ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2826 advisory.

  - ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in     ssl_parse_server_key_exchange() that could cause a crash on invalid input. (CVE-2018-9988)

  - ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in     ssl_parse_server_psk_hint() that could cause a crash on invalid input. (CVE-2018-9989)

  - An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). The     calculations performed by mbedtls_mpi_exp_mod are not limited; thus, supplying overly large parameters     could lead to denial of service when generating Diffie-Hellman key pairs. (CVE-2020-36475)

  - An issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS). There is     missing zeroization of plaintext buffers in mbedtls_ssl_read to erase unused application data from memory.
    (CVE-2020-36476)

  - An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). A NULL     algorithm parameters entry looks identical to an array of REAL (size zero) and thus the certificate is     considered valid. However, if the parameters do not match in any way, then the certificate should be     considered invalid. (CVE-2020-36478)

  - In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows     system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-     channel and side-channel attack on software running in isolated environments that can be single stepped,     especially Intel SGX. (CVE-2021-24119)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Two vulnerabilities were discovered in polarssl, a lightweight crypto and SSL/TLS library (nowadays continued under the name mbedtls) which could result in plain text recovery via side-channel attacks.

Two other minor vulnerabilities were discovered in polarssl which could result in arithmetic overflow errors.

CVE-2018-0497

As a protection against the Lucky Thirteen attack, the TLS code for CBC decryption in encrypt-then-MAC mode performs extra MAC calculations to compensate for variations in message size due to padding. The amount of extra MAC calculation to perform was based on the assumption that the bulk of the time is spent in processing 64-byte blocks, which is correct for most supported hashes but not for SHA-384. Correct the amount of extra work for SHA-384 (and SHA-512 which is currently not used in TLS, and MD2 although no one should care about that).

This is a regression fix for what CVE-2013-0169 had been fixed this.

CVE-2018-0498

The basis for the Lucky 13 family of attacks is for an attacker to be able to distinguish between (long) valid TLS-CBC padding and invalid TLS-CBC padding. Since our code sets padlen = 0 for invalid padding, the length of the input to the HMAC function gives information about that.

Information about this length (modulo the MD/SHA block size) can be deduced from how much MD/SHA padding (this is distinct from TLS-CBC padding) is used. If MD/SHA padding is read from a (static) buffer, a local attacker could get information about how much is used via a cache attack targeting that buffer.

Let's get rid of this buffer. Now the only buffer used is the internal MD/SHA one, which is always read fully by the process() function.

CVE-2018-9988

Prevent arithmetic overflow on bounds check and add bound check before signature length read in ssl_parse_server_key_exchange().

CVE-2018-9989

Prevent arithmetic overflow on bounds check and add bound check before length read in ssl_parse_server_psk_hint()

For Debian 8 'Jessie', these problems have been fixed in version 1.3.9-2.1+deb8u4.

We recommend that you upgrade your polarssl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for mbedtls fixes the following issues :

Security issues fixed :

  - CVE-2018-9988: Fixed buffer over-read in     ssl_parse_server_key_exchange() that could cause a crash     on invalid input (boo#1089022).

  - CVE-2018-9989: Fixed buffer over-read in     ssl_parse_server_psk_hint() that could cause a crash on     invalid input (boo#1089021).

ID	Name	Product	Family	Severity
155683	Debian DLA-2826-1 : mbedtls - LTS security update	Nessus	Debian Local Security Checks	high
117711	Debian DLA-1518-1 : polarssl security update	Nessus	Debian Local Security Checks	medium
109237	openSUSE Security Update : mbedtls (openSUSE-2018-382)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-9988

high

Tenable Plugins

high

medium

high