtraq&m=140317760000786&w=2↗secunia.comhttp://secunia.com/advisories/59459↗secunia.comhttp://secunia.com/advisories/59895↗secunia.comhttp://secunia.com/advisories/59306↗secunia.comhttp://secunia.com/advisories/59483↗secunia.comhttp://secunia.com/advisories/58797↗kb.bluecoat.comhttps://kb.bluecoat.com/index?page=content&id=SA80↗secunia.comhttp://secunia.com/advisories/59990↗secunia.comhttp://secunia.com/advisories/61254↗kb.juniper.nethttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629↗secunia.comhttp://secunia.com/advisories/59284↗git.openssl.orghttps://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=8011cd56e39a433b1837465259a9bd24a38727fb↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676496↗www.oracle.comhttp://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html↗www.securityfocus.comhttp://www.securityfocus.com/archive/1/534161/100/0/threaded↗secunia.comhttp://secunia.com/advisories/59413↗secunia.comhttp://secunia.com/advisories/59445↗secunia.comhttp://secunia.com/advisories/59437↗www.vmware.comhttp://www.vmware.com/security/advisories/VMSA-2014-0012.html↗www.oracle.comhttp://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html↗www.oracle.comhttp://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html↗secunia.comhttp://secunia.com/advisories/59175↗secunia.comhttp://secunia.com/advisories/58716↗www.f-secure.comhttp://www.f-secure.com/en/web/labs_global/fsc-2014-6↗