CyaSSL Multiple Security Vulnerabilities
BID:66780
Info
CyaSSL Multiple Security Vulnerabilities
| Bugtraq ID: | 66780 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-2896 CVE-2014-2899 CVE-2014-2898 CVE-2014-2900 CVE-2014-2897 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 09 2014 12:00AM |
| Updated: | Jan 12 2017 03:08AM |
| Credit: | Ivan Fratric of Google, Suman Jana with security researchers at UT Austin and UC Davis |
| Vulnerable: |
wolfSSL CyaSSL 2.9 Gentoo Linux |
| Not Vulnerable: |
wolfSSL CyaSSL 2.9.4 |
Discussion
CyaSSL Multiple Security Vulnerabilities
CyaSSL is prone to multiple security vulnerabilities.
An attacker can exploit these issues to execute arbitrary code, spoof a valid server and conduct man-in-the-middle attacks, or crash the affected application causing denial of service conditions. This may lead to further attacks.
CyaSSL prior to 2.9.4 are vulnerable.
CyaSSL is prone to multiple security vulnerabilities.
An attacker can exploit these issues to execute arbitrary code, spoof a valid server and conduct man-in-the-middle attacks, or crash the affected application causing denial of service conditions. This may lead to further attacks.
CyaSSL prior to 2.9.4 are vulnerable.
Exploit / POC
CyaSSL Multiple Security Vulnerabilities
Attackers can use standard, readily available tools to exploit this issue.
Attackers can use standard, readily available tools to exploit this issue.
Solution / Fix
CyaSSL Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
CyaSSL Multiple Security Vulnerabilities
References:
References:
- cyassl Homepage (wolfssl)
- Re: CVE ids for CyaSSL 2.9.4? (MITRE CVE Numbering Authority)
- wolfSSL Security Advisory: April 9, 2014 (wolfssl)
- cyassl Change log (wolfssl)