Siemens OpenSSL Inadequate Encryption Strength (CVE-2014-0224)

high Tenable OT Security Plugin ID 500473

Synopsis

The remote OT asset is affected by a vulnerability.

Description

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero- length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the CCS Injection vulnerability.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

Refer to the vendor advisory.

Plugin Details

Severity: High

ID: 500473

Version: 1.9

Type: remote

Family: Tenable.ot

Published: 2/7/2022

Updated: 2/21/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: High

Score: 7.7

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2014-0224

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.9

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:siemens:cp1543-1_firmware, cpe:/o:siemens:s7-1500_firmware

Required KB Items: Tenable.ot/Siemens

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/5/2014

Vulnerability Publication Date: 6/5/2014

Exploitable With

Core Impact

Reference Information

CVE: CVE-2014-0224

CWE: 326

FEDORA: FEDORA-2014-9301, FEDORA-2014-9308

GLSA: GLSA-201407-05

HP: HPSBGN03050, HPSBGN03068, HPSBHF03052, HPSBHF03088, HPSBHF03145, HPSBMU03051, HPSBMU03053, HPSBMU03055, HPSBMU03056, HPSBMU03057, HPSBMU03058, HPSBMU03062, HPSBMU03065, HPSBMU03070, HPSBMU03071, HPSBMU03074, HPSBMU03076, HPSBMU03078, HPSBMU03083, HPSBMU03089, HPSBMU03094, HPSBMU03101, HPSBOV03047, HPSBPI03107, HPSBST03097, HPSBST03098, HPSBST03103, HPSBST03106, HPSBST03195, HPSBST03265, HPSBUX03046, SSRT101818

RHSA: RHSA-2014:0624, RHSA-2014:0626, RHSA-2014:0627, RHSA-2014:0630, RHSA-2014:0631, RHSA-2014:0632, RHSA-2014:0633, RHSA-2014:0680

SECUNIA: 58128, 58337, 58385, 58433, 58492, 58579, 58615, 58639, 58660, 58667, 58713, 58714, 58716, 58719, 58742, 58743, 58745, 58759, 58930, 58939, 58945, 58977, 59004, 59012, 59040, 59043, 59055, 59063, 59093, 59101, 59120, 59126, 59132, 59135, 59142, 59162, 59163, 59167, 59175, 59186, 59188, 59189, 59190, 59191, 59192, 59202, 59211, 59214, 59215, 59223, 59231, 59264, 59282, 59284, 59287, 59300, 59301, 59305, 59306, 59310, 59325, 59338, 59342, 59347, 59354, 59362, 59364, 59365, 59368, 59370, 59374, 59375, 59380, 59383, 59389, 59413, 59429, 59435, 59437, 59438, 59440, 59441, 59442, 59444, 59445, 59446, 59447, 59448, 59449, 59450, 59451, 59454, 59459, 59460, 59483, 59490, 59491, 59495, 59502, 59506, 59514, 59518, 59525, 59528, 59529, 59530, 59589, 59602, 59655, 59659, 59661, 59666, 59669, 59677, 59721, 59784, 59824, 59827, 59878, 59885, 59894, 59916, 59990, 60049, 60066, 60176, 60522, 60567, 60571, 60577, 60819, 61254, 61815

SuSE: SUSE-SU-2015:0578, SUSE-SU-2015:0743, openSUSE-SU-2015:0229, openSUSE-SU-2016:0640

Detections

Analytics