The ressol function in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to cause a denial of service (infinite loop) via unspecified input to the OS2ECP function, related to a composite modulus.

The remote host is affected by the vulnerability described in GLSA-201612-38 (Botan: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Botan. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Several security vulnerabilities were found in botan1.10, a C++ library which provides support for many common cryptographic operations, including encryption, authentication, X.509v3 certificates and CRLs.

  - CVE-2015-5726     The BER decoder would crash due to reading from offset 0     of an empty vector if it encountered a BIT STRING which     did not contain any data at all. This can be used to     easily crash applications reading untrusted ASN.1 data,     but does not seem exploitable for code execution.

  - CVE-2015-5727     The BER decoder would allocate a fairly arbitrary amount     of memory in a length field, even if there was no chance     the read request would succeed. This might cause the     process to run out of memory or invoke the OOM killer.

  - CVE-2015-7827     Use constant time PKCS #1 unpadding to avoid possible     side channel attack against RSA decryption

  - CVE-2016-2194     Infinite loop in modular square root algorithm. The     ressol function implementing the Tonelli-Shanks     algorithm for finding square roots could be sent into a     nearly infinite loop due to a misplaced conditional     check. This could occur if a composite modulus is     provided, as this algorithm is only defined for primes.
    This function is exposed to attacker controlled input     via the OS2ECP function during ECC point decompression.

  - CVE-2016-2195     Fix Heap overflow on invalid ECC point.

  - CVE-2016-2849     Use constant time modular inverse algorithm to avoid     possible side channel attack against ECDSA.

The botan developers reports :

Infinite loop in modular square root algorithm - The ressol function implements the Tonelli-Shanks algorithm for finding square roots could be sent into a nearly infinite loop due to a misplaced conditional check. This could occur if a composite modulus is provided, as this algorithm is only defined for primes. This function is exposed to attacker controlled input via the OS2ECP function during ECC point decompression.

Heap overflow on invalid ECC point - The PointGFp constructor did not check that the affine coordinate arguments were less than the prime, but then in curve multiplication assumed that both arguments if multiplied would fit into an integer twice the size of the prime.

The bigint_mul and bigint_sqr functions received the size of the output buffer, but only used it to dispatch to a faster algorithm in cases where there was sufficient output space to call an unrolled multiplication function.

The result is a heap overflow accessible via ECC point decoding, which accepted untrusted inputs. This is likely exploitable for remote code execution.

On systems which use the mlock pool allocator, it would allow an attacker to overwrite memory held in secure_vector objects. After this point the write will hit the guard page at the end of the mmapped region so it probably could not be used for code execution directly, but would allow overwriting adjacent key material.

Security fix for CVE-2016-2194, CVE-2016-2195, CVE-2016-2196

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
95741	GLSA-201612-38 : Botan: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
90841	Debian DSA-3565-1 : botan1.10 - security update	Nessus	Debian Local Security Checks	critical
90287	FreeBSD : Multiple vulnerabilities in Botan (4cd9b19f-f66d-11e5-b94c-001999f8d30b)	Nessus	FreeBSD Local Security Checks	critical
89646	Fedora 23 : botan-1.10.12-1.fc23 / code-editor-2.8.1-13.fc23 / monotone-1.1-13.fc23 / etc (2016-fb9b356b74)	Nessus	Fedora Local Security Checks	critical
89488	Fedora 22 : botan-1.10.12-1.fc22 / code-editor-2.8.1-13.fc22 / monotone-1.1-13.fc22 / etc (2016-1c08d77b96)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2016-2194

high

Tenable Plugins

critical

critical

critical

critical

critical