OpenSSL - Memory Leak and Padding Vulnerabilities
Summary
DSA-3053-1: openssl - security update. Affects openssl versions < 1.0.1e-2+deb7u13. Fixed in 1.0.1e-2+deb7u13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a widely used Secure Sockets Layer (SSL) library and toolkit that provides cryptographic functions for secure communication over computer networks. It is utilized by various applications and services to establish secure connections. However, several vulnerabilities have been identified in OpenSSL, including memory leaks and padding vulnerabilities.
Vulnerability Detail
The first vulnerability, identified as CVE-2014-3513, involves a memory leak flaw in OpenSSL's parsing of the DTLS Secure Real-time Transport Protocol (SRTP) extension data. An attacker can exploit this flaw by sending specially crafted handshake messages, leading to the exhaustion of server memory.
The second vulnerability, known as CVE-2014-3566 or "POODLE", affects SSL 3.0 and its handling of padding bytes during message decryption. A man-in-the-middle attacker can decrypt a selected byte of cipher text by forcing the victim application to repeatedly send the same data over newly created SSL 3.0 connections.
The third vulnerability, CVE-2014-3567, involves a memory leak flaw in OpenSSL's handling of failed session ticket integrity checks. By sending a large number of invalid session tickets, an attacker can exhaust the server's memory.
The fourth vulnerability, CVE-2014-3568, occurs when OpenSSL is configured with the "no-ssl3" build option. Despite this configuration, servers can still accept and complete SSL 3.0 handshakes, and clients can be configured to send them.
How To Fix
Minimum fixed version
1.0.1e-2+deb7u13
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is crucial to apply the provided fixes by upgrading the OpenSSL package to the recommended versions.
Conclusion
OpenSSL is susceptible to memory leak and padding vulnerabilities, which can lead to denial-of-service scenarios and unauthorized decryption of cipher text. It is crucial to upgrade the OpenSSL package to the fixed versions (1.0.1e-2+deb7u13 for wheezy and 1.0.1j-1 for sid) to mitigate these risks. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openssl →
FAQ
CVE-2014-3513 can lead to a denial-of-service (DoS) scenario by exhausting the memory of an SSL/TLS or DTLS server.
CVE-2014-3566 allows a man-in-the-middle attacker to decrypt a selected byte of cipher text by exploiting SSL 3.0's handling of padding bytes.
CVE-2014-3567 can exhaust the memory of an SSL/TLS or DTLS server by sending a large number of invalid session tickets.
CVE-2014-3568 highlights a configuration issue where servers, despite being configured with "no-ssl3", can still accept and complete SSL 3.0 handshakes.
To fix these vulnerabilities, upgrade the OpenSSL package to the recommended fixed versions: 1.0.1e-2+deb7u13 for the stable distribution (wheezy) and 1.0.1j-1 for the unstable distribution (sid).
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
