In ARM mbed TLS before 2.7.0, there is a bounds-check bypass through an integer overflow in PSK identity parsing in the ssl_parse_client_psk_identity() function in library/ssl_srv.c.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - In ARM mbed TLS before 2.7.0, there is a bounds-check bypass through an integer overflow in PSK identity
    parsing in the ssl_parse_client_psk_identity() function in library/ssl_srv.c. (CVE-2017-18187)

  - ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0 allows remote attackers to execute arbitrary
    code or cause a denial of service (buffer overflow) via a crafted certificate chain that is mishandled
    during RSASSA-PSS signature verification within a TLS or DTLS session. (CVE-2018-0487)

  - ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0, when the truncated HMAC extension and CBC are
    used, allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption) via
    a crafted application packet within a TLS or DTLS session. (CVE-2018-0488)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4267-1 advisory.

    It was discovered that mbedtls has a bounds-check bypass through an integer overflow that can be used by     an attacked to execute arbitrary code or cause a denial of service. (CVE-2017-18187)

    It was discovered that mbedtls has a vulnerability where an attacker could execute arbitrary code or cause     a denial of service (buffer overflow) via a crafted certificate chain that is mishandled during RSASSA-PSS     signature verification within a TLS or DTLS session. (CVE-2018-0487)

    It was discovered that mbedtls has a vulnerability where an attacker could execute arbitrary code or cause     a denial of service (heap corruption) via a crafted application packet within a TLS or DTLS session.
    (CVE-2018-0488)

    It was discovered that mbedtls has a vulnerability that allows remote attackers to achieve partial     plaintext recovery (for a CBC based ciphersuite) via a timing-based side-channel attack. (CVE-2018-0497)

    It was discovered that mbedtls has a vulnerability that allows local users to achieve partial plaintext     recovery (for a CBC based ciphersuite) via a cache-based side-channel attack. (CVE-2018-0498)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201804-19 (mbed TLS: Multiple vulnerabilites)

    Multiple vulnerabilities have been discovered in mbed TLS. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, through multiple vectors, could possibly execute       arbitrary code with the privileges of the process or cause a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities were discovered in PolarSSL, a lightweight crypto and SSL/TLS library, that allowed a remote attacker to either cause a denial-of-service by application crash, or execute arbitrary code.

Several vulnerabilities were discovered in mbed TLS, a lightweight crypto and SSL/TLS library, that allowed a remote attacker to either cause a denial-of-service by application crash, or execute arbitrary code.

- Update to 2.7.0

Release notes:
https://tls.mbed.org/tech-updates/releases/mbedtls-2.7.0-2.1.10-and-1.
3.22-released

Security Advisory:
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security
-advisory-2018-01

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for mbedtls fixes the following issues :

  - CVE-2018-0487: Fixed a buffer overflow in RSASSA-PSS     signature verification, which allowed remote attackers     to execute arbitrary code or cause a denial of service     via a crafted certificate chain. (boo#1080826)

  - CVE-2018-0488: Fixed a heap vulnerability, which allowed     remote attackers to execute arbitrary code or cause a     DoS via a crafted application packet when the truncated     HMAC extension and CBC are used. (boo#1080828)

  - CVE-2017-18187: Fixed bound check in     ssl_parse_client_psk_identity(), which might lead to an     overflow. (boo#1080973)

ID	Name	Product	Family	Severity
426624	Alpine: multiple mbedtls2 packages: security update to 2.7.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
426624	Alpine: multiple mbedtls2 packages: security update to 2.7.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
424177	Alpine: multiple mbedtls packages: security update to 2.7.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
424177	Alpine: multiple mbedtls packages: security update to 2.7.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
400684	Alpine: multiple mbedtls packages: security update to 2.6.1-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
400684	Alpine: multiple mbedtls packages: security update to 2.6.1-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
133521	Ubuntu 16.04 LTS : ARM mbed TLS vulnerabilities (USN-4267-1)	Nessus	Ubuntu Local Security Checks	critical
109233	GLSA-201804-19 : mbed TLS: Multiple vulnerabilites	Nessus	Gentoo Local Security Checks	critical
108523	Debian DSA-4147-1 : polarssl - security update	Nessus	Debian Local Security Checks	critical
108386	Debian DSA-4138-1 : mbedtls - security update	Nessus	Debian Local Security Checks	critical
107077	Fedora 26 : mbedtls (2018-9817f1dafa)	Nessus	Fedora Local Security Checks	critical
106918	openSUSE Security Update : mbedtls (openSUSE-2018-186)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2017-18187

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical