Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.

CVE-2016-6304

statem/statem_dtls.c in the DTLS implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length, which might allow remote attackers to cause a denial of service (memory consumption) via crafted DTLS messages.

OpenSSL Security Advisory \[22 Sep 2016\] ======================================== OCSP Status Request extension unbounded memory growth (CVE-2016-6304) ===================================================================== Severity: High A malicious client can send an excessively large OCSP Status Request extension. If that client continually requests renegotiation, sending a large OCSP Status Request extension each time, then there will be unbounded memory growth on the server. This will eventually lead to a Denial Of Service attack through memory exhaustion. Servers with a default configuration are vulnerable even if they do not support OCSP. Builds using the "no-ocsp" build time option are not affected. Servers using OpenSSL versions prior to 1.0.1g are not vulnerable in a default configuration, instead only if an application explicitly enables OCSP stapling support. OpenSSL 1.1.0 users should upgrade to 1.1.0a OpenSSL 1.0.2 users should upgrade to 1.0.2i OpenSSL 1.0.1 users should upgrade to 1.0.1u This issue was reported to OpenSSL on 29th August 2016 by Shi Lei (Gear Team, Qihoo 360 Inc.). The fix was developed by Matt Caswell of the OpenSSL development team. SSL\_peek() hang on empty record (CVE-2016-6305) =============================================== Severity: Moderate OpenSSL 1.1.0 SSL/TLS will hang during a call to SSL\_peek() if the peer sends an empty record. This could be exploited by a malicious peer in a Denial Of Service attack. OpenSSL 1.1.0 users should upgrade to 1.1.0a This issue was reported to OpenSSL on 10th September 2016 by Alex Gaynor. The fix was developed by Matt Caswell of the OpenSSL development team. SWEET32 Mitigation (CVE-2016-2183) ================================== Severity: Low SWEET32 (https://sweet32.info) is an attack on older block cipher algorithms that use a block size of 64 bits. In mitigation for the SWEET32 attack DES based ciphersuites have been moved from the HIGH cipherstring group to MEDIUM in OpenSSL 1.0.1 and OpenSSL 1.0.2. OpenSSL 1.1.0 since release has had these ciphersuites disabled by default. OpenSSL 1.0.2 users should upgrade to 1.0.2i OpenSSL 1.0.1 users should upgrade to 1.0.1u This issue was reported to OpenSSL on 16th August 2016 by Karthikeyan Bhargavan and Gaetan Leurent (INRIA). The fix was developed by Rich Salz of the OpenSSL development team. OOB write in MDC2\_Update() (CVE-2016-6303) ========================================== Severity: Low An overflow can occur in MDC2\_Update() either if called directly or through the EVP\_DigestUpdate() function using MDC2. If an attacker is able to supply very large amounts of input data after a previous call to EVP\_EncryptUpdate() with a partial block then a length check can overflow resulting in a heap corruption. The amount of data needed is comparable to SIZE\_MAX which is impractical on most platforms. OpenSSL 1.0.2 users should upgrade to 1.0.2i OpenSSL 1.0.1 users should upgrade to 1.0.1u This issue was reported to OpenSSL on 11th August 2016 by Shi Lei (Gear Team, Qihoo 360 Inc.). The fix was developed by Stephen Henson of the OpenSSL development team. Malformed SHA512 ticket DoS (CVE-2016-6302) =========================================== Severity: Low If a server uses SHA512 for TLS session ticket HMAC it is vulnerable to a DoS attack where a malformed ticket will result in an OOB read which will ultimately crash. The use of SHA512 in TLS session tickets is comparatively rare as it requires a custom server callback and ticket lookup mechanism. OpenSSL 1.0.2 users should upgrade to 1.0.2i OpenSSL 1.0.1 users should upgrade to 1.0.1u This issue was reported to OpenSSL on 19th August 2016 by Shi Lei (Gear Team, Qihoo 360 Inc.). The fix was developed by Stephen Henson of the OpenSSL development team. OOB write in BN\_bn2dec() (CVE-2016-2182) ======================================== Severity: Low The function BN\_bn2dec() does not check the return value of BN\_div\_word(). This can cause an OOB write if an application uses this function with an overly large BIGNUM. This could be a problem if an overly large certificate or CRL is printed out from an untrusted source. TLS is not affected because record limits will reject an oversized certificate before it is parsed. OpenSSL 1.0.2 users should upgrade to 1.0.2i OpenSSL 1.0.1 users should upgrade to 1.0.1u This issue was reported to OpenSSL on 2nd August 2016 by Shi Lei (Gear Team, Qihoo 360 Inc.). The fix was developed by Stephen Henson of the OpenSSL development team. OOB read in TS\_OBJ\_print\_bio() (CVE-2016-2180) ============================================== Severity: Low The function TS\_OBJ\_print\_bio() misuses OBJ\_obj2txt(): the return value is the total length the OID text representation would use and not the amount of data written. This will result in OOB reads when large OIDs are presented. OpenSSL 1.0.2 users should upgrade to 1.0.2i OpenSSL 1.0.1 users should upgrade to 1.0.1u This issue was reported to OpenSSL on 21st July 2016 by Shi Lei (Gear Team, Qihoo 360 Inc.). The fix was developed by Stephen Henson of the OpenSSL development team. Pointer arithmetic undefined behaviour (CVE-2016-2177) ====================================================== Severity: Low Avoid some undefined pointer arithmetic A common idiom in the codebase is to check limits in the following manner: "p + len > limit" Where "p" points to some malloc'd data of SIZE bytes and limit == p + SIZE "len" here could be from some externally supplied data (e.g. from a TLS message). The rules of C pointer arithmetic are such that "p + len" is only well defined where len <= SIZE. Therefore the above idiom is actually undefined behaviour. For example this could cause problems if some malloc implementation provides an address for "p" such that "p + len" actually overflows for values of len that are too big and therefore p + len < limit. OpenSSL 1.0.2 users should upgrade to 1.0.2i OpenSSL 1.0.1 users should upgrade to 1.0.1u This issue was reported to OpenSSL on 4th May 2016 by Guido Vranken. The fix was developed by Matt Caswell of the OpenSSL development team. Constant time flag not preserved in DSA signing (CVE-2016-2178) =============================================================== Severity: Low Operations in the DSA signing algorithm should run in constant time in order to avoid side channel attacks. A flaw in the OpenSSL DSA implementation means that a non-constant time codepath is followed for certain operations. This has been demonstrated through a cache-timing attack to be sufficient for an attacker to recover the private DSA key. OpenSSL 1.0.2 users should upgrade to 1.0.2i OpenSSL 1.0.1 users should upgrade to 1.0.1u This issue was reported to OpenSSL on 23rd May 2016 by César Pereida (Aalto University), Billy Brumley (Tampere University of Technology), and Yuval Yarom (The University of Adelaide and NICTA). The fix was developed by César Pereida. DTLS buffered message DoS (CVE-2016-2179) ========================================= Severity: Low In a DTLS connection where handshake messages are delivered out-of-order those messages that OpenSSL is not yet ready to process will be buffered for later use. Under certain circumstances, a flaw in the logic means that those messages do not get removed from the buffer even though the handshake has been completed. An attacker could force up to approx. 15 messages to remain in the buffer when they are no longer required. These messages will be cleared when the DTLS connection is closed. The default maximum size for a message is 100k. Therefore the attacker could force an additional 1500k to be consumed per connection. By opening many simulataneous connections an attacker could cause a DoS attack through memory exhaustion. OpenSSL 1.0.2 DTLS users should upgrade to 1.0.2i OpenSSL 1.0.1 DTLS users should upgrade to 1.0.1u This issue was reported to OpenSSL on 22nd June 2016 by Quan Luo. The fix was developed by Matt Caswell of the OpenSSL development team. DTLS replay protection DoS (CVE-2016-2181) ========================================== Severity: Low A flaw in the DTLS replay attack protection mechanism means that records that arrive for future epochs update the replay protection "window" before the MAC for the record has been validated. This could be exploited by an attacker by sending a record for the next epoch (which does not have to decrypt or have a valid MAC), with a very large sequence number. This means that all subsequent legitimate packets are dropped causing a denial of service for a specific DTLS connection. OpenSSL 1.0.2 DTLS users should upgrade to 1.0.2i OpenSSL 1.0.1 DTLS users should upgrade to 1.0.1u This issue was reported to OpenSSL on 21st November 2015 by the OCAP audit team. The fix was developed by Matt Caswell of the OpenSSL development team. Certificate message OOB reads (CVE-2016-6306) ============================================= Severity: Low In OpenSSL 1.0.2 and earlier some missing message length checks can result in OOB reads of up to 2 bytes beyond an allocated buffer. There is a theoretical DoS risk but this has not been observed in practice on common platforms. The messages affected are client certificate, client certificate request and server certificate. As a result the attack can only be performed against a client or a server which enables client authentication. OpenSSL 1.1.0 is not affected. OpenSSL 1.0.2 users should upgrade to 1.0.2i OpenSSL 1.0.1 users should upgrade to 1.0.1u This issue was reported to OpenSSL on 22nd August 2016 by Shi Lei (Gear Team, Qihoo 360 Inc.). The fix was developed by Stephen Henson of the OpenSSL development team. Excessive allocation of memory in tls\_get\_message\_header() (CVE-2016-6307) ========================================================================== Severity: Low A TLS message includes 3 bytes for its length in the header for the message. This would allow for messages up to 16Mb in length. Messages of this length are excessive and OpenSSL includes a check to ensure that a peer is sending reasonably sized messages in order to avoid too much memory being consumed to service a connection. A flaw in the logic of version 1.1.0 means that memory for the message is allocated too early, prior to the excessive message length check. Due to way memory is allocated in OpenSSL this could mean an attacker could force up to 21Mb to be allocated to service a connection. This could lead to a Denial of Service through memory exhaustion. However, the excessive message length check still takes place, and this would cause the connection to immediately fail. Assuming that the application calls SSL\_free() on the failed conneciton in a timely manner then the 21Mb of allocated memory will then be immediately freed again. Therefore the excessive memory allocation will be transitory in nature. This then means that there is only a security impact if: 1) The application does not call SSL\_free() in a timely manner in the event that the connection fails or 2) The application is working in a constrained environment where there is very little free memory or 3) The attacker initiates multiple connection attempts such that there are multiple connections in a state where memory has been allocated for the connection; SSL\_free() has not yet been called; and there is insufficient memory to service the multiple requests. Except in the instance of (1) above any Denial Of Service is likely to be transitory because as soon as the connection fails the memory is subsequently freed again in the SSL\_free() call. However there is an increased risk during this period of application crashes due to the lack of memory - which would then mean a more serious Denial of Service. This issue does not affect DTLS users. OpenSSL 1.1.0 TLS users should upgrade to 1.1.0a This issue was reported to OpenSSL on 18th September 2016 by Shi Lei (Gear Team, Qihoo 360 Inc.). The fix was developed by Matt Caswell of the OpenSSL development team. Excessive allocation of memory in dtls1\_preprocess\_fragment() (CVE-2016-6308) ============================================================================= Severity: Low This issue is very similar to CVE-2016-6307. The underlying defect is different but the security analysis and impacts are the same except that it impacts DTLS. A DTLS message includes 3 bytes for its length in the header for the message. This would allow for messages up to 16Mb in length. Messages of this length are excessive and OpenSSL includes a check to ensure that a peer is sending reasonably sized messages in order to avoid too much memory being consumed to service a connection. A flaw in the logic of version 1.1.0 means that memory for the message is allocated too early, prior to the excessive message length check. Due to way memory is allocated in OpenSSL this could mean an attacker could force up to 21Mb to be allocated to service a connection. This could lead to a Denial of Service through memory exhaustion. However, the excessive message length check still takes place, and this would cause the connection to immediately fail. Assuming that the application calls SSL\_free() on the failed conneciton in a timely manner then the 21Mb of allocated memory will then be immediately freed again. Therefore the excessive memory allocation will be transitory in nature. This then means that there is only a security impact if: 1) The application does not call SSL\_free() in a timely manner in the event that the connection fails or 2) The application is working in a constrained environment where there is very little free memory or 3) The attacker initiates multiple connection attempts such that there are multiple connections in a state where memory has been allocated for the connection; SSL\_free() has not yet been called; and there is insufficient memory to service the multiple requests. Except in the instance of (1) above any Denial Of Service is likely to be transitory because as soon as the connection fails the memory is subsequently freed again in the SSL\_free() call. However there is an increased risk during this period of application crashes due to the lack of memory - which would then mean a more serious Denial of Service. This issue does not affect TLS users. OpenSSL 1.1.0 DTLS users should upgrade to 1.1.0a This issue was reported to OpenSSL on 18th September 2016 by Shi Lei (Gear Team, Qihoo 360 Inc.). The fix was developed by Matt Caswell of the OpenSSL development team. Note ==== As per our previous announcements and our Release Strategy (https://www.openssl.org/policies/releasestrat.html), support for OpenSSL version 1.0.1 will cease on 31st December 2016. No security updates for that version will be provided after that date. Users of 1.0.1 are advised to upgrade. Support for versions 0.9.8 and 1.0.0 ended on 31st December 2015. Those versions are no longer receiving security updates. References ========== URL for this Security Advisory: https://www.openssl.org/news/secadv/20160922.txt Note: the online version of the advisory may be updated with additional details over time. For details of OpenSSL severity classifications please see: https://www.openssl.org/policies/secpolicy.html

CVE-2016-6308

crypto/x509/x509_vfy.c in OpenSSL 1.0.2i allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by triggering a CRL operation.

CVE-2016-7052

The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the ability to compute the master secret in certain situations with a client secret key and server public key but not a server secret key, which makes it easier for man-in-the-middle attackers to spoof TLS servers by leveraging knowledge of the secret key for an arbitrary installed client X.509 certificate, aka the "Key Compromise Impersonation (KCI)" issue.

CVE-2015-8960

Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.

'1370146?cve=title' is not a valid bug number nor an alias to a bug.

Please press **Back** and try again.

CVE-2016-6303: Invalid Bug ID

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.

'1369383?cve=title' is not a valid bug number nor an alias to a bug.

Please press **Back** and try again.

CVE-2016-2183: Invalid Bug ID

spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data.

CVE-2016-5771: PHP: PHP 5 ChangeLog

The RSA-CRT implementation in the Cavium Software Development Kit (SDK) 2.x, when used on OCTEON II CN6xxx Hardware on Linux to support TLS with Perfect Forward Secrecy (PFS), makes it easier for remote attackers to obtain private RSA keys by conducting a Lenstra side-channel attack.

%PDF-1.5 %���� 3 0 obj <> stream xڭ<;�&�m���q��\`\[$�����hn%.�7��,9��"���>A�뛕��j��n� �7@�~���w�O6l\`�ӷ�~�O���g6�ғ�ŧo?=����/!�\_�{c����q��c��7����+��;�᷶?!�������\`��������4�}<|�\\F�1�L�W ǆW�%8�o3Xoƿ���?q���-9g�&8��'���8�p� "��O�Q�%B\]@&�k\[L����f3���v#�\[�rf��x�c\]VjO�� ³|����g�����E����3��M�"u��(����%�+u}mb!�0 ?�X�̬giC�����h�|�U��)� փ�\`�?�-y�Fq�YY���A��������"�\]��6x�92H^ql+#�2�'0�^�\`򿰴��ؾ�'g�b���\[� �H��a�H!� j��2��sa��>Q���u^$�Nƕ n��cz.�"�����4e-�˪U��#��'u�a2��\*�e��d���a������kf�r����U�cAI6�� �v �vqzڥ�S�C�IX��U��O��vK��a�\[�h��.T�#h-���+͉�\*ca�,\]��X��ʗ��gE����j�N�E!���=?�߸\[�1�N�����E{Y�8ģ�jb��AE�mhH5�IM�L�e�kB�X�q�}��X��E��v�1�m�ߒVeoJAy/��v-�Z���AiL/���ylJ\[E�O�:��膶)���u��7j��a �3�"�S�?�!M�)� ��5��e��V��c4%FU���l�X؊G���Y��isa����nu�ʓ�p��j�9��;^���Pzw˓�\\�ą����7kVk�A(Ӥ�Y)�>h�"�����������@��Z��a\_ j�ۧ�/:塽�"�uj߿N�p����c\[��0��BH��#aS���mj�$���O��m �u)-��R��\*�4Q��K ʘ�B�o�\]꿖��.&-��A��BhP�\*��M���|���!�F4M �r�Zv��9j�\*1�\[���#n)�n�\]���J3�m�kcv��\`�5��򞔷i^�{^�vV|䇢��� �8�)NX���/��d\]�\[ ���6���� }�� ��!���z.��n��O4,^��#�nT���jĺgV��\*D�����Y�f�����i7�:��4�C;W�}��� �3��N�2P�@w��� M7�ƚ �t��?k�8�@�&^�({�9d��A2���I� �'��!~�$��I��1g��R�T�<͟�5�3Y7�i���,�� ��Y�3�/׸qԗ�n��\`Ѳ �+Ԣ{#$ؐ$E|׿�'����|"���9��2ٜ|�T��\[&���,q��\`r�\`��� �$c\`��� S�܂���Ea2�8\[�j��Zۥ���3�����EV yW��؏�>�2���d�g������6O�wx�W,T�����-s����~��O��Υ���&&��1�~�8C���-�e�EP)�H���������j��Q��D��S��n��u�W�7l�V��հ�EN�@K����\[��B%ANyW�^�H������~B�����HTUh̥�b)n��y�?g��D✸������{��f�S�����p���P�x��g���#�͹��pMCV��������ź��$6#N���(#��y��b��־�H j�����g�(��l��sdtְ�~�-���$-���Kw��)�s�-����+��2o�'6�!h�;�u�uq���&|�9�)b���a� \\bQ\\Ao��F΋7���ClJ�r�ȘĢt��?s�� ��{:�9�����|9�<؟��� ��x8�9ѵ/������\\�H�E1�Q\`�ք5 \*�-9\*˪0ȩ �U�r�"�e�jJ~�x\`\`k��g�� e�8��h���Ѡ\*{�� �\*2D+ča'z��P�\*FU�z5�&?Q\`�d~��G�����v���ӌp\]pڭ�c;;,d�۔�y�pj���RFNr��̏h+y��iwΦQ)��ԗN���ᴔ\[�D1ڥ�d��ܴ����^��.�&pW"v9���zuPrF�. �����\_�yN��|I6qh���2c�mT� M9)��I ��Ce�|��:��Hc����4 �^: #wT){I��a����k�޵I�K����疧k9s̝���� �U�u���}�N|,��-��x��UaQ���B,j�F����z{��{�%��C�U#Dg���X��ql��G@\\5�I����(�57\*"�R28h-a�md��&A��Q;��뀆 ��j�a�TdT�{��\_����BЩ�f\[Y�f!$�mYqU�/&�\*o��q, �I�,1����6��s@\`OHQ�='E�b�.�3��%\*؋�ul�Ut���fn1�=�25 \*��/�2\`}���˸��T�e9�Uy3�p�\`��GD��l?��¢U��8��y���V��4�K��DZ�Z�W\`��pF�RS�MrԳ�wz�r�I�G���?�F��t���\\

CVE-2015-5738

Unspecified vulnerability in Oracle MySQL 5.5.45 and earlier and 5.6.26 and earlier allows local users to affect confidentiality, integrity, and availability via vectors related to Server: Option.

CVE-2016-3471: Oracle Critical Patch Update - July 2016

The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.

%PDF-1.5 %���� 105 0 obj << /Length 5564 /Filter /FlateDecode >> stream xڥ<�r�F��� ���5!�q��Ė��:q��Lj+�DB�$�@ۚڏ�sm4@@R��R���9}�����n�/��������.�&�"H�<4���v�^����O������OƄ����ڤ����H���+�����?~�v�填���-W~,��n���.\`�?��kı�E�b�^nb^��uš\[\_W���+l4\]��Ǳ����0�b?\[���3�l��l����m�˲)�m�+�ͧ0�;���g3^�Ô�%���<�L���� OQ���e�?���!��3y<}���Æa\\��&f��U��j������İ׶�V��/\_p���+�I�Ϥ0e�eY�Snv�;2�?���}�}#ϼ4�QH�y��j��sy\]�H\`��:�w���pl�8\[�,�|�Ɂ�֡�$��Vg4�^����E�4���׫�W��It�p��3a>5����\]}���x���}A� a�{7#��ԝ:���K�š� ���\*�剱����X4�~ �@SA�\`���j\[�j+=>�-�G$���$d\\^����|@r��W+8�S�55l�\*���,N� ���i�)x�n ?���+N8�Â����!PM u�(��L���돯Vq������"�%��a+�Erl��W�� h62�����'�����\[�Ȱg�2�����˚+jh�ն\`y�u�M&����X��KW����'�\[���fM������R����R�~4\\nKl�I�JV��w� �ǉ�\[ʎ���A\`?�A���:���/�@0�������� ����\`K\\a��~'�v���O��P�h�V懊3�F{4�Û���'2/O�l��a��Q1L��ҳ��$�"�UMN��.�}ef�G���m\[9�0L�|T�d;X�p$\`\[J~�y2G�����U���Dq$��OV1p�h�\[�"ٖܲՎ�T�S��I �?���I�LDC��=U��N��+�0F�Q�:3Q\[�n�,\*�V���?��C���z�n|' �{���j���ywL�X�ޢ��>w~�Rid��Y! q��Zj����L�'s/�>l �a\\5��@�/1�!�r�UO}�过��(��1#��ʒ����(GY�K� =��\_��M���@8����L�W�مw��IxiD�V6���yA|�^;�2���,�Ë!��a����T)+�nmE�Ͷ��+���i�Ν�s�M���7er� �s���b\[&J�-!�. �E�)ض@o� ��M"{emWl��Ww��g��FE��v�}��̝̎����EP��͖�v�a���x�Ú\`b~L��������Q� ʢc��ڒ+�R�ٽ��/� �{��=�u%9B@3U�$�\`����\]��7��M��>�Eh�^�ڈ����>��%Y�����Nz=���f\*��ǿ%t��#�����L���\[\[�Gr �:�d�ڠ2�L���Ӯ��d����B�7s���ٔ'��Q���Hvs!h��k�0̢2�T� =����)��s�~l(�'��@������"x���쇯��Ͷ}Z�Tł�F��)�nW�FZ �\`��H-��;����ct΃{v��38�н�~�s��3�ざ�@"�ٻb

Tag

#ssl