Debian DSA-3500-1 : openssl - security update

Critical Nessus Plugin ID 89061

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 7.4

Synopsis

The remote Debian host is missing a security-related update.

Description

Several vulnerabilities were discovered in OpenSSL, a Secure Socket Layer toolkit.

- CVE-2016-0702 Yuval Yarom from the University of Adelaide and NICTA, Daniel Genkin from Technion and Tel Aviv University, and Nadia Heninger from the University of Pennsylvania discovered a side-channel attack which makes use of cache-bank conflicts on the Intel Sandy-Bridge microarchitecture. This could allow local attackers to recover RSA private keys.

- CVE-2016-0705 Adam Langley from Google discovered a double free bug when parsing malformed DSA private keys. This could allow remote attackers to cause a denial of service or memory corruption in applications parsing DSA private keys received from untrusted sources.

- CVE-2016-0797 Guido Vranken discovered an integer overflow in the BN_hex2bn and BN_dec2bn functions that can lead to a NULL pointer dereference and heap corruption. This could allow remote attackers to cause a denial of service or memory corruption in applications processing hex or dec data received from untrusted sources.

- CVE-2016-0798 Emilia Kasper of the OpenSSL development team discovered a memory leak in the SRP database lookup code. To mitigate the memory leak, the seed handling in SRP_VBASE_get_by_user is now disabled even if the user has configured a seed. Applications are advised to migrate to the SRP_VBASE_get1_by_user function.

- CVE-2016-0799, CVE-2016-2842 Guido Vranken discovered an integer overflow in the BIO_*printf functions that could lead to an OOB read when printing very long strings. Additionally the internal doapr_outch function can attempt to write to an arbitrary memory location in the event of a memory allocation failure. These issues will only occur on platforms where sizeof(size_t) > sizeof(int) like many 64 bit systems. This could allow remote attackers to cause a denial of service or memory corruption in applications that pass large amounts of untrusted data to the BIO_*printf functions.

Additionally the EXPORT and LOW ciphers were disabled since thay could be used as part of the DROWN (CVE-2016-0800 ) and SLOTH (CVE-2015-7575 ) attacks, but note that the oldstable (wheezy) and stable (jessie) distributions are not affected by those attacks since the SSLv2 protocol has already been dropped in the openssl package version 1.0.0c-2.

Solution

Upgrade the openssl packages.

For the oldstable distribution (wheezy), these problems have been fixed in version 1.0.1e-2+deb7u20.

For the stable distribution (jessie), these problems have been fixed in version 1.0.1k-3+deb8u4.

See Also

https://security-tracker.debian.org/tracker/CVE-2016-0702

https://security-tracker.debian.org/tracker/CVE-2016-0705

https://security-tracker.debian.org/tracker/CVE-2016-0797

https://security-tracker.debian.org/tracker/CVE-2016-0798

https://security-tracker.debian.org/tracker/CVE-2016-0799

https://security-tracker.debian.org/tracker/CVE-2016-2842

https://security-tracker.debian.org/tracker/CVE-2016-0800

https://security-tracker.debian.org/tracker/CVE-2015-7575

https://packages.debian.org/source/wheezy/openssl

https://packages.debian.org/source/jessie/openssl

https://www.debian.org/security/2016/dsa-3500

Plugin Details

Severity: Critical

ID: 89061

File Name: debian_DSA-3500.nasl

Version: 2.14

Type: local

Agent: unix

Published: 2016/03/02

Updated: 2020/09/23

Dependencies: 12634

Risk Information

Risk Factor: Critical

VPR Score: 7.4

CVSS v2.0

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS v3.0

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:openssl, cpe:/o:debian:debian_linux:7.0, cpe:/o:debian:debian_linux:8.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Patch Publication Date: 2016/03/01

Reference Information

CVE: CVE-2016-0702, CVE-2016-0705, CVE-2016-0797, CVE-2016-0798, CVE-2016-0799, CVE-2016-2842

DSA: 3500