SSL Protocol 3.0 Vulnerability in OpenSSL Products
CVE-2014-3566

3.4LOW

Key Information:

Vendor

Redhat
Status
Enterprise Linux Desktop Supplementary
Enterprise Linux Desktop
Enterprise Linux Workstation
Enterprise Linux Server
Vendor
CVE Published:
15 October 2014

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 94%

What is CVE-2014-3566?

The SSL Protocol 3.0 vulnerability allows attackers to exploit the nondeterministic CBC padding method used in OpenSSL, enabling man-in-the-middle attacks. This vulnerability can lead to the exposure of sensitive cleartext data via a padding-oracle attack, commonly referred to as the 'POODLE' exploit. Updating to newer versions that disable SSL 3.0 and implementing proper security measures can significantly mitigate this risk.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2014-3566 - Proof of Concept

poodle-PoC
Created by mpgn

poodle_protector
Created by stdevel

References

http://marc.info/?l=bugtraq&m=142103967620673&w=2
vendor-advisoryx_refsource_HP
http://aix.software.ibm.com/aix/efixes/security/openssl_a...
x_refsource_CONFIRM
http://www.securitytracker.com/id/1031090
vdb-entryx_refsource_SECTRACK

EPSS Score

94% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
3.4
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.