An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM
    mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate,
    when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential
    remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a
    server on a network to deliver malicious x509 certificates to vulnerable applications. (CVE-2017-2784)

- Update to 2.4.2

  - CVE-2017-2784

Release notes:
https://tls.mbed.org/tech-updates/releases/mbedtls-2.4.2-2.1.7-and-1.3 .19-released Security notes:
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security
-advisory-2017-01

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201706-18 (mbed TLS: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in mbed TLS. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update to mbedtls 1.3.19 fixes security issues and bugs.

The following vulnerability was fixed :

CVE-2017-2784: A remote user could have used a specially crafted certificate to cause mbedtls to free a buffer allocated on the stack when verifying the validity of public key with a secp224k1 curve, which could have allowed remote code execution on some platforms (boo#1029017)

The following non-security changes are included :

  - Add checks to prevent signature forgeries for very large     messages while using RSA through the PK module in 64-bit     systems.

  - Fixed potential livelock during the parsing of a CRL in     PEM format

ID	Name	Product	Family	Severity
427448	Alpine: multiple mbedtls2 packages: security update to 2.4.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
427448	Alpine: multiple mbedtls2 packages: security update to 2.4.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
424174	Alpine: multiple mbedtls packages: security update to 2.4.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
424174	Alpine: multiple mbedtls packages: security update to 2.4.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400908	Alpine: multiple mbedtls packages: security update to 2.4.1-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400908	Alpine: multiple mbedtls packages: security update to 2.4.1-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
101654	Fedora 26 : mbedtls (2017-718154e0f2)	Nessus	Fedora Local Security Checks	high
100944	GLSA-201706-18 : mbed TLS: Multiple vulnerabilities (SLOTH)	Nessus	Gentoo Local Security Checks	high
97970	Fedora 25 : mbedtls (2017-9ed1b89530)	Nessus	Fedora Local Security Checks	high
97969	Fedora 24 : mbedtls (2017-922652dd9c)	Nessus	Fedora Local Security Checks	high
97905	openSUSE Security Update : mbedtls (openSUSE-2017-372)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2017-2784

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high