Vulnerability in Apple Mac OS X
CVE-2014-3566
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.
Vulnerability class: POODLE (CVE-2014-3566)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.4 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 1.000 (100.0th percentile), scored .
Very high probability of exploitation in the next 30 days — among the top 0.1% most-likely-to-be-exploited CVEs. 100th percentile — 100.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
The 30-day trend appears once there are two daily scores.
Affected products
- Apple Mac OS X
- IBM Aix — versions 5.3, 6.1, 7.1
- IBM Vios — versions 2.2.0.10, 2.2.0.11, 2.2.0.12
- Mageia — versions 3.0, 4.0
- NetBSD — versions 5.1, 5.1.1, 5.1.2
- Novell SUSE Linux Enterprise Desktop — versions 9.0, 10.0, 11.0
- Novell SUSE Linux Enterprise Server — versions 11.0, 12.0
- Novell SUSE Linux Enterprise Software Development Kit — versions 11.0, 12.0
- OpenSSL — versions 0.9.8, 0.9.8a, 0.9.8b
- Oracle Database — versions 11.2.0.4, 12.1.0.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- marc.info/ (vendor-advisory, Third Party Advisory)
- aix.software.ibm.com/aix/efixes/security/openssl_advisory11.asc (Third Party Advisory)
- www.securitytracker.com/id/1031090 (VDB Entry, Third Party Advisory, vdb-entry)
- blog.nodejs.org/2014/10/23/node-v0-10-33-stable/ (Third Party Advisory)
- rhn.redhat.com/errata/RHSA-2014-1880.html (vendor-advisory, Third Party Advisory)
- marc.info/ (vendor-advisory, Third Party Advisory)
- h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay (Third Party Advisory)
- www.kb.cert.org/vuls/id/577193 (US Government Resource, Third Party Advisory, third-party-advisory)
- marc.info/ (vendor-advisory, Third Party Advisory)
- marc.info/ (vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2014-3566?
- CVE-2014-3566 is a low-severity vulnerability in Apple Mac OS X, classified under Cryptographic Issues. CVSS score: 3.4/10. Published 2014-10-15.
- How severe is CVE-2014-3566?
- Low severity. CVSS v3 base score is 3.4 out of 10.
- Is CVE-2014-3566 known to be exploited?
- 142 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.