CVE-2014-0160 Heartbleed: OpenSSL Information Disclosure
Remote attackers can read sensitive memory contents, including private keys, from OpenSSL servers via crafted Heartbeat packets.
- Exploited in the wild
- Since 4 May 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-0160?
CVE-2014-0160 (Heartbleed) is a high-severity vulnerability in Canonical Ubuntu Linux, published on 7 Apr 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
Weakness: CWE-125
Which versions are affected by CVE-2014-0160?
It affects 28 products.
Linux distribution packages (27)
openssl Red Hat:enterprise_linux:6::client | All versions | 0:1.0.1e-16.el6_5.7 |
openssl-debuginfo Red Hat:enterprise_linux:6::client | All versions | 0:1.0.1e-16.el6_5.7 |
openssl-devel Red Hat:enterprise_linux:6::client | All versions | 0:1.0.1e-16.el6_5.7 |
openssl-perl Red Hat:enterprise_linux:6::client | All versions | 0:1.0.1e-16.el6_5.7 |
openssl-static Red Hat:enterprise_linux:6::client | All versions | 0:1.0.1e-16.el6_5.7 |
openssl Red Hat:enterprise_linux:6::computenode | All versions | 0:1.0.1e-16.el6_5.7 |
openssl-debuginfo Red Hat:enterprise_linux:6::computenode | All versions | 0:1.0.1e-16.el6_5.7 |
openssl-devel Red Hat:enterprise_linux:6::computenode | All versions | 0:1.0.1e-16.el6_5.7 |
openssl-perl Red Hat:enterprise_linux:6::computenode | All versions | 0:1.0.1e-16.el6_5.7 |
openssl-static Red Hat:enterprise_linux:6::computenode | All versions | 0:1.0.1e-16.el6_5.7 |
rhev-hypervisor6 Red Hat:enterprise_linux:6::hypervisor | All versions | 0:6.5-20140118.1.3.2.el6_5 |
rhev-hypervisor6 Red Hat:enterprise_linux:6::hypervisor | All versions | 0:6.5-20140407.0.el6ev |
openssl Red Hat:enterprise_linux:6::server | All versions | 0:1.0.1e-16.el6_5.7 |
openssl-debuginfo Red Hat:enterprise_linux:6::server | All versions | 0:1.0.1e-16.el6_5.7 |
openssl-devel Red Hat:enterprise_linux:6::server | All versions | 0:1.0.1e-16.el6_5.7 |
openssl-perl Red Hat:enterprise_linux:6::server | All versions | 0:1.0.1e-16.el6_5.7 |
openssl-static Red Hat:enterprise_linux:6::server | All versions | 0:1.0.1e-16.el6_5.7 |
openssl Red Hat:enterprise_linux:6::workstation | All versions | 0:1.0.1e-16.el6_5.7 |
openssl-debuginfo Red Hat:enterprise_linux:6::workstation | All versions | 0:1.0.1e-16.el6_5.7 |
openssl-devel Red Hat:enterprise_linux:6::workstation | All versions | 0:1.0.1e-16.el6_5.7 |
openssl-perl Red Hat:enterprise_linux:6::workstation | All versions | 0:1.0.1e-16.el6_5.7 |
openssl-static Red Hat:enterprise_linux:6::workstation | All versions | 0:1.0.1e-16.el6_5.7 |
openssl Red Hat:storage:2.1:server:el6 | All versions | 0:1.0.1e-16.el6_5.7 |
openssl-debuginfo Red Hat:storage:2.1:server:el6 | All versions | 0:1.0.1e-16.el6_5.7 |
openssl-devel Red Hat:storage:2.1:server:el6 | All versions | 0:1.0.1e-16.el6_5.7 |
openssl-perl Red Hat:storage:2.1:server:el6 | All versions | 0:1.0.1e-16.el6_5.7 |
openssl-static Red Hat:storage:2.1:server:el6 | All versions | 0:1.0.1e-16.el6_5.7 |
Products include Broadcom Symantec Messaging Gateway, Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Filezilla-Project Filezilla Server, Intellian V100 Firmware and 22 more.
How do I fix CVE-2014-0160?
Upgrade to a fixed version. US federal agencies must fix it by 25 May 2022.
Is CVE-2014-0160 being exploited?
Yes. Attackers have exploited CVE-2014-0160 in the wild since at least 4 May 2022.
Public exploit code: 2 Metasploit modules, 4 Exploit-DB entries and 74 proofs of concept on GitHub.
Other vulnerabilities in Canonical Ubuntu Linux
- CVE-2024-23614 Symantec Messaging Gateway Buffer Overflow
- CVE-2024-23615 Symantec Messaging Gateway Buffer Overflow
- CVE-2020-12594 Privilege escalation in Symantec Messaging Gateway (SMG)
- CVE-2021-30651 Information disclosure in Symantec Messaging Gateway (SMG)
- CVE-2020-12595 Information disclosure in Symantec Messaging Gateway (SMG)
Sources
Also known as CVE-2014-0346, DEBIAN-CVE-2014-0160, DSA-2896-1, GHSA-w8r8-w5w4-4w4v, MGASA-2014-0256, RHSA-2014:0376 and 4 more.