High severity · published Apr 7, 2014
CVE-2014-0160
OpenSSL Information Disclosure Vulnerability
In wildKEV
7.5
CVSS
100%
EPSS
Yes
On KEV
Description
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)100.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed May 4, 2022
Federal remediation dueMay 25, 2022
Ransomware campaign useNot known
Affected products
Which versions
AP
Application Processing Engine Firmware · Siemens
2.0 · source: NVD
C1
CP 1543-1 Firmware · Siemens
1.1 · source: NVD
DL
Debian Linux · Debian
6.0; 7.0; 8.0 · source: NVD
EL
Elan-8.2 · Siemens
before 8.3.3 · source: NVD
EL
Enterprise Linux Desktop · Redhat
6.0 · source: NVD
EL
Enterprise Linux Server · Redhat
6.0 · source: NVD
EL
Enterprise Linux Server Aus · Redhat
6.5 · source: NVD
EL
Enterprise Linux Server Eus · Redhat
6.5 · source: NVD
EL
Enterprise Linux Server Tus · Redhat
6.5 · source: NVD
EL
Enterprise Linux Workstation · Redhat
6.0 · source: NVD
FE
Fedora · Fedoraproject
19; 20 · source: NVD
FS
Filezilla Server · Filezilla-project
before 0.9.44 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0160
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0160
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
support.f5.com
https://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html?sr=36517217
vdb-entry
http://www.securitytracker.com/id/1030077
mailing-list
http://seclists.org/fulldisclosure/2014/Apr/90
www.getchef.com
http://www.getchef.com/blog/2014/04/09/chef-server-heartbleed-cve-2014-0160-releases/
vendor-advisory
http://www.debian.org/security/2014/dsa-2896
vendor-advisory
http://marc.info/?l=bugtraq&m=139774054614965&w=2
More from Symantec Messaging Gateway
9.8
CVE-2024-23615
A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 10.5 and before
9.8
CVE-2024-23614
A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 9.5 and before
7.2
CVE-2020-12594
A privilege escalation flaw allows a malicious, authenticated, privileged CLI user to escalate their privileges on the system and gain full control over the SMG appliance
4.9
CVE-2021-30651
A malicious authenticated SMG administrator user can obtain passwords for external LDAP/Active Directory servers that they might not otherwise be authorized to access
4.9
CVE-2020-12595
An information disclosure flaw allows a malicious, authenticated, privileged web UI user to obtain a password for a remote SCP backup server that they might not otherwise be…