# MA-401.062014: MyCERT Advisory - OpenSSL Releases Security Updates

**Date:** 09 Jun 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-401.062014  
**Advisory ID:** MA-401.062014

---

**1.0 Introduction**
OpenSSL has released updates patching 6 vulnerabilities, which may allow an attacker to decrypt or modify traffic between a vulnerable client and server, cause a denial of service condition, or remotely execute arbitrary code [1].
**2.0 Impact**
An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. This can be exploited by a Man-in-the-middle (MITM) attack where the attacker can decrypt and modify traffic from the attacked client and server [2, 3].
**3.0 Recommendation**
Users of affected versions of OpenSSL are advised to apply the updates accordingly [2, 3] as per below:
- OpenSSL 0.9.8 SSL/TLS users should upgrade to 0.9.8za
- OpenSSL 1.0.0 SSL/TLS users should upgrade to 1.0.0m
- OpenSSL 1.0.1 SSL/TLS users should upgrade to 1.0.1h
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection)
Phone: 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web: https://www.mycert.org.my
Twitter: http://www.twitter.com/mycert
Facebook: http://www.facebook.com/mycert.org.my
**5.0 References**
[1] US CERT: OpenSSL Releases Security Advisory [online], https://www.us-cert.gov/ncas/current-  activity/2014/06/05/OpenSSL-Releases-Security-Advisory
[2] OpenSSL Security Advisory [online], http://www.openssl.org/news/secadv\_20140605.txt
[3] Vulnerability Note #978508 [online], http://www.kb.cert.org/vuls/id/978508