Update to latest upstream release. Also fixes CVE-2016-0705, CVE-2016-0639, CVE-2016-2047, CVE-2016-0647, CVE-2016-0648, CVE-2016-0666, CVE-2016-0642, CVE-2016-0655, CVE-2016-0643

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A cross-protocol attack was discovered that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. Note that traffic between clients and non-vulnerable servers can be decrypted provided another server supporting SSLv2 and EXPORT ciphers (even with a different protocol such as SMTP, IMAP or POP3) shares the RSA keys of the non-vulnerable server. This vulnerability is known as DROWN.
[CVE-2016-0800]

A double free bug was discovered when OpenSSL parses malformed DSA private keys and could lead to a DoS attack or memory corruption for applications that receive DSA private keys from untrusted sources.
This scenario is considered rare. [CVE-2016-0705]

The SRP user database lookup method SRP_VBASE_get_by_user had confusing memory management semantics; the returned pointer was sometimes newly allocated, and sometimes owned by the callee. The calling code has no way of distinguishing these two cases.
[CVE-2016-0798]

In the BN_hex2bn function, the number of hex digits is calculated using an int value |i|. Later |bn_expand| is called with a value of |i
* 4|. For large values of |i| this can result in |bn_expand| not allocating any memory because |i * 4| is negative. This can leave the internal BIGNUM data field as NULL leading to a subsequent NULL pointer dereference. For very large values of |i|, the calculation |i
* 4| could be a positive value smaller than |i|. In this case memory is allocated to the internal BIGNUM data field, but it is insufficiently sized leading to heap corruption. A similar issue exists in BN_dec2bn. This could have security consequences if BN_hex2bn/BN_dec2bn is ever called by user applications with very large untrusted hex/dec data. This is anticipated to be a rare occurrence. [CVE-2016-0797]

The internal |fmtstr| function used in processing a '%s' formatted string in the BIO_*printf functions could overflow while calculating the length of a string and cause an out-of-bounds read when printing very long strings. [CVE-2016-0799]

A side-channel attack was found which makes use of cache-bank conflicts on the Intel Sandy-Bridge microarchitecture which could lead to the recovery of RSA keys. [CVE-2016-0702]

s2_srvr.c did not enforce that clear-key-length is 0 for non-export ciphers. If clear-key bytes are present for these ciphers, they displace encrypted-key bytes. [CVE-2016-0703]

s2_srvr.c overwrites the wrong bytes in the master key when applying Bleichenbacher protection for export cipher suites. [CVE-2016-0704] Impact : Servers that have SSLv2 protocol enabled are vulnerable to the 'DROWN' attack which allows a remote attacker to fast attack many recorded TLS connections made to the server, even when the client did not make any SSLv2 connections themselves.

An attacker who can supply malformed DSA private keys to OpenSSL applications may be able to cause memory corruption which would lead to a Denial of Service condition. [CVE-2016-0705]

An attacker connecting with an invalid username can cause memory leak, which could eventually lead to a Denial of Service condition.
[CVE-2016-0798]

An attacker who can inject malformed data into an application may be able to cause memory corruption which would lead to a Denial of Service condition. [CVE-2016-0797, CVE-2016-0799]

A local attacker who has control of code in a thread running on the same hyper-threaded core as the victim thread which is performing decryptions could recover RSA keys. [CVE-2016-0702]

An eavesdropper who can intercept SSLv2 handshake can conduct an efficient divide-and-conquer key recovery attack and use the server as an oracle to determine the SSLv2 master-key, using only 16 connections to the server and negligible computation. [CVE-2016-0703]

An attacker can use the Bleichenbacher oracle, which enables more efficient variant of the DROWN attack. [CVE-2016-0704]

Versions of OpenSSL prior to 1.0.1s, or 1.0.2g are unpatched for the following vulnerabilities :

 - A flaw exists in the 'SRP_VBASE_get_by_user' method in the SRP Server 'apps/s_server.c' that is triggered when handling invalid usernames. With a specially crafted username, a remote attacker can cause the service to leak 300 bytes of memory per connection, exhausting available memory resources.(
 - A flaw exists in the 'doapr_outch()' function in 'crypto/bio/b_print.c' that is triggered when failing to allocate memory, as the function's return value has no way to signal this error to a calling function. This may allow a context-dependent attacker to corrupt memory and crash a process linked against the library or potentially execute arbitrary code.
 - An out-of-bounds read flaw exists in the 'fmtstr()' function in 'crypto/bio/b_print.c' that is triggered when printing very long strings. This may allow a context-dependent attacker to crash a process linked against the library or to disclose memory contents.
 - A NULL pointer dereference flaw exists in the 'BN_hex2bn()' and 'BN_dec2bn()' functions in 'crypto/bn/bn_print.c'. This may allow a context-dependent attacker to trigger a heap corruption, potentially allowing the execution of arbitrary code.
 - SSLv2 contains a flaw in its implementation, allowing for a cross-protocol Bleichenbacher padding oracle attack (an adaptive chosen-ciphertext attack). Such an attack may allow a man-in-the-middle attacker to decrypt intercepted TLS connections via a series of specially crafted connections to an SSLv2 server that uses the same private key. The monitored connections required to conduct this attack can use any version of the SSL or TLS protocols, including TLS 1.2, as long as they all use the same RSA key exchange method. With each connection, the server response will vary enough so as to leak information to the attacker about the secret keys in use for the victim TLS connection. This information can in turn be used to eventually decrypt the entire TLS connection and gain access to all plaintext traffic between the victim and server.
 - A double-free flaw exists that is triggered as user-supplied input is not properly validated when parsing malformed DSA private keys. This may allow an attacker to corrupt memory to cause a denial of service or potentially execute arbitrary code.
 - A side-channel attack exists that is triggered during the handling of the cache-bank conflicts on the Intel Sandy-bridge microarchitecture. This may allow an attacker to gain access to RSA key information.
 - A flaw exists in 's2_srvr.c' that is triggered as it does not properly enforce that the 'clear-key-length' is 0 for non-export ciphers. This may allow an attacker to displace encrypted-key bytes if clear-key bytes are present for these ciphers, which can allow the attacker to gain access to SSLv2 master-key information.
 - A flaw exists in 's2_srvr.c' that is triggered when the incorrect bytes in the master-key are overwritten during the application of Bleichenbacher protection mechanisms for export cipher suites. This may allow an attacker to potentially execute more efficient variants of the DROWN attack.

Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Versions of OpenSSL prior to 1.0.1s, or 1.0.2g are unpatched for the following vulnerabilities :

According to its banner, the remote host is running a version of OpenSSL 1.0.2 prior to 1.0.2g. It is, therefore, affected by the following vulnerabilities :

  - A key disclosure vulnerability exists due to improper handling of cache-bank conflicts on the Intel Sandy-bridge microarchitecture. An attacker can exploit this to gain access to RSA key information. (CVE-2016-0702)

  - A double-free error exists due to improper validation of user-supplied input when parsing malformed DSA private keys. A remote attacker can exploit this to corrupt memory, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2016-0705)

  - A NULL pointer dereference flaw exists in the BN_hex2bn() and BN_dec2bn() functions. A remote attacker can exploit this to trigger a heap corruption, resulting in the execution of arbitrary code. (CVE-2016-0797)

  - A denial of service vulnerability exists due to improper handling of invalid usernames. A remote attacker can exploit this, via a specially crafted username, to leak 300 bytes of memory per connection, exhausting available memory resources. (CVE-2016-0798)

  - Multiple memory corruption issues exist that allow a remote attacker to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-0799)

  - A flaw exists that allows a cross-protocol Bleichenbacher padding oracle attack known as DROWN (Decrypting RSA with Obsolete and Weakened eNcryption). This vulnerability exists due to a flaw in the Secure Sockets Layer Version 2 (SSLv2) implementation, and it allows captured TLS traffic to be decrypted. A man-in-the-middle attacker can exploit this to decrypt the TSL connection by utilizing previously captured traffic and weak cryptography along with a series of specially crafted connections to an SSLv2 server that uses the same private key. (CVE-2016-0800)

ID	Name	Product	Family	Published	Updated	Severity
92063	Fedora 22 : community-mysql (2016-1aaf308de4)	Nessus	Fedora Local Security Checks	7/14/2016	1/11/2021	critical
92921	FreeBSD : FreeBSD -- Multiple OpenSSL vulnerabilities (7b1a4a27-600a-11e6-a6c3-14dae9d210b8) (DROWN)	Nessus	FreeBSD Local Security Checks	8/12/2016	1/4/2021	critical
9128	OpenSSL 1.0.1 < 1.0.1s / 1.0.2 < 1.0.2g Multiple Vulnerabilities (DROWN)	Nessus Network Monitor	Web Servers	3/1/2016	3/6/2019	medium
503088	Siemens SCALANCE X-200RNA Switch Devices Improper Input Validation (CVE-2016-0705)	Tenable OT Security	Tenable.ot	3/13/2025	3/13/2025	critical
801963	OpenSSL 1.0.1 < 1.0.1s / 1.0.2 < 1.0.2g Multiple Vulnerabilities (DROWN)	Log Correlation Engine	Web Servers	3/7/2016		medium

Detections

Analytics

Plugins Search

critical

critical

medium

critical

medium