# MA-421.102014: MyCERT Advisory - OpenSSL Patches Four Vulnerabilities

**Date:** 17 Oct 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-421.102014  
**Advisory ID:** MA-421.102014

---

**1.0    Introduction**
OpenSSL has released updates patching four vulnerabilities, some of which may allow an attacker to cause a Denial of Service (DoS) condition or execute man-in-the-middle attacks (MITM).
**2.0    Impact**
The impact of such vulnerabilities is the attacker is able to send a crafted handshake message and a large number of invalid session tickets which allows DoS to take place. Another impact is the attacker is able to execute a MITM attack by forcing protocol downgrade.
**3.0    Recommendation**
Users of affected versions of OpenSSL are advised to apply the updates accordingly as per below:
- OpenSSL 1.0.1 users should upgrade to 1.0.1j
- OpenSSL 1.0.0 users should upgrade to 1.0.0o
- OpenSSL 0.9.8 users should upgrade to 0.9.8zc
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection)
Phone: 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
**4.0    References**
[1]    US CERT: OpenSSL Releases Security Advisory [online],
<https://www.us-cert.gov/ncas/current-activity/2014/10/16/OpenSSL-Patches-Four-Vulnerabilities>
[2]    OpenSSL Security Advisory [online],
<https://www.openssl.org/news/secadv_20141015.txt>
[3]    AusCERT: ESB-2014.1858 - [Win][UNIX/Linux] OpenSSL: Multiple vulnerabilities,
<http://www.auscert.org.au/render.html?it=20873>