Return
-
Title
CVE reports and actions required for TPAM (2) -
Description
CVE reports and actions required for TPAM (2)CVE-2014-3505CVE-2014-3506CVE-2014-3507CVE-2014-3508CVE-2014-3510CVE-2017-0161 -
Resolution
CVE-2014-3505Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (application crash) via crafted DTLS packets that trigger an error condition.One Identity:The openSSL aspects/features that these vulnerabilities exploit TPAM doesn't use, so the appliance isn't vulnerable to them.CVE-2014-3506d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via crafted DTLS handshake messages that trigger memory allocations corresponding to large length values.One Identity:The openSSL aspects/features that these vulnerabilities exploit TPAM doesn't use, so the appliance isn't vulnerable to them.CVE-2014-3507Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via zero-length DTLS fragments that trigger improper handling of the return value of a certain insert function.One Identity:The openSSL aspects/features that these vulnerabilities exploit TPAM doesn't use, so the appliance isn't vulnerable to them.CVE-2014-3508The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of '\0' characters, which allows context-dependent attackers to obtain sensitive information from process stack memory by reading output from X509_name_oneline, X509_name_print_ex, and unspecified other functions.One Identity:The openSSL aspects/features that these vulnerabilities exploit TPAM doesn't use, so the appliance isn't vulnerable to them.CVE-2014-3510The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS servers to cause a denial of service (NULL pointer dereference and client application crash) via a crafted handshake message in conjunction with a (1) anonymous DH or (2) anonymous ECDH ciphersuite.One Identity:The openSSL aspects/features that these vulnerabilities exploit TPAM doesn't use, so the appliance isn't vulnerable to them.CVE-2014-3509Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data.One Identity:The following vulnerabilities do not apply to TPAM as it is not running the versions impacted.CVE-2014-3511The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue.Quest Software:The following vulnerabilities do not apply to TPAM as it is not running the versions impacted.CVE-2014-3512Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid SRP (1) g, (2) A, or (3) B parameter.Quest Software:The following vulnerabilities do not apply to TPAM as it is not running the versions impacted.CVE-2014-5139The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client application crash) via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite with the client.Quest Software:The following vulnerabilities do not apply to TPAM as it is not running the versions impacted.CVE-2017-0161Microsoft Wintel NetBIOS Remote Code Execution VulnerabilityQuest Software:The following vulnerabilities do not apply to TPAM as it is not running the versions impacted.