CVE-2014-3566— OpenSSL 加密问题漏洞
一分钟漏洞结论
影响对象
n/a n/a
利用判断
存在公开或 AI PoC，应优先验证
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
OpenSSL是OpenSSL团队的一个开源的能够实现安全套接层（SSLv2/v3）和安全传输层（TLSv1）协议的通用加密库。该产品支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL 1.0.1i版本及之前版本存在加密问题漏洞，该漏洞源于程序使用非确定性的CBC填充。攻击者利用该漏洞实施中间人攻击，获取明文数据。
公开利用映射 1
Metasploit · 1
ssl_version.rb#CVE-2014-3566 [auxiliary]
可能的 ATT&CK 技术 3 AI
T1595 · Active Scanning T1597 · Search Closed Sources T1557 · Adversary-in-the-Middle
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2014-3566 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
N/A
来源: CVE Program / CVE List V5
Vulnerability Description
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
OpenSSL 加密问题漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
OpenSSL是OpenSSL团队的一个开源的能够实现安全套接层（SSLv2/v3）和安全传输层（TLSv1）协议的通用加密库。该产品支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL 1.0.1i版本及之前版本存在加密问题漏洞，该漏洞源于程序使用非确定性的CBC填充。攻击者利用该漏洞实施中间人攻击，获取明文数据。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
二、漏洞 CVE-2014-3566 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | None | https://github.com/mikesplain/CVE-2014-3566-poodle-cookbook | POC详情 |
| 2 | Python script for automatically protecting your systems against POODLE vulnerability (CVE-2014-3566) | https://github.com/stdevel/poodle_protector | POC详情 |
| 3 | CloudPassage Halo policy for detecting vulnerability to CVE-2014-3566 (AKA POODLE) | https://github.com/cloudpassage/mangy-beast | POC详情 |
| 4 | :poodle: Poodle (Padding Oracle On Downgraded Legacy Encryption) attack CVE-2014-3566 :poodle: | https://github.com/mpgn/poodle-PoC | POC详情 |
| 5 | None | https://github.com/uthrasri/openssl_g2.5_CVE-2014-3566 | POC详情 |
| 6 | Test code for poodle attack (CVE-2014-3566) | https://github.com/GoRuGoo/poodle-attack-sandbox | POC详情 |
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2014-3566 的情报信息
请登录查看更多情报信息。
CVE-2014-3566 厂商安全公告 (109)
-
https://support.apple.com/HT205217 x_refsource_CONFIRM
-
https://www.openssl.org/~bodo/ssl-poodle.pdf x_refsource_MISC
-
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 x_refsource_CONFIRM
-
https://www.suse.com/support/kb/doc.php?id=7015773 x_refsource_CONFIRM
-
http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html x_refsource_CONFIRM
-
http://www-01.ibm.com/support/docview.wss?uid=swg21687172 x_refsource_CONFIRM
-
https://support.apple.com/kb/HT6529 x_refsource_CONFIRM
-
http://advisories.mageia.org/MGASA-2014-0416.html x_refsource_CONFIRM
-
https://www-01.ibm.com/support/docview.wss?uid=swg21688165 x_refsource_CONFIRM
-
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html x_refsource_CONFIRM
-
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html x_refsource_CONFIRM
-
https://bugzilla.redhat.com/show_bug.cgi?id=1152789 x_refsource_CONFIRM
-
http://www-01.ibm.com/support/docview.wss?uid=swg21688283 x_refsource_CONFIRM
-
http://www-01.ibm.com/support/docview.wss?uid=swg21692299 x_refsource_CONFIRM
-
http://www.vmware.com/security/advisories/VMSA-2015-0003.html x_refsource_CONFIRM
-
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html x_refsource_CONFIRM
-
http://support.apple.com/HT204244 x_refsource_CONFIRM
-
https://security.netapp.com/advisory/ntap-20141015-0001/ x_refsource_CONFIRM
-
http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html x_refsource_CONFIRM
-
https://support.apple.com/kb/HT6527 x_refsource_CONFIRM
-
https://support.apple.com/kb/HT6536 x_refsource_CONFIRM
-
https://support.apple.com/kb/HT6535 x_refsource_CONFIRM
-
https://access.redhat.com/articles/1232123 x_refsource_CONFIRM
-
http://www-01.ibm.com/support/docview.wss?uid=swg21687611 x_refsource_CONFIRM
-
https://support.lenovo.com/product_security/poodle x_refsource_CONFIRM
-
https://www.openssl.org/news/secadv_20141015.txt x_refsource_CONFIRM
-
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html x_refsource_CONFIRM
-
https://support.apple.com/kb/HT6542 x_refsource_CONFIRM
-
-
http://www-01.ibm.com/support/docview.wss?uid=swg21686997 x_refsource_CONFIRM
-
https://support.apple.com/kb/HT6531 x_refsource_CONFIRM
-
http://www-01.ibm.com/support/docview.wss?uid=isg3T1021431 x_refsource_CONFIRM
-
https://support.apple.com/kb/HT6541 x_refsource_CONFIRM
-
https://support.lenovo.com/us/en/product_security/poodle x_refsource_CONFIRM
-
http://www-01.ibm.com/support/docview.wss?uid=isg3T1021439 x_refsource_CONFIRM
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
http://www.mandriva.com/security/advisories?name=MDVSA-2015:062 vendor-advisory x_refsource_MANDRIVA
-
-
-
-
-
-
-
-
-
-
-
-
http://www.mandriva.com/security/advisories?name=MDVSA-2014:203 vendor-advisory x_refsource_MANDRIVA
-
🔗 claws-mail: Multiple Vulnerabilities (GLSA 201606-11) — Gentoo security 查看完整文章 vendor-advisory x_refsource_GENTOO
-
-
-
-
-
-
-
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141015-poodle vendor-advisory x_refsource_CISCO
CVE-2014-3566 邮件列表归档 (80)
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
'[security bulletin] HPSBMU03301 rev.1 - HP BladeSystem c-Class Onboard Administrator running OpenSSL' - MARC vendor-advisory x_refsource_HP
-
-
-
-
-
-
-
-
🔗 '[security bulletin] HPSBMU03267 rev.1 - HP Matrix Operating Environment and HP CloudSystem Matrix ru' - MARC 查看完整文章 vendor-advisory x_refsource_HP
-
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169361.html vendor-advisory x_refsource_FEDORA
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169374.html vendor-advisory x_refsource_FEDORA
-
http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00003.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00026.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00001.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00024.html vendor-advisory x_refsource_SUSE
-
http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141158.html vendor-advisory x_refsource_FEDORA
-
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00066.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00036.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00027.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00033.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00000.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00021.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00018.html vendor-advisory x_refsource_SUSE
-
http://lists.fedoraproject.org/pipermail/package-announce/2014-November/142330.html vendor-advisory x_refsource_FEDORA
-
http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00002.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00001.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00008.html vendor-advisory x_refsource_SUSE
-
-
http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html vendor-advisory x_refsource_APPLE
-
-
http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html vendor-advisory x_refsource_APPLE
-
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html vendor-advisory x_refsource_SUSE
-
CVE-2014-3566 安全博客文章 (5)
-
https://www.elastic.co/blog/logstash-1-4-3-released x_refsource_CONFIRM
-
https://www.dfranke.us/posts/2014-10-14-how-poodle-happened.html x_refsource_MISC
-
http://blog.nodejs.org/2014/10/23/node-v0-10-33-stable/ x_refsource_CONFIRM
CVE-2014-3566 其他参考 (37)
-
https://kc.mcafee.com/corporate/index?page=content&id=SB10104 x_refsource_CONFIRM
-
https://bto.bluecoat.com/security-advisory/sa83 x_refsource_CONFIRM
-
http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04779034 x_refsource_CONFIRM
-
https://github.com/mpgn/poodle-PoC x_refsource_MISC
-
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html x_refsource_CONFIRM
-
http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-3566.html x_refsource_CONFIRM
-
https://www.imperialviolet.org/2014/10/14/poodle.html x_refsource_MISC
-
https://puppet.com/security/cve/poodle-sslv3-vulnerability x_refsource_CONFIRM
-
https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_openssl6 x_refsource_CONFIRM
-
http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html x_refsource_CONFIRM
-
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html x_refsource_CONFIRM
-
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html x_refsource_CONFIRM
-
https://technet.microsoft.com/library/security/3009008.aspx x_refsource_CONFIRM
-
https://kc.mcafee.com/corporate/index?page=content&id=SB10091 x_refsource_CONFIRM
-
http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html x_refsource_CONFIRM
-
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html x_refsource_CONFIRM
-
http://downloads.asterisk.org/pub/security/AST-2014-011.html x_refsource_CONFIRM
-
https://groups.google.com/forum/#%21topic/docker-user/oYm0i3xShJU x_refsource_CONFIRM
-
https://kc.mcafee.com/corporate/index?page=content&id=SB10090 x_refsource_CONFIRM
-
https://support.citrix.com/article/CTX216642 x_refsource_CONFIRM
-
https://devcentral.f5.com/articles/cve-2014-3566-removing-sslv3-from-big-ip x_refsource_CONFIRM
-
http://docs.ipswitch.com/MOVEit/DMZ82/ReleaseNotes/MOVEitReleaseNotes82.pdf x_refsource_CONFIRM
-
http://support.citrix.com/article/CTX200238 x_refsource_CONFIRM
-
https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02 x_refsource_MISC
-
http://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04583581 vendor-advisory x_refsource_HP
-
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-015.txt.asc vendor-advisory x_refsource_NETBSD
同批安全公告 · n/a · 2014-10-15 · 共 196 条
| CVE-2014-3593 | OpenWrt LuCI 代码注入漏洞 | |
| CVE-2014-6476 | Oracle Java SE 安全漏洞 | |
| CVE-2014-6478 | Oracle MySQL Server 安全漏洞 | |
| CVE-2014-6479 | Oracle E-Business Suite Oracle Applications Technology组件安全漏洞 | |
| CVE-2014-6482 | Oracle PeopleSoft Products PeopleSoft Enterprise PT PeopleTools组件安全漏洞 | |
| CVE-2014-6483 | Oracle Database Server Application Express组件拒绝服务漏洞 | |
| CVE-2014-6484 | Oracle MySQL Server 拒绝服务漏洞 | |
| CVE-2014-6485 | Oracle Java SE和JavaFX 代码执行漏洞 | |
| CVE-2014-1829 | Requests 信息泄露漏洞 | |
| CVE-2014-1830 | Requests 信息泄露漏洞 | |
| CVE-2014-2022 | vBulletin SQL注入漏洞 | |
| CVE-2014-2576 | Claws Mail 权限许可和访问控制漏洞 | |
| CVE-2014-2927 | F5 BIG-IP和Enterprise Manager 代码注入漏洞 | |
| CVE-2014-8294 | Voice Of Web AllMyGuests SQL注入漏洞 | |
| CVE-2014-0569 | 多款Adobe产品整数溢出漏洞 | |
| CVE-2014-0564 | 多款Adobe产品内存损坏漏洞 | |
| CVE-2014-0558 | 多款Adobe产品内存损坏漏洞 | |
| CVE-2014-8750 | OpenStack Compute Vmware驱动器竞争条件漏洞 | |
| CVE-2014-8295 | Bacula-Web joblogs.php脚本SQL注入漏洞 | |
| CVE-2014-6312 | WordPress Login Widget With Shortcode 跨站请求伪造漏洞 |
显示前 20 条，共 196 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2014-3566
暂无评论