Updated openssl packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library.

A memory leak vulnerability was found in the way OpenSSL parsed PKCS#7 and CMS data. A remote attacker could use this flaw to cause an application that parses PKCS#7 or CMS data from untrusted sources to use an excessive amount of memory and possibly crash. (CVE-2015-3195)

All openssl users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.

According to the versions of the openssl098e package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An integer underflow flaw, leading to a buffer     overflow, was found in the way OpenSSL decoded     malformed Base64-encoded inputs. An attacker able to     make an application using OpenSSL decode a specially     crafted Base64-encoded input (such as a PEM file) could     use this flaw to cause the application to crash. Note:
    this flaw is not exploitable via the TLS/SSL protocol     because the data being transferred is not     Base64-encoded.(CVE-2015-0292)

  - An out-of-bounds read flaw was found in the     X509_cmp_time() function of OpenSSL, which is used to     test the expiry dates of SSL/TLS certificates. An     attacker could possibly use a specially crafted SSL/TLS     certificate or CRL (Certificate Revocation List), which     when parsed by an application would cause that     application to crash.(CVE-2015-1789)

  - A memory leak vulnerability was found in the way     OpenSSL parsed PKCS#7 and CMS data. A remote attacker     could use this flaw to cause an application that parses     PKCS#7 or CMS data from untrusted sources to use an     excessive amount of memory and possibly     crash.(CVE-2015-3195)

  - OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1     before 1.0.1k allows remote attackers to cause a denial     of service (NULL pointer dereference and application     crash) via a crafted DTLS message that is processed     with a different read operation for the handshake     header than for the handshake body, related to the     dtls1_get_record function in d1_pkt.c and the     ssl3_read_n function in s3_pkt.c.(CVE-2014-3571)

  - OpenSSL through 1.0.2h incorrectly uses pointer     arithmetic for heap-buffer boundary checks, which might     allow remote attackers to cause a denial of service     (integer overflow and application crash) or possibly     have unspecified other impact by leveraging unexpected     malloc behavior, related to s3_srvr.c, ssl_sess.c, and     t1_lib.c.(CVE-2016-2177)

  - An integer overflow flaw, leading to a buffer overflow,     was found in the way the EVP_EncodeUpdate() function of     OpenSSL parsed very large amounts of input data. A     remote attacker could use this flaw to crash an     application using OpenSSL or, possibly, execute     arbitrary code with the permissions of the user running     that application.(CVE-2016-2105)

  - An integer overflow flaw, leading to a buffer overflow,     was found in the way the EVP_EncryptUpdate() function     of OpenSSL parsed very large amounts of input data. A     remote attacker could use this flaw to crash an     application using OpenSSL or, possibly, execute     arbitrary code with the permissions of the user running     that application.(CVE-2016-2106)

  - A flaw was found in the way OpenSSL encoded certain     ASN.1 data structures. An attacker could use this flaw     to create a specially crafted certificate which, when     verified or re-encoded by OpenSSL, could cause it to     crash, or execute arbitrary code using the permissions     of the user running an application compiled against the     OpenSSL library.(CVE-2016-2108)

  - A denial of service flaw was found in the way OpenSSL     parsed certain ASN.1-encoded data from BIO (OpenSSL's     I/O abstraction) inputs. An application using OpenSSL     that accepts untrusted ASN.1 BIO input could be forced     to allocate an excessive amount of data.(CVE-2016-2109)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for compat-openssl098 fixes the following issues :

Security issue fixed:;

  - CVE-2015-3195: When presented with a malformed     X509_ATTRIBUTE structure OpenSSL would leak memory. This     structure is used by the PKCS#7 and CMS routines so any     application which reads PKCS#7 or CMS data from     untrusted sources is affected. SSL/TLS is not affected.
    (bsc#957812)

Non security issue fixed :

  - Prevent segfault in s_client with invalid options     (bsc#952099)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of OpenSSL installed on the remote host is prior to 1.0.1q. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.1q advisory.

  - The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before     1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE     data, which allows remote attackers to obtain sensitive information from process memory by triggering a     decoding failure in a PKCS#7 or CMS application. (CVE-2015-3195)

  - crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to     cause a denial of service (NULL pointer dereference and application crash) via an RSA PSS ASN.1 signature     that lacks a mask generation function parameter. (CVE-2015-3194)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-2617 advisory.

    - fix CVE-2015-3194 - certificate verify crash with missing PSS parameter
    - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak
    - fix CVE-2015-3196 - race condition when handling PSK identity hint
    - fix the CVE-2015-1791 fix (broken server side renegotiation)
    - improved fix for CVE-2015-1791
    - add missing parts of CVE-2015-0209 fix for corectness although unexploitable
    - fix CVE-2014-8176 - invalid free in DTLS buffering code
    - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time
    - fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent
    - fix CVE-2015-1791 - race condition handling NewSessionTicket
    - fix CVE-2015-1792 - CMS verify infinite loop with unknown hash function
    - fix CVE-2015-3216 - regression in RAND locking that can cause segfaults on       read in multithreaded applications
    - fix CVE-2015-4000 - prevent the logjam attack on client - restrict       the DH key size to at least 768 bits (limit will be increased in future)
    - update fix for CVE-2015-0287 to what was released upstream
    - fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey()
    - fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison
    - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
    - fix CVE-2015-0288 - X509_to_X509_REQ NULL pointer dereference
    - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
    - fix CVE-2015-0292 - integer underflow in base64 decoder
    - fix CVE-2015-0293 - triggerable assert in SSLv2 server

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix CVE-2015-3194 - certificate verify crash with     missing PSS parameter

  - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak

  - fix CVE-2015-3196 - race condition when handling PSK     identity hint

When presented with a malformed X509_ATTRIBUTE structure OpenSSL will leak memory. This structure is used by the PKCS#7 and CMS routines so any application which reads PKCS#7 or CMS data from untrusted sources is affected. SSL/TLS is not affected.

Kurt

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application. (CVE-2015-3195)

Moderate security issues fixed in this update. Faster handling of some common elliptic curves enabled on 64 bit architectures. Improved Makefile.certificate to not use serial number 0 by default.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
87356	CentOS 5 : openssl (CESA-2015:2616)	Nessus	CentOS Local Security Checks	12/15/2015	1/4/2021	medium
128913	EulerOS 2.0 SP2 : openssl098e (EulerOS-SA-2019-1861)	Nessus	Huawei Local Security Checks	9/17/2019	4/25/2024	critical
87654	SUSE SLED12 / SLES12 Security Update : compat-openssl098 (SUSE-SU-2015:2342-1)	Nessus	SuSE Local Security Checks	12/29/2015	1/6/2021	medium
87221	OpenSSL 1.0.1 < 1.0.1q Multiple Vulnerabilities	Nessus	Web Servers	12/7/2015	10/23/2024	high
87364	Oracle Linux 6 / 7 : openssl (ELSA-2015-2617)	Nessus	Oracle Linux Local Security Checks	12/15/2015	11/1/2024	high
87366	OracleVM 3.3 : openssl (OVMSA-2015-0155)	Nessus	OracleVM Local Security Checks	12/15/2015	1/4/2021	high
87186	Debian DLA-358-1 : openssl security update	Nessus	Debian Local Security Checks	12/4/2015	1/11/2021	medium
91201	F5 Networks BIG-IP : OpenSSL vulnerability (K12824341)	Nessus	F5 Networks Local Security Checks	5/18/2016	1/4/2019	medium
89256	Fedora 23 : openssl-1.0.2e-1.fc23 (2015-605de37b7f)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	high

Detections

Analytics

Plugins Search

medium

critical

medium

high

high

high

medium

medium

high