The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ASN.1 sequence in a certificate.

The remote host is affected by the vulnerability described in GLSA-201801-15 (PolarSSL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PolarSSL. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker might be able to execute arbitrary code, cause Denial       of Service condition or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

A vulnerability was discovered in PolarSSL, a lightweight crypto and SSL/TLS library. A remote attacker could exploit this flaw using specially crafted certificates to mount a denial of service against an application linked against the library (application crash), or potentially, to execute arbitrary code.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

polarssl was updated to fix a remote attack using crafted certificates. (boo#913903, CVE-2015-1182)

- Fix for CVE-2015-1182

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

PolarSSL contains a flaw when parsing ASN.1 sequences from X.509 certificates due to freeing an uninitialized pointer by the function 'asn1_get_sequence_of' within file 'asn1parse.c'. An unauthenticated, remote attacker, using a specially crafted certificate, can exploit this flaw to cause a denial of service or execute arbitrary code.

This plugin sends client certificates with an X.509 Extended Key Usage extension that contains a malformed key purpose OID. PolarSSL allocates a 'asn1_sequence' structure to store the OID. For this plugin to work, the following conditions must be met :

  - (1) The 'next' field of the allocated 'asn_sequence'     structure for the malformed key purpose OID must be     non-zero.

  - (2) The SSL server requests a client certificate.

A vulnerability was discovered in PolarSSL, a lightweight crypto and SSL/TLS library. A remote attacker could exploit this flaw using specially crafted certificates to mount a denial of service against an application linked against the library (application crash), or potentially, to execute arbitrary code.

PolarSSL team reports :

During the parsing of a ASN.1 sequence, a pointer in the linked list of asn1_sequence is not initialized by asn1_get_sequence_of(). In case an error occurs during parsing of the list, a situation is created where the uninitialized pointer is passed to polarssl_free().

This sequence can be triggered when a PolarSSL entity is parsing a certificate. So practically this means clients when receiving a certificate from the server or servers in case they are actively asking for a client certificate.

ID	Name	Product	Family	Severity
106039	GLSA-201801-15 : PolarSSL: Multiple vulnerabilities (SLOTH)	Nessus	Gentoo Local Security Checks	medium
82127	Debian DLA-144-1 : polarssl security update	Nessus	Debian Local Security Checks	high
81138	openSUSE Security Update : polarssl (openSUSE-SU-2015:0186-1)	Nessus	SuSE Local Security Checks	high
81093	Fedora 21 : polarssl-1.3.9-3.fc21 (2015-1045)	Nessus	Fedora Local Security Checks	high
81092	Fedora 20 : polarssl-1.2.12-3.fc20 (2015-0991)	Nessus	Fedora Local Security Checks	high
81047	PolarSSL 'asn1_get_sequence_of' Function Uninitialized Pointer RCE	Nessus	General	critical
80971	Debian DSA-3136-1 : polarssl - security update	Nessus	Debian Local Security Checks	high
80840	FreeBSD : polarssl -- Remote attack using crafted certificates (a5856eba-a015-11e4-a680-1c6f65c3c4ff)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-1182

critical

Tenable Plugins

medium

high

high

high

high

critical

high

high