ID

VAR-201609-0347

CVE

CVE-2016-6302

TITLE

OpenSSL of ssl/t1_lib.c of tls_decrypt_ticket Denial of service in function (DoS) Vulnerability

DESCRIPTION

The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short. OpenSSL is prone to denial-of-service vulnerability. An attacker may exploit this issue to cause a denial-of-service condition. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files). After installing the updated packages, the httpd daemon will be restarted automatically. Additional information can be found at https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithmetic/ CVE-2016-2178 Cesar Pereida, Billy Brumley and Yuval Yarom discovered a timing leak in the DSA code. CVE-2016-2179 / CVE-2016-2181 Quan Luo and the OCAP audit team discovered denial of service vulnerabilities in DTLS. For the stable distribution (jessie), these problems have been fixed in version 1.0.1t-1+deb8u4. For the unstable distribution (sid), these problems will be fixed soon. ========================================================================== Ubuntu Security Notice USN-3087-2 September 23, 2016 openssl regression ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: USN-3087-1 introduced a regression in OpenSSL. Software Description: - openssl: Secure Socket Layer (SSL) cryptographic library and tools Details: USN-3087-1 fixed vulnerabilities in OpenSSL. The fix for CVE-2016-2182 was incomplete and caused a regression when parsing certificates. This update fixes the problem. We apologize for the inconvenience. (CVE-2016-6304) Guido Vranken discovered that OpenSSL used undefined behaviour when performing pointer arithmetic. This issue has only been addressed in Ubuntu 16.04 LTS in this update. (CVE-2016-2178) Quan Luo discovered that OpenSSL did not properly restrict the lifetime of queue entries in the DTLS implementation. (CVE-2016-2179) Shi Lei discovered that OpenSSL incorrectly handled memory in the TS_OBJ_print_bio() function. (CVE-2016-2180) It was discovered that the OpenSSL incorrectly handled the DTLS anti-replay feature. (CVE-2016-2181) Shi Lei discovered that OpenSSL incorrectly validated division results. (CVE-2016-2182) Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions. This update moves DES from the HIGH cipher list to MEDIUM. (CVE-2016-2183) Shi Lei discovered that OpenSSL incorrectly handled certain ticket lengths. (CVE-2016-6302) Shi Lei discovered that OpenSSL incorrectly handled memory in the MDC2_Update() function. (CVE-2016-6303) Shi Lei discovered that OpenSSL incorrectly performed certain message length checks. (CVE-2016-6306) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: libssl1.0.0 1.0.2g-1ubuntu4.5 Ubuntu 14.04 LTS: libssl1.0.0 1.0.1f-1ubuntu2.21 Ubuntu 12.04 LTS: libssl1.0.0 1.0.1-4ubuntu5.38 After a standard system update you need to reboot your computer to make all the necessary changes. References: http://www.ubuntu.com/usn/usn-3087-2 http://www.ubuntu.com/usn/usn-3087-1 https://launchpad.net/bugs/1626883 Package Information: https://launchpad.net/ubuntu/+source/openssl/1.0.2g-1ubuntu4.5 https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.21 https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.38 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 RHEL 7 security update Advisory ID: RHSA-2018:2185-01 Product: Red Hat JBoss Core Services Advisory URL: https://access.redhat.com/errata/RHSA-2018:2185 Issue date: 2018-07-12 CVE Names: CVE-2016-2182 CVE-2016-6302 CVE-2016-6306 CVE-2016-7055 CVE-2017-3731 CVE-2017-3732 CVE-2017-3736 CVE-2017-3737 CVE-2017-3738 ==================================================================== 1. Summary: Red Hat JBoss Core Services Pack Apache Server 2.4.29 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat JBoss Core Services on RHEL 7 Server - noarch, ppc64, x86_64 3. Description: This release adds the new Apache HTTP Server 2.4.29 packages that are part of the JBoss Core Services offering. This release serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.23, and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes, enhancements and component upgrades included in this release. This release upgrades OpenSSL to version 1.0.2.n Security Fix(es): * openssl: Out-of-bounds write caused by unchecked errors in BN_bn2dec() (CVE-2016-2182) * openssl: Insufficient TLS session ticket HMAC length checks (CVE-2016-6302) * openssl: certificate message OOB reads (CVE-2016-6306) * openssl: Carry propagating bug in Montgomery multiplication (CVE-2016-7055) * openssl: Truncated packet could crash via OOB read (CVE-2017-3731) * openssl: BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732) * openssl: bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736) * openssl: Read/write after SSL object in error state (CVE-2017-3737) * openssl: rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738) Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6306 and CVE-2016-7055. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1367340 - CVE-2016-2182 openssl: Out-of-bounds write caused by unchecked errors in BN_bn2dec() 1369855 - CVE-2016-6302 openssl: Insufficient TLS session ticket HMAC length checks 1377594 - CVE-2016-6306 openssl: certificate message OOB reads 1393929 - CVE-2016-7055 openssl: Carry propagating bug in Montgomery multiplication 1416852 - CVE-2017-3731 openssl: Truncated packet could crash via OOB read 1416856 - CVE-2017-3732 openssl: BN_mod_exp may produce incorrect results on x86_64 1509169 - CVE-2017-3736 openssl: bn_sqrx8x_internal carry bug on x86_64 1523504 - CVE-2017-3737 openssl: Read/write after SSL object in error state 1523510 - CVE-2017-3738 openssl: rsaz_1024_mul_avx2 overflow bug on x86_64 6. JIRA issues fixed (https://issues.jboss.org/): JBCS-373 - Errata for httpd 2.4.29 GA RHEL 7 7. Package List: Red Hat JBoss Core Services on RHEL 7 Server: Source: jbcs-httpd24-apache-commons-daemon-1.1.0-1.redhat_2.1.jbcs.el7.src.rpm jbcs-httpd24-apache-commons-daemon-jsvc-1.1.0-1.redhat_2.jbcs.el7.src.rpm jbcs-httpd24-apr-1.6.3-14.jbcs.el7.src.rpm jbcs-httpd24-apr-util-1.6.1-9.jbcs.el7.src.rpm jbcs-httpd24-httpd-2.4.29-17.jbcs.el7.src.rpm jbcs-httpd24-mod_auth_kerb-5.4-36.jbcs.el7.src.rpm jbcs-httpd24-mod_bmx-0.9.6-17.GA.jbcs.el7.src.rpm jbcs-httpd24-mod_cluster-native-1.3.8-1.Final_redhat_2.jbcs.el7.src.rpm jbcs-httpd24-mod_jk-1.2.43-1.redhat_1.jbcs.el7.src.rpm jbcs-httpd24-mod_rt-2.4.1-19.GA.jbcs.el7.src.rpm jbcs-httpd24-mod_security-2.9.1-23.GA.jbcs.el7.src.rpm jbcs-httpd24-nghttp2-1.29.0-8.jbcs.el7.src.rpm jbcs-httpd24-openssl-1.0.2n-11.jbcs.el7.src.rpm noarch: jbcs-httpd24-apache-commons-daemon-1.1.0-1.redhat_2.1.jbcs.el7.noarch.rpm jbcs-httpd24-httpd-manual-2.4.29-17.jbcs.el7.noarch.rpm ppc64: jbcs-httpd24-apache-commons-daemon-jsvc-1.1.0-1.redhat_2.jbcs.el7.ppc64.rpm jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo-1.1.0-1.redhat_2.jbcs.el7.ppc64.rpm jbcs-httpd24-apr-1.6.3-14.jbcs.el7.ppc64.rpm jbcs-httpd24-apr-debuginfo-1.6.3-14.jbcs.el7.ppc64.rpm jbcs-httpd24-apr-devel-1.6.3-14.jbcs.el7.ppc64.rpm jbcs-httpd24-apr-util-1.6.1-9.jbcs.el7.ppc64.rpm jbcs-httpd24-apr-util-debuginfo-1.6.1-9.jbcs.el7.ppc64.rpm jbcs-httpd24-apr-util-devel-1.6.1-9.jbcs.el7.ppc64.rpm jbcs-httpd24-apr-util-ldap-1.6.1-9.jbcs.el7.ppc64.rpm jbcs-httpd24-apr-util-mysql-1.6.1-9.jbcs.el7.ppc64.rpm jbcs-httpd24-apr-util-nss-1.6.1-9.jbcs.el7.ppc64.rpm jbcs-httpd24-apr-util-odbc-1.6.1-9.jbcs.el7.ppc64.rpm jbcs-httpd24-apr-util-openssl-1.6.1-9.jbcs.el7.ppc64.rpm jbcs-httpd24-apr-util-pgsql-1.6.1-9.jbcs.el7.ppc64.rpm jbcs-httpd24-apr-util-sqlite-1.6.1-9.jbcs.el7.ppc64.rpm jbcs-httpd24-httpd-2.4.29-17.jbcs.el7.ppc64.rpm jbcs-httpd24-httpd-debuginfo-2.4.29-17.jbcs.el7.ppc64.rpm jbcs-httpd24-httpd-devel-2.4.29-17.jbcs.el7.ppc64.rpm jbcs-httpd24-httpd-selinux-2.4.29-17.jbcs.el7.ppc64.rpm jbcs-httpd24-httpd-tools-2.4.29-17.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_auth_kerb-5.4-36.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_auth_kerb-debuginfo-5.4-36.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_bmx-0.9.6-17.GA.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_bmx-debuginfo-0.9.6-17.GA.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_cluster-native-1.3.8-1.Final_redhat_2.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_cluster-native-debuginfo-1.3.8-1.Final_redhat_2.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_jk-ap24-1.2.43-1.redhat_1.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_jk-debuginfo-1.2.43-1.redhat_1.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_jk-manual-1.2.43-1.redhat_1.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_ldap-2.4.29-17.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_proxy_html-2.4.29-17.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_rt-2.4.1-19.GA.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_rt-debuginfo-2.4.1-19.GA.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_security-2.9.1-23.GA.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_security-debuginfo-2.9.1-23.GA.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_session-2.4.29-17.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_ssl-2.4.29-17.jbcs.el7.ppc64.rpm jbcs-httpd24-nghttp2-1.29.0-8.jbcs.el7.ppc64.rpm jbcs-httpd24-nghttp2-debuginfo-1.29.0-8.jbcs.el7.ppc64.rpm jbcs-httpd24-nghttp2-devel-1.29.0-8.jbcs.el7.ppc64.rpm jbcs-httpd24-openssl-1.0.2n-11.jbcs.el7.ppc64.rpm jbcs-httpd24-openssl-debuginfo-1.0.2n-11.jbcs.el7.ppc64.rpm jbcs-httpd24-openssl-devel-1.0.2n-11.jbcs.el7.ppc64.rpm jbcs-httpd24-openssl-libs-1.0.2n-11.jbcs.el7.ppc64.rpm jbcs-httpd24-openssl-perl-1.0.2n-11.jbcs.el7.ppc64.rpm jbcs-httpd24-openssl-static-1.0.2n-11.jbcs.el7.ppc64.rpm x86_64: jbcs-httpd24-apache-commons-daemon-jsvc-1.1.0-1.redhat_2.jbcs.el7.x86_64.rpm jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo-1.1.0-1.redhat_2.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-1.6.3-14.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-debuginfo-1.6.3-14.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-devel-1.6.3-14.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-1.6.1-9.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-debuginfo-1.6.1-9.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-devel-1.6.1-9.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-ldap-1.6.1-9.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-mysql-1.6.1-9.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-nss-1.6.1-9.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-odbc-1.6.1-9.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-openssl-1.6.1-9.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-pgsql-1.6.1-9.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-sqlite-1.6.1-9.jbcs.el7.x86_64.rpm jbcs-httpd24-httpd-2.4.29-17.jbcs.el7.x86_64.rpm jbcs-httpd24-httpd-debuginfo-2.4.29-17.jbcs.el7.x86_64.rpm jbcs-httpd24-httpd-devel-2.4.29-17.jbcs.el7.x86_64.rpm jbcs-httpd24-httpd-selinux-2.4.29-17.jbcs.el7.x86_64.rpm jbcs-httpd24-httpd-tools-2.4.29-17.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_auth_kerb-5.4-36.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_auth_kerb-debuginfo-5.4-36.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_bmx-0.9.6-17.GA.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_bmx-debuginfo-0.9.6-17.GA.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_cluster-native-1.3.8-1.Final_redhat_2.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_cluster-native-debuginfo-1.3.8-1.Final_redhat_2.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_jk-ap24-1.2.43-1.redhat_1.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_jk-debuginfo-1.2.43-1.redhat_1.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_jk-manual-1.2.43-1.redhat_1.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_ldap-2.4.29-17.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_proxy_html-2.4.29-17.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_rt-2.4.1-19.GA.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_rt-debuginfo-2.4.1-19.GA.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_security-2.9.1-23.GA.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_security-debuginfo-2.9.1-23.GA.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_session-2.4.29-17.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_ssl-2.4.29-17.jbcs.el7.x86_64.rpm jbcs-httpd24-nghttp2-1.29.0-8.jbcs.el7.x86_64.rpm jbcs-httpd24-nghttp2-debuginfo-1.29.0-8.jbcs.el7.x86_64.rpm jbcs-httpd24-nghttp2-devel-1.29.0-8.jbcs.el7.x86_64.rpm jbcs-httpd24-openssl-1.0.2n-11.jbcs.el7.x86_64.rpm jbcs-httpd24-openssl-debuginfo-1.0.2n-11.jbcs.el7.x86_64.rpm jbcs-httpd24-openssl-devel-1.0.2n-11.jbcs.el7.x86_64.rpm jbcs-httpd24-openssl-libs-1.0.2n-11.jbcs.el7.x86_64.rpm jbcs-httpd24-openssl-perl-1.0.2n-11.jbcs.el7.x86_64.rpm jbcs-httpd24-openssl-static-1.0.2n-11.jbcs.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBW0d+y9zjgjWX9erEAQh8oA/7BIg3HlOvxwmHZR8gAxdYdX87HQj/jy3D 0jmV0br7tzHq81RFOtVGw2c57FA6bnj/2YpL61k7l2KIBPltTQHWqu3QbeCvofUn Iw1ga1Q54PjMrAiniwYma8MHO0jf1prdPQbfaLzcd6KQxSGaxd1zRCucysSzjXud Kq5Q//HeY2jvj6JmwHxxfRhVrkMrM++7zb945XECKEvfejkLNuNM51MllnlEYlpG iIKSjXP03UyG3sE6+h5pMgYLS0iB2wGVdopRaKLNFNQ8JiVlWODUVYlDkGuPWFu3 llvdWj/yPdbSDSs/hGTXOg4u0ng/3q/361WEp33goAW6dcoQg7ucUH8zWdB/lNwd kC1Kxqny7D0h1RReVMPVpa1H40zH1k+4xgTzrgFVPo35n483axTuytac3O/E6rf8 QkP5Cytj0VwvTVukfVovXTB7SctQ2J9k05w9zPQJXzdpww+VU4pLA/UlIi/a85lR Y+vCkFuuFfoS0f7pNL4ariNJFnHAHJom0AlBILO2QxNeQ3lr794fEmHLSBQ4S9s6 5xtgmvo/qZEIe486r0mrYKw8N4+sbKJwCJVUr9E6AkR3u0mgBZa3Y2AqisIJUq9g iMqV5xYQX2nxuyeW8rkYisKI4ISJ3O5XQ3p8Je4ctUGhKFzSTAJQUfXxJEwx+w/p EF1cPMI+sEc=l2Ei -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . OpenSSL Security Advisory [22 Sep 2016] ======================================== OCSP Status Request extension unbounded memory growth (CVE-2016-6304) ===================================================================== Severity: High A malicious client can send an excessively large OCSP Status Request extension. If that client continually requests renegotiation, sending a large OCSP Status Request extension each time, then there will be unbounded memory growth on the server. This will eventually lead to a Denial Of Service attack through memory exhaustion. Servers with a default configuration are vulnerable even if they do not support OCSP. Builds using the "no-ocsp" build time option are not affected. Servers using OpenSSL versions prior to 1.0.1g are not vulnerable in a default configuration, instead only if an application explicitly enables OCSP stapling support. OpenSSL 1.1.0 users should upgrade to 1.1.0a OpenSSL 1.0.2 users should upgrade to 1.0.2i OpenSSL 1.0.1 users should upgrade to 1.0.1u This issue was reported to OpenSSL on 29th August 2016 by Shi Lei (Gear Team, Qihoo 360 Inc.). The fix was developed by Matt Caswell of the OpenSSL development team. SSL_peek() hang on empty record (CVE-2016-6305) =============================================== Severity: Moderate OpenSSL 1.1.0 SSL/TLS will hang during a call to SSL_peek() if the peer sends an empty record. This could be exploited by a malicious peer in a Denial Of Service attack. OpenSSL 1.1.0 users should upgrade to 1.1.0a This issue was reported to OpenSSL on 10th September 2016 by Alex Gaynor. The fix was developed by Matt Caswell of the OpenSSL development team. SWEET32 Mitigation (CVE-2016-2183) ================================== Severity: Low SWEET32 (https://sweet32.info) is an attack on older block cipher algorithms that use a block size of 64 bits. In mitigation for the SWEET32 attack DES based ciphersuites have been moved from the HIGH cipherstring group to MEDIUM in OpenSSL 1.0.1 and OpenSSL 1.0.2. OpenSSL 1.1.0 since release has had these ciphersuites disabled by default. OpenSSL 1.0.2 users should upgrade to 1.0.2i OpenSSL 1.0.1 users should upgrade to 1.0.1u This issue was reported to OpenSSL on 16th August 2016 by Karthikeyan Bhargavan and Gaetan Leurent (INRIA). The fix was developed by Rich Salz of the OpenSSL development team. OOB write in MDC2_Update() (CVE-2016-6303) ========================================== Severity: Low An overflow can occur in MDC2_Update() either if called directly or through the EVP_DigestUpdate() function using MDC2. If an attacker is able to supply very large amounts of input data after a previous call to EVP_EncryptUpdate() with a partial block then a length check can overflow resulting in a heap corruption. The amount of data needed is comparable to SIZE_MAX which is impractical on most platforms. OpenSSL 1.0.2 users should upgrade to 1.0.2i OpenSSL 1.0.1 users should upgrade to 1.0.1u This issue was reported to OpenSSL on 11th August 2016 by Shi Lei (Gear Team, Qihoo 360 Inc.). The fix was developed by Stephen Henson of the OpenSSL development team. Malformed SHA512 ticket DoS (CVE-2016-6302) =========================================== Severity: Low If a server uses SHA512 for TLS session ticket HMAC it is vulnerable to a DoS attack where a malformed ticket will result in an OOB read which will ultimately crash. The use of SHA512 in TLS session tickets is comparatively rare as it requires a custom server callback and ticket lookup mechanism. OpenSSL 1.0.2 users should upgrade to 1.0.2i OpenSSL 1.0.1 users should upgrade to 1.0.1u This issue was reported to OpenSSL on 19th August 2016 by Shi Lei (Gear Team, Qihoo 360 Inc.). The fix was developed by Stephen Henson of the OpenSSL development team. OOB write in BN_bn2dec() (CVE-2016-2182) ======================================== Severity: Low The function BN_bn2dec() does not check the return value of BN_div_word(). This can cause an OOB write if an application uses this function with an overly large BIGNUM. This could be a problem if an overly large certificate or CRL is printed out from an untrusted source. TLS is not affected because record limits will reject an oversized certificate before it is parsed. OpenSSL 1.0.2 users should upgrade to 1.0.2i OpenSSL 1.0.1 users should upgrade to 1.0.1u This issue was reported to OpenSSL on 2nd August 2016 by Shi Lei (Gear Team, Qihoo 360 Inc.). The fix was developed by Stephen Henson of the OpenSSL development team. OOB read in TS_OBJ_print_bio() (CVE-2016-2180) ============================================== Severity: Low The function TS_OBJ_print_bio() misuses OBJ_obj2txt(): the return value is the total length the OID text representation would use and not the amount of data written. This will result in OOB reads when large OIDs are presented. OpenSSL 1.0.2 users should upgrade to 1.0.2i OpenSSL 1.0.1 users should upgrade to 1.0.1u This issue was reported to OpenSSL on 21st July 2016 by Shi Lei (Gear Team, Qihoo 360 Inc.). The fix was developed by Stephen Henson of the OpenSSL development team. Pointer arithmetic undefined behaviour (CVE-2016-2177) ====================================================== Severity: Low Avoid some undefined pointer arithmetic A common idiom in the codebase is to check limits in the following manner: "p + len > limit" Where "p" points to some malloc'd data of SIZE bytes and limit == p + SIZE "len" here could be from some externally supplied data (e.g. from a TLS message). The rules of C pointer arithmetic are such that "p + len" is only well defined where len <= SIZE. Therefore the above idiom is actually undefined behaviour. For example this could cause problems if some malloc implementation provides an address for "p" such that "p + len" actually overflows for values of len that are too big and therefore p + len < limit. OpenSSL 1.0.2 users should upgrade to 1.0.2i OpenSSL 1.0.1 users should upgrade to 1.0.1u This issue was reported to OpenSSL on 4th May 2016 by Guido Vranken. The fix was developed by Matt Caswell of the OpenSSL development team. Constant time flag not preserved in DSA signing (CVE-2016-2178) =============================================================== Severity: Low Operations in the DSA signing algorithm should run in constant time in order to avoid side channel attacks. A flaw in the OpenSSL DSA implementation means that a non-constant time codepath is followed for certain operations. This has been demonstrated through a cache-timing attack to be sufficient for an attacker to recover the private DSA key. OpenSSL 1.0.2 users should upgrade to 1.0.2i OpenSSL 1.0.1 users should upgrade to 1.0.1u This issue was reported to OpenSSL on 23rd May 2016 by César Pereida (Aalto University), Billy Brumley (Tampere University of Technology), and Yuval Yarom (The University of Adelaide and NICTA). The fix was developed by César Pereida. DTLS buffered message DoS (CVE-2016-2179) ========================================= Severity: Low In a DTLS connection where handshake messages are delivered out-of-order those messages that OpenSSL is not yet ready to process will be buffered for later use. Under certain circumstances, a flaw in the logic means that those messages do not get removed from the buffer even though the handshake has been completed. An attacker could force up to approx. 15 messages to remain in the buffer when they are no longer required. These messages will be cleared when the DTLS connection is closed. The default maximum size for a message is 100k. Therefore the attacker could force an additional 1500k to be consumed per connection. By opening many simulataneous connections an attacker could cause a DoS attack through memory exhaustion. OpenSSL 1.0.2 DTLS users should upgrade to 1.0.2i OpenSSL 1.0.1 DTLS users should upgrade to 1.0.1u This issue was reported to OpenSSL on 22nd June 2016 by Quan Luo. The fix was developed by Matt Caswell of the OpenSSL development team. DTLS replay protection DoS (CVE-2016-2181) ========================================== Severity: Low A flaw in the DTLS replay attack protection mechanism means that records that arrive for future epochs update the replay protection "window" before the MAC for the record has been validated. This could be exploited by an attacker by sending a record for the next epoch (which does not have to decrypt or have a valid MAC), with a very large sequence number. This means that all subsequent legitimate packets are dropped causing a denial of service for a specific DTLS connection. OpenSSL 1.0.2 DTLS users should upgrade to 1.0.2i OpenSSL 1.0.1 DTLS users should upgrade to 1.0.1u This issue was reported to OpenSSL on 21st November 2015 by the OCAP audit team. The fix was developed by Matt Caswell of the OpenSSL development team. Certificate message OOB reads (CVE-2016-6306) ============================================= Severity: Low In OpenSSL 1.0.2 and earlier some missing message length checks can result in OOB reads of up to 2 bytes beyond an allocated buffer. There is a theoretical DoS risk but this has not been observed in practice on common platforms. The messages affected are client certificate, client certificate request and server certificate. As a result the attack can only be performed against a client or a server which enables client authentication. OpenSSL 1.1.0 is not affected. OpenSSL 1.0.2 users should upgrade to 1.0.2i OpenSSL 1.0.1 users should upgrade to 1.0.1u This issue was reported to OpenSSL on 22nd August 2016 by Shi Lei (Gear Team, Qihoo 360 Inc.). The fix was developed by Stephen Henson of the OpenSSL development team. Excessive allocation of memory in tls_get_message_header() (CVE-2016-6307) ========================================================================== Severity: Low A TLS message includes 3 bytes for its length in the header for the message. This would allow for messages up to 16Mb in length. Messages of this length are excessive and OpenSSL includes a check to ensure that a peer is sending reasonably sized messages in order to avoid too much memory being consumed to service a connection. A flaw in the logic of version 1.1.0 means that memory for the message is allocated too early, prior to the excessive message length check. Due to way memory is allocated in OpenSSL this could mean an attacker could force up to 21Mb to be allocated to service a connection. This could lead to a Denial of Service through memory exhaustion. However, the excessive message length check still takes place, and this would cause the connection to immediately fail. Assuming that the application calls SSL_free() on the failed conneciton in a timely manner then the 21Mb of allocated memory will then be immediately freed again. Therefore the excessive memory allocation will be transitory in nature. This then means that there is only a security impact if: 1) The application does not call SSL_free() in a timely manner in the event that the connection fails or 2) The application is working in a constrained environment where there is very little free memory or 3) The attacker initiates multiple connection attempts such that there are multiple connections in a state where memory has been allocated for the connection; SSL_free() has not yet been called; and there is insufficient memory to service the multiple requests. Except in the instance of (1) above any Denial Of Service is likely to be transitory because as soon as the connection fails the memory is subsequently freed again in the SSL_free() call. However there is an increased risk during this period of application crashes due to the lack of memory - which would then mean a more serious Denial of Service. This issue does not affect DTLS users. OpenSSL 1.1.0 TLS users should upgrade to 1.1.0a This issue was reported to OpenSSL on 18th September 2016 by Shi Lei (Gear Team, Qihoo 360 Inc.). The fix was developed by Matt Caswell of the OpenSSL development team. Excessive allocation of memory in dtls1_preprocess_fragment() (CVE-2016-6308) ============================================================================= Severity: Low This issue is very similar to CVE-2016-6307. The underlying defect is different but the security analysis and impacts are the same except that it impacts DTLS. A DTLS message includes 3 bytes for its length in the header for the message. This would allow for messages up to 16Mb in length. Messages of this length are excessive and OpenSSL includes a check to ensure that a peer is sending reasonably sized messages in order to avoid too much memory being consumed to service a connection. A flaw in the logic of version 1.1.0 means that memory for the message is allocated too early, prior to the excessive message length check. Due to way memory is allocated in OpenSSL this could mean an attacker could force up to 21Mb to be allocated to service a connection. This could lead to a Denial of Service through memory exhaustion. However, the excessive message length check still takes place, and this would cause the connection to immediately fail. Assuming that the application calls SSL_free() on the failed conneciton in a timely manner then the 21Mb of allocated memory will then be immediately freed again. Therefore the excessive memory allocation will be transitory in nature. This then means that there is only a security impact if: 1) The application does not call SSL_free() in a timely manner in the event that the connection fails or 2) The application is working in a constrained environment where there is very little free memory or 3) The attacker initiates multiple connection attempts such that there are multiple connections in a state where memory has been allocated for the connection; SSL_free() has not yet been called; and there is insufficient memory to service the multiple requests. Except in the instance of (1) above any Denial Of Service is likely to be transitory because as soon as the connection fails the memory is subsequently freed again in the SSL_free() call. However there is an increased risk during this period of application crashes due to the lack of memory - which would then mean a more serious Denial of Service. This issue does not affect TLS users. OpenSSL 1.1.0 DTLS users should upgrade to 1.1.0a This issue was reported to OpenSSL on 18th September 2016 by Shi Lei (Gear Team, Qihoo 360 Inc.). The fix was developed by Matt Caswell of the OpenSSL development team. Note ==== As per our previous announcements and our Release Strategy (https://www.openssl.org/policies/releasestrat.html), support for OpenSSL version 1.0.1 will cease on 31st December 2016. No security updates for that version will be provided after that date. Users of 1.0.1 are advised to upgrade. Support for versions 0.9.8 and 1.0.0 ended on 31st December 2015. Those versions are no longer receiving security updates. References ========== URL for this Security Advisory: https://www.openssl.org/news/secadv/20160922.txt Note: the online version of the advisory may be updated with additional details over time. For details of OpenSSL severity classifications please see: https://www.openssl.org/policies/secpolicy.html

AFFECTED PRODUCTS