AIX OpenSSL Advisory : openssl_advisory.asc

Critical Nessus Plugin ID 73559

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 6.7

Synopsis

The remote AIX host is running a vulnerable version of OpenSSL.

Description

The version of OpenSSL running on the remote host is affected by the following vulnerabilities :

- In TLS connections, certain incorrectly formatted records can cause an OpenSSL client or server to crash due to a read attempt at NULL. OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c, (2) crypto/bn/bn_gf2m.c, (3) crypto/ec/ec2_smpl.c, and (4) engines e_ubsec.c, which has an unspecified impact and context-dependent attack vectors. (CVE-2009-3245)

- The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via SSL cipher negotiation, as demonstrated by a chroot installation of Dovecot or stunnel without Kerberos configuration files inside the chroot. (CVE-2010-0433)

- The ssl3_get_record function in ssl/s3_pkt.c in OpenSSL 0.9.8f through 0.9.8m allows remote attackers to cause a denial of service (crash) via a malformed record in a TLS connection that triggers a NULL pointer dereference, related to the minor version number. (CVE-2010-0740)

Solution

A fix is available, and it can be downloaded from the AIX website.

To extract the fixes from the tar file :

zcat openssl.0.9.8.1103.tar.Z | tar xvf - or zcat openssl-fips.12.9.8.1103.tar.Z | tar xvf - or zcat openssl.0.9.8.806.tar.Z | tar xvf -

IMPORTANT : If possible, it is recommended that a mksysb backup of the system be created. Verify it is both bootable and readable before proceeding.

To preview the fix installation :

installp -apYd . openssl

To install the fix package :

installp -aXYd . openssl

See Also

http://aix.software.ibm.com/aix/efixes/security/openssl_advisory.asc

https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=aixbp

Plugin Details

Severity: Critical

ID: 73559

File Name: aix_openssl_advisory.nasl

Version: 1.9

Type: local

Published: 2014/04/16

Updated: 2021/01/04

Dependencies: 12634

Risk Information

Risk Factor: Critical

VPR Score: 6.7

CVSS v2.0

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/o:ibm:aix

Required KB Items: Host/AIX/lslpp, Host/local_checks_enabled, Host/AIX/version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2010/05/21

Vulnerability Publication Date: 2010/02/23

Reference Information

CVE: CVE-2009-3245, CVE-2010-0433, CVE-2010-0740

BID: 38533, 38562, 39013

CWE: 20