This update for openssl fixes various security issues :

Security issues fixed :

  - CVE-2016-0800 aka the 'DROWN' attack (bsc#968046):
    OpenSSL was vulnerable to a cross-protocol attack that     could lead to decryption of TLS sessions by using a     server supporting SSLv2 and EXPORT cipher suites as a     Bleichenbacher RSA padding oracle.

    This update changes the openssl library to :

  - Disable SSLv2 protocol support by default. This can be     overridden by setting the environment variable     'OPENSSL_ALLOW_SSL2' or by using SSL_CTX_clear_options     using the SSL_OP_NO_SSLv2 flag.

    Note that various services and clients had already     disabled SSL protocol 2 by default previously.

  - Disable all weak EXPORT ciphers by default. These can be     reenabled if required by old legacy software using the     environment variable 'OPENSSL_ALLOW_EXPORT'.

  - CVE-2016-0702 aka the 'CacheBleed' attack. (bsc#968050)     Various changes in the modular exponentation code were     added that make sure that it is not possible to recover     RSA secret keys by analyzing cache-bank conflicts on the     Intel Sandy-Bridge microarchitecture.

    Note that this was only exploitable if the malicious     code was running on the same hyper threaded Intel Sandy     Bridge processor as the victim thread performing     decryptions.

  - CVE-2016-0705 (bnc#968047): A double free() bug in the     DSA ASN1 parser code was fixed that could be abused to     facilitate a denial-of-service attack.

  - CVE-2016-0797 (bnc#968048): The BN_hex2bn() and     BN_dec2bn() functions had a bug that could result in an     attempt to de-reference a NULL pointer leading to     crashes. This could have security consequences if these     functions were ever called by user applications with     large untrusted hex/decimal data. Also, internal usage     of these functions in OpenSSL uses data from config     files or application command line arguments. If user     developed applications generated config file data based     on untrusted data, then this could have had security     consequences as well.

  - CVE-2016-0798 (bnc#968265) The SRP user database lookup     method SRP_VBASE_get_by_user() had a memory leak that     attackers could abuse to facility DoS attacks. To     mitigate the issue, the seed handling in     SRP_VBASE_get_by_user() was disabled even if the user     has configured a seed. Applications are advised to     migrate to SRP_VBASE_get1_by_user().

  - CVE-2016-0799 (bnc#968374) On many 64 bit systems, the     internal fmtstr() and doapr_outch() functions could     miscalculate the length of a string and attempt to     access out-of-bounds memory locations. These problems     could have enabled attacks where large amounts of     untrusted data is passed to the BIO_*printf functions.
    If applications use these functions in this way then     they could have been vulnerable. OpenSSL itself uses     these functions when printing out human-readable dumps     of ASN.1 data. Therefore applications that print this     data could have been vulnerable if the data is from     untrusted sources. OpenSSL command line applications     could also have been vulnerable when they print out     ASN.1 data, or if untrusted data is passed as command     line arguments. Libssl is not considered directly     vulnerable.

  - CVE-2015-3197 (bsc#963415): The SSLv2 protocol did not     block disabled ciphers.

Note that the March 1st 2016 release also references following CVEs that were fixed by us with CVE-2015-0293 in 2015 :

  - CVE-2016-0703 (bsc#968051): This issue only affected     versions of OpenSSL prior to March 19th 2015 at which     time the code was refactored to address vulnerability     CVE-2015-0293. It would have made the above 'DROWN'     attack much easier.

  - CVE-2016-0704 (bsc#968053): 'Bleichenbacher oracle in     SSLv2' This issue only affected versions of OpenSSL     prior to March 19th 2015 at which time the code was     refactored to address vulnerability CVE-2015-0293. It     would have made the above 'DROWN' attack much easier.

Also the following bug was fixed :

  - Ensure that OpenSSL doesn't fall back to the default     digest algorithm (SHA1) in case a non-FIPS algorithm was     negotiated while running in FIPS mode. Instead, OpenSSL     will refuse the session. (bnc#958501)

This update was imported from the SUSE:SLE-12-SP1:Update update project.

From Red Hat Security Advisory 2016:0996 :

An update for openssl is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es) :

* A flaw was found in the way OpenSSL encoded certain ASN.1 data structures. An attacker could use this flaw to create a specially crafted certificate which, when verified or re-encoded by OpenSSL, could cause it to crash, or execute arbitrary code using the permissions of the user running an application compiled against the OpenSSL library. (CVE-2016-2108)

* Two integer overflow flaws, leading to buffer overflows, were found in the way the EVP_EncodeUpdate() and EVP_EncryptUpdate() functions of OpenSSL parsed very large amounts of input data. A remote attacker could use these flaws to crash an application using OpenSSL or, possibly, execute arbitrary code with the permissions of the user running that application. (CVE-2016-2105, CVE-2016-2106)

* It was discovered that OpenSSL leaked timing information when decrypting TLS/SSL and DTLS protocol encrypted records when the connection used the AES CBC cipher suite and the server supported AES-NI. A remote attacker could possibly use this flaw to retrieve plain text from encrypted packets by using a TLS/SSL or DTLS server as a padding oracle. (CVE-2016-2107)

* Several flaws were found in the way BIO_*printf functions were implemented in OpenSSL. Applications which passed large amounts of untrusted data through these functions could crash or potentially execute code with the permissions of the user running such an application. (CVE-2016-0799, CVE-2016-2842)

* A denial of service flaw was found in the way OpenSSL parsed certain ASN.1-encoded data from BIO (OpenSSL's I/O abstraction) inputs. An application using OpenSSL that accepts untrusted ASN.1 BIO input could be forced to allocate an excessive amount of data. (CVE-2016-2109)

Red Hat would like to thank the OpenSSL project for reporting CVE-2016-2108, CVE-2016-2842, CVE-2016-2105, CVE-2016-2106, CVE-2016-2107, and CVE-2016-0799. Upstream acknowledges Huzaifa Sidhpurwala (Red Hat), Hanno Bock, and David Benjamin (Google) as the original reporters of CVE-2016-2108; Guido Vranken as the original reporter of CVE-2016-2842, CVE-2016-2105, CVE-2016-2106, and CVE-2016-0799; and Juraj Somorovsky as the original reporter of CVE-2016-2107.

Security Fix(es) :

  - A flaw was found in the way OpenSSL encoded certain     ASN.1 data structures. An attacker could use this flaw     to create a specially crafted certificate which, when     verified or re-encoded by OpenSSL, could cause it to     crash, or execute arbitrary code using the permissions     of the user running an application compiled against the     OpenSSL library. (CVE-2016-2108)

  - Two integer overflow flaws, leading to buffer overflows,     were found in the way the EVP_EncodeUpdate() and     EVP_EncryptUpdate() functions of OpenSSL parsed very     large amounts of input data. A remote attacker could use     these flaws to crash an application using OpenSSL or,     possibly, execute arbitrary code with the permissions of     the user running that application. (CVE-2016-2105,     CVE-2016-2106)

  - It was discovered that OpenSSL leaked timing information     when decrypting TLS/SSL and DTLS protocol encrypted     records when the connection used the AES CBC cipher     suite and the server supported AES-NI. A remote attacker     could possibly use this flaw to retrieve plain text from     encrypted packets by using a TLS/SSL or DTLS server as a     padding oracle. (CVE-2016-2107)

  - Several flaws were found in the way BIO_*printf     functions were implemented in OpenSSL. Applications     which passed large amounts of untrusted data through     these functions could crash or potentially execute code     with the permissions of the user running such an     application. (CVE-2016-0799, CVE-2016-2842)

  - A denial of service flaw was found in the way OpenSSL     parsed certain ASN.1-encoded data from BIO (OpenSSL's     I/O abstraction) inputs. An application using OpenSSL     that accepts untrusted ASN.1 BIO input could be forced     to allocate an excessive amount of data. (CVE-2016-2109)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix CVE-2016-2177 - possible integer overflow

  - fix CVE-2016-2178 - non-constant time DSA operations

  - fix CVE-2016-2179 - further DoS issues in DTLS

  - fix CVE-2016-2180 - OOB read in TS_OBJ_print_bio

  - fix CVE-2016-2181 - DTLS1 replay protection and     unprocessed records issue

  - fix CVE-2016-2182 - possible buffer overflow in     BN_bn2dec

  - fix CVE-2016-6302 - insufficient TLS session ticket HMAC     length check

  - fix CVE-2016-6304 - unbound memory growth with OCSP     status request

  - fix CVE-2016-6306 - certificate message OOB reads

  - mitigate CVE-2016-2183 - degrade all 64bit block ciphers     and RC4 to 112 bit effective strength

  - replace expired testing certificates

  - fix CVE-2016-2105 - possible overflow in base64 encoding

  - fix CVE-2016-2106 - possible overflow in     EVP_EncryptUpdate

  - fix CVE-2016-2107 - padding oracle in stitched AES-NI     CBC-MAC

  - fix CVE-2016-2108 - memory corruption in ASN.1 encoder

  - fix CVE-2016-2109 - possible DoS when reading ASN.1 data     from BIO

  - fix CVE-2016-0799 - memory issues in BIO_printf

This update for openssl fixes various security issues and bugs :

Security issues fixed :

  - CVE-2016-0800 aka the 'DROWN' attack (bsc#968046):
    OpenSSL was vulnerable to a cross-protocol attack that     could lead to decryption of TLS sessions by using a     server supporting SSLv2 and EXPORT cipher suites as a     Bleichenbacher RSA padding oracle.

    This update changes the openssl library to :

  - Disable SSLv2 protocol support by default.

    This can be overridden by setting the environment     variable 'OPENSSL_ALLOW_SSL2' or by using     SSL_CTX_clear_options using the SSL_OP_NO_SSLv2 flag.

    Note that various services and clients had already     disabled SSL protocol 2 by default previously.

  - Disable all weak EXPORT ciphers by default. These can be     reenabled if required by old legacy software using the     environment variable 'OPENSSL_ALLOW_EXPORT'.

  - CVE-2016-0705 (bnc#968047): A double free() bug in the     DSA ASN1 parser code was fixed that could be abused to     facilitate a denial-of-service attack.

  - CVE-2016-0797 (bnc#968048): The BN_hex2bn() and     BN_dec2bn() functions had a bug that could result in an     attempt to de-reference a NULL pointer leading to     crashes. This could have security consequences if these     functions were ever called by user applications with     large untrusted hex/decimal data. Also, internal usage     of these functions in OpenSSL uses data from config     files or application command line arguments. If user     developed applications generated config file data based     on untrusted data, then this could have had security     consequences as well.

  - CVE-2016-0799 (bnc#968374) On many 64 bit systems, the     internal fmtstr() and doapr_outch() functions could     miscalculate the length of a string and attempt to     access out-of-bounds memory locations. These problems     could have enabled attacks where large amounts of     untrusted data is passed to the BIO_*printf functions.
    If applications use these functions in this way then     they could have been vulnerable. OpenSSL itself uses     these functions when printing out human-readable dumps     of ASN.1 data. Therefore applications that print this     data could have been vulnerable if the data is from     untrusted sources. OpenSSL command line applications     could also have been vulnerable when they print out     ASN.1 data, or if untrusted data is passed as command     line arguments. Libssl is not considered directly     vulnerable.

  - CVE-2015-3197 (bsc#963415): The SSLv2 protocol did not     block disabled ciphers.

Note that the March 1st 2016 release also references following CVEs that were fixed by us with CVE-2015-0293 in 2015 :

  - CVE-2016-0703 (bsc#968051): This issue only affected     versions of OpenSSL prior to March 19th 2015 at which     time the code was refactored to address vulnerability     CVE-2015-0293. It would have made the above 'DROWN'     attack much easier.

  - CVE-2016-0704 (bsc#968053): 'Bleichenbacher oracle in     SSLv2' This issue only affected versions of OpenSSL     prior to March 19th 2015 at which time the code was     refactored to address vulnerability CVE-2015-0293. It     would have made the above 'DROWN' attack much easier.

Also fixes the following bug :

  - Avoid running OPENSSL_config twice. This avoids breaking     engine loading and also fixes a memory leak in libssl.
    (bsc#952871 bsc#967787)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-3556 advisory.

  - The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g     improperly calculates string lengths, which allows remote attackers to cause a denial of service (overflow     and out-of-bounds read) or possibly have unspecified other impact via a long string, as demonstrated by a     large amount of ASN.1 data, a different vulnerability than CVE-2016-2842. (CVE-2016-0799)

  - Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and     1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a     large amount of binary data. (CVE-2016-2105)

  - The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory     allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext     information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists     because of an incorrect fix for CVE-2013-0169. (CVE-2016-2107)

  - The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g     does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial     of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a     long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than     CVE-2016-0799. (CVE-2016-2842)

  - Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and     1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a     large amount of data. (CVE-2016-2106)

  - The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to     execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY     field in crafted serialized data, aka the negative zero issue. (CVE-2016-2108)

  - The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before     1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption)     via a short invalid encoding. (CVE-2016-2109)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of OpenSSL prior to 1.0.1s, or 1.0.2g are unpatched for the following vulnerabilities :

 - A flaw exists in the 'SRP_VBASE_get_by_user' method in the SRP Server 'apps/s_server.c' that is triggered when handling invalid usernames. With a specially crafted username, a remote attacker can cause the service to leak 300 bytes of memory per connection, exhausting available memory resources.(
 - A flaw exists in the 'doapr_outch()' function in 'crypto/bio/b_print.c' that is triggered when failing to allocate memory, as the function's return value has no way to signal this error to a calling function. This may allow a context-dependent attacker to corrupt memory and crash a process linked against the library or potentially execute arbitrary code.
 - An out-of-bounds read flaw exists in the 'fmtstr()' function in 'crypto/bio/b_print.c' that is triggered when printing very long strings. This may allow a context-dependent attacker to crash a process linked against the library or to disclose memory contents.
 - A NULL pointer dereference flaw exists in the 'BN_hex2bn()' and 'BN_dec2bn()' functions in 'crypto/bn/bn_print.c'. This may allow a context-dependent attacker to trigger a heap corruption, potentially allowing the execution of arbitrary code.
 - SSLv2 contains a flaw in its implementation, allowing for a cross-protocol Bleichenbacher padding oracle attack (an adaptive chosen-ciphertext attack). Such an attack may allow a man-in-the-middle attacker to decrypt intercepted TLS connections via a series of specially crafted connections to an SSLv2 server that uses the same private key. The monitored connections required to conduct this attack can use any version of the SSL or TLS protocols, including TLS 1.2, as long as they all use the same RSA key exchange method. With each connection, the server response will vary enough so as to leak information to the attacker about the secret keys in use for the victim TLS connection. This information can in turn be used to eventually decrypt the entire TLS connection and gain access to all plaintext traffic between the victim and server.
 - A double-free flaw exists that is triggered as user-supplied input is not properly validated when parsing malformed DSA private keys. This may allow an attacker to corrupt memory to cause a denial of service or potentially execute arbitrary code.
 - A side-channel attack exists that is triggered during the handling of the cache-bank conflicts on the Intel Sandy-bridge microarchitecture. This may allow an attacker to gain access to RSA key information.
 - A flaw exists in 's2_srvr.c' that is triggered as it does not properly enforce that the 'clear-key-length' is 0 for non-export ciphers. This may allow an attacker to displace encrypted-key bytes if clear-key bytes are present for these ciphers, which can allow the attacker to gain access to SSLv2 master-key information.
 - A flaw exists in 's2_srvr.c' that is triggered when the incorrect bytes in the master-key are overwritten during the application of Bleichenbacher protection mechanisms for export cipher suites. This may allow an attacker to potentially execute more efficient variants of the DROWN attack.

Versions of OpenSSL prior to 1.0.1s, or 1.0.2g are unpatched for the following vulnerabilities :

According to its banner, the remote host is running a version of OpenSSL 1.0.2 prior to 1.0.2g. It is, therefore, affected by the following vulnerabilities :

  - A key disclosure vulnerability exists due to improper handling of cache-bank conflicts on the Intel Sandy-bridge microarchitecture. An attacker can exploit this to gain access to RSA key information. (CVE-2016-0702)

  - A double-free error exists due to improper validation of user-supplied input when parsing malformed DSA private keys. A remote attacker can exploit this to corrupt memory, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2016-0705)

  - A NULL pointer dereference flaw exists in the BN_hex2bn() and BN_dec2bn() functions. A remote attacker can exploit this to trigger a heap corruption, resulting in the execution of arbitrary code. (CVE-2016-0797)

  - A denial of service vulnerability exists due to improper handling of invalid usernames. A remote attacker can exploit this, via a specially crafted username, to leak 300 bytes of memory per connection, exhausting available memory resources. (CVE-2016-0798)

  - Multiple memory corruption issues exist that allow a remote attacker to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-0799)

  - A flaw exists that allows a cross-protocol Bleichenbacher padding oracle attack known as DROWN (Decrypting RSA with Obsolete and Weakened eNcryption). This vulnerability exists due to a flaw in the Secure Sockets Layer Version 2 (SSLv2) implementation, and it allows captured TLS traffic to be decrypted. A man-in-the-middle attacker can exploit this to decrypt the TSL connection by utilizing previously captured traffic and weak cryptography along with a series of specially crafted connections to an SSLv2 server that uses the same private key. (CVE-2016-0800)

ID	Name	Product	Family	Published	Updated	Severity
89091	openSUSE Security Update : openssl (openSUSE-2016-289) (DROWN)	Nessus	SuSE Local Security Checks	3/3/2016	1/19/2021	critical
91152	Oracle Linux 6 : openssl (ELSA-2016-0996)	Nessus	Oracle Linux Local Security Checks	5/16/2016	1/14/2021	critical
91541	Scientific Linux Security Update : openssl on SL6.x i386/x86_64 (20160510)	Nessus	Scientific Linux Local Security Checks	6/9/2016	1/14/2021	critical
93761	OracleVM 3.3 / 3.4 : openssl (OVMSA-2016-0135)	Nessus	OracleVM Local Security Checks	9/28/2016	1/4/2021	critical
89655	SUSE SLED11 / SLES11 Security Update : openssl (SUSE-SU-2016:0624-1) (DROWN)	Nessus	SuSE Local Security Checks	3/4/2016	1/6/2021	critical
181111	Oracle Linux 7 : openssl (ELSA-2016-3556)	Nessus	Oracle Linux Local Security Checks	9/7/2023	9/7/2023	critical
9128	OpenSSL 1.0.1 < 1.0.1s / 1.0.2 < 1.0.2g Multiple Vulnerabilities (DROWN)	Nessus Network Monitor	Web Servers	3/1/2016	3/6/2019	medium
801963	OpenSSL 1.0.1 < 1.0.1s / 1.0.2 < 1.0.2g Multiple Vulnerabilities (DROWN)	Log Correlation Engine	Web Servers	3/7/2016		medium

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

medium

medium