CVE-2014-3470

What it actually does

NULL pointer dereference in ssl3_send_client_key_exchange during anonymous ECDH handshake causes client process crash.

Why it matters to the business

Client applications using affected OpenSSL versions become unavailable when connecting to servers advertising anonymous ECDH suites, leading to service outages and potential loss of connectivity for dependent systems.

How an attack unfolds

An attacker configures a server to offer anonymous ECDH cipher suites, waits for a vulnerable client to initiate a TLS handshake, and responds with a ServerKeyExchange message that triggers the client to process a NULL certificate value inside ssl3_send_client_key_exchange, resulting in an immediate crash.

How to fix it

Upgrade OpenSSL to 0.9.8za, 1.0.0m, or 1.0.1h or later on all affected systems and rebuild or reinstall any statically linked applications; disable anonymous ECDH cipher suites in configuration until patches are applied.

How to confirm the fix worked

Confirm OpenSSL version is at or above the fixed releases; attempt a test connection using an anonymous ECDH suite from a patched client and verify the connection either succeeds or fails gracefully without a crash.

Typical attack path

1. Attacker positions a TLS server advertising only anonymous ECDH cipher suites.
2. Vulnerable client initiates connection and selects an anonymous ECDH suite.
3. Server sends ServerHello and ServerKeyExchange without a certificate.
4. Client code path in ssl3_send_client_key_exchange dereferences a NULL certificate pointer.
5. Client process terminates with segmentation fault or equivalent crash.

How to detect it

Review application and system logs for segmentation faults or abrupt process terminations immediately following outbound TLS connections; correlate with network traffic showing ServerHello messages advertising anonymous ECDH suites.

What your security team should do

• Prioritize patching all internet-facing or externally reachable OpenSSL clients within 30 days given high EPSS score.
• Audit configuration files to remove or explicitly disable anonymous cipher suites.
• Scan internal package inventories for the listed affected distributions and rebuild any custom builds linked against vulnerable OpenSSL.