CVE-2014-3569

Name of the Vulnerable Software and Affected Versions OpenSSL versions 0.9.8zc through 1.0.1j

Description The issue is related to the ssl23 get client hello function in s23 srvr.c of the OpenSSL library, which incorrectly handles outdated protocols. This can be exploited by a remote attacker to cause a denial of service, resulting in a daemon crash due to a NULL pointer dereference. The exploitation can occur through an unexpected handshake, such as an SSLv3 handshake to a non-SSLv3 application with specific error handling.

Recommendations For OpenSSL versions 0.9.8zc through 1.0.1j, consider updating to a version that properly handles attempts to use unsupported protocols, or apply configuration changes to restrict the use of outdated protocols until a patch is available. As a temporary workaround, consider disabling the ssl23 get client hello function until a patch is available to prevent potential exploitation.