The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Vulnerability of OpenSSL: NULL pointer dereference via X509_to_X509_REQ

Synthesis of the vulnerability

An attacker can force a NULL pointer to be dereferenced in X509_to_X509_REQ() of OpenSSL, in order to trigger a denial of service.
Severity of this computer vulnerability: 2/4.
Creation date: 09/03/2015.
Références of this announce: 1701334, 1964410, 55767, 9010031, c04679334, CERTFR-2015-AVI-089, CERTFR-2015-AVI-117, CERTFR-2015-AVI-146, CERTFR-2015-AVI-177, CERTFR-2015-AVI-259, CERTFR-2016-AVI-303, cisco-sa-20150320-openssl, cisco-sa-20150408-ntpd, cpuoct2017, CTX216642, CVE-2015-0288, DSA-3197-1, DSA-3197-2, FEDORA-2015-4300, FEDORA-2015-4303, FEDORA-2015-6855, FreeBSD-SA-15:06.openssl, HPSBUX03334, JSA10680, MDVSA-2015:062, MDVSA-2015:063, NetBSD-SA2015-007, NTAP-20150323-0002, openSUSE-SU-2015:0554-1, openSUSE-SU-2015:1277-1, openSUSE-SU-2015:2243-1, openSUSE-SU-2016:0640-1, RHSA-2015:0715-01, RHSA-2015:0716-01, RHSA-2015:0752-01, RHSA-2015:0800-01, SA40001, SB10110, SOL16301, SOL16302, SOL16317, SOL16319, SOL16320, SOL16321, SOL16323, SPL-98351, SPL-98531, SSA:2015-111-09, SSRT102000, SUSE-SU-2015:0541-1, SUSE-SU-2015:0553-1, SUSE-SU-2015:0553-2, SUSE-SU-2015:0578-1, TNS-2015-04, USN-2537-1, VIGILANCE-VUL-16342.

Description of the vulnerability

The OpenSSL product processes X.509 certificates.

However, the X509_to_X509_REQ() function does not check if a pointer is NULL, before using it.

An attacker can therefore force a NULL pointer to be dereferenced in X509_to_X509_REQ() of OpenSSL, in order to trigger a denial of service.
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

This security alert impacts software or systems such as Arkoon FAST360, ProxySG par Blue Coat, SGOS by Blue Coat, FabricOS, Brocade Network Advisor, Cisco ASR, AnyConnect VPN Client, Cisco ACE, ASA, AsyncOS, Cisco CSS, Cisco ESA, IOS XE Cisco, Cisco IPS, IronPort Email, IronPort Web, Nexus by Cisco, NX-OS, Prime Infrastructure, Cisco PRSM, Cisco Router, Secure ACS, Cisco CUCM, Cisco Unified CCX, Cisco IP Phone, Cisco MeetingPlace, Cisco Wireless IP Phone, WebNS, Cisco WSA, Debian, BIG-IP Hardware, TMOS, Fedora, FreeBSD, hMailServer, HP-UX, AIX, IRAD, Tivoli Workload Scheduler, Juniper J-Series, Junos OS, Junos Space, Junos Space Network Management Platform, NSM Central Manager, NSMXpress, Juniper SBR, McAfee Email Gateway, ePO, McAfee NTBA, McAfee NGFW, VirusScan, McAfee Web Gateway, Data ONTAP 7-Mode, NetBSD, NetScreen Firewall, ScreenOS, OpenBSD, OpenSSL, openSUSE, openSUSE Leap, Oracle Communications, Solaris, pfSense, RHEL, Base SAS Software, SAS SAS/CONNECT, Slackware, Splunk Enterprise, Stonesoft NGFW/VPN, SUSE Linux Enterprise Desktop, SLES, Nessus, Ubuntu, Unix (platform) ~ not comprehensive, WinSCP.

Our Vigil@nce team determined that the severity of this security weakness is medium.

The trust level is of type confirmed by the editor, with an origin of document.

An attacker with a expert ability can exploit this security announce.

Solutions for this threat

OpenSSL: version 1.0.2a.
The version 1.0.2a is fixed:
  https://www.openssl.org/

OpenSSL: version 1.0.1m.
The version 1.0.1m is fixed:
  https://www.openssl.org/

OpenSSL: version 1.0.0r.
The version 1.0.0r is fixed:
  https://www.openssl.org/

OpenSSL: version 0.9.8zf.
The version 0.9.8zf is fixed:
  https://www.openssl.org/

OpenSSL: patch for X509_to_X509_REQ.
A patch is available in information sources.

Arkoon Firewall FAST360: versions 5.0/34 and 6.0/8.
Versions 5.0/34 and 6.0/8 are fixed:
  http://www.arkoon.net/

Blue Coat ProxySG: version 6.2.16.4.
The version 6.2.16.4 is fixed.

Blue Coat ProxySG: version 6.5.7.5.
The version 6.5.7.5 is fixed.

Brocade: solution for OpenSSL (12/05/2015).
The solution is indicated in information sources.

Cisco: solution for OpenSSL.
The solution is indicated in information sources.

Citrix NetScaler: fixed versions for LOM Firmware.
Fixed versions are indicated in information sources.

Citrix NetScaler Platform IPMI LOM: solution.
The solution is indicated in information sources.

Debian: new openssl packages.
New packages are available:
  Debian 7: openssl 1.0.1e-2+deb7u16

F5 BIG-IP: solution for OpenSSL.
The solution is indicated in information sources.

Fedora 21: new mingw-openssl packages.
New packages are available:
  Fedora 21: mingw-openssl 1.0.2a-1.fc21

Fedora: new openssl packages (23/03/2015).
New packages are available:
  Fedora 20: openssl 1.0.1e-42.fc20
  Fedora 21: openssl 1.0.1k-6.fc21

FreeBSD: patch for OpenSSL.
A patch is available:
FreeBSD 8.4, 9.3:
  https://security.FreeBSD.org/patches/SA-15:06/openssl-0.9.8.patch
  https://security.FreeBSD.org/patches/SA-15:06/openssl-0.9.8-errata.patch
FreeBSD 10.1:
  fetch https://security.FreeBSD.org/patches/SA-15:06/openssl-1.0.1.patch
  fetch https://security.FreeBSD.org/patches/SA-15:06/openssl-1.0.1-errata.patch

hMailServer: version 5.6.2.
The version 5.6.2 is fixed:
  https://www.hmailserver.com/download

HP-UX: fixed versions for OpenSSL.
Fixed versions are indicated in information sources.

IBM AIX: patch for OpenSSL.
A patch is available:
  ftp://aix.software.ibm.com/aix/efixes/security/openssl_fix13.tar

IBM Rational Application Developer: solution for OpenSSL.
The solution is indicated in information sources.

IBM Tivoli Workload Scheduler Application: solution for OpenSSL.
The solution is indicated in information sources.

Juniper: fixed versions for OpenSSL-19/03/2015.
Fixed versions are indicated in information sources.

LibreSSL: version 2.1.6.
The version 2.1.6 is fixed:
  http://www.libressl.org/

Mandriva BS1: new openssl packages.
New packages are available:
  Mandriva BS1: openssl 1.0.0r-1.mbs1

Mandriva BS2: new openssl packages.
New packages are available:
  Mandriva BS2: openssl 1.0.1m-1.mbs2

McAfee: solution for OpenSSL.
The solution is indicated in information sources.

Nessus: version 5.2.9.
The version 5.2.9 is fixed:
  http://www.tenable.com/

Nessus: version 6.3.4.
The version 6.3.4 is fixed:
  http://www.tenable.com/

NetApp Data ONTAP: patch for OpenSSL 03/2015.
A patch is available:
  Data ONTAP Edge: http://mysupport.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=899856
  Data ONTAP operating in 7-Mode: http://mysupport.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=899855
  Data ONTAP SMI-S Agent: http://mysupport.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=899852

NetBSD: patch for OpenSSL (20/08/2015).
A patch is available in information sources.

OpenBSD: patch for OpenSSL.
A patch is available:
  http://ftp.openbsd.org/pub/OpenBSD/patches/5.5/common/024_openssl.patch.sig
  http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/020_openssl.patch.sig

openSUSE 13.2: new libressl packages.
New packages are available:
  openSUSE 13.2: libressl 2.2.1-2.3.1

openSUSE: new libopenssl0_9_8 packages.
New packages are available:
  openSUSE 13.2: libopenssl0_9_8 0.9.8zh-9.3.1
  openSUSE Leap 42.1: libopenssl0_9_8 0.9.8zh-14.1

openSUSE: new mysql-community-server packages.
New packages are available:
  openSUSE 13.1: mysql-community-server 5.6.27-7.13.1
  openSUSE 13.2: mysql-community-server 5.6.27-2.12.1
  openSUSE Leap 42.1: mysql-community-server 5.6.27-8.1

openSUSE: new openssl packages.
New packages are available:
  openSUSE 13.1: openssl 1.0.1k-11.68.1
  openSUSE 13.2: openssl 1.0.1k-2.20.1

Oracle Communications: CPU of October 2017.
A Critical Patch Update is available.

pfSense: version 2.2.2.
The version 2.2.2 is fixed:
  https://pfsense.org/products/

Red Hat Storage Server 2.1: new openssl packages.
New packages are available:
  RHEL 6: openssl 1.0.1e-30.el6_6.7

RHEL 5: new openssl packages.
New packages are available:
  RHEL 5: openssl 0.9.8e-33.el5_11

RHEL: new openssl packages.
New packages are available:
  RHEL 6: openssl 1.0.1e-30.el6_6.7
  RHEL 7: openssl 1.0.1e-42.el7_1.4

SAS: solution for OpenSSL.
The solution is indicated in information sources.

Slackware: new openssl packages.
New packages are available:
  Slackware 13.0: openssl 0.9.8zf-*-1_slack13.0
  Slackware 13.1: openssl 0.9.8zf-*-1_slack13.1
  Slackware 13.37: openssl 0.9.8zf-*-1_slack13.37
  Slackware 14.0: openssl 1.0.1m-*-1_slack14.0
  Slackware 14.1: openssl 1.0.1m-*-1_slack14.1

Snare Enterprise Agent for MSSQL: version 1.3.4.
The version 1.3.4 is fixed:
  https://snaresupport.intersectalliance.com/

Snare Enterprise Agent for Windows: version 4.2.12.
The version 4.2.12 is fixed:
  https://snaresupport.intersectalliance.com/

Solaris: patch for OpenSSL.
A patch is available:
  https://support.oracle.com/rs?type=doc&id=1448883.1

Splunk Enterprise: version 6.2.3.
The version 6.2.3 is fixed:
  http://www.splunk.com/

Splunk Enterprise: versions 5.0.13, 6.0.9 and 6.1.8.
Versions 5.0.13, 6.0.9 and 6.1.8 are fixed:
  http://www.splunk.com/

SUSE LE 12: new openssl packages.
New packages are available:
  SUSE LE 12: openssl 1.0.1i-20.1

Ubuntu: new libssl packages.
New packages are available:
  Ubuntu 14.10: libssl1.0.0 1.0.1f-1ubuntu9.4
  Ubuntu 14.04 LTS: libssl1.0.0 1.0.1f-1ubuntu2.11
  Ubuntu 12.04 LTS: libssl1.0.0 1.0.1-4ubuntu5.25
  Ubuntu 10.04 LTS: libssl0.9.8 0.9.8k-7ubuntu8.27

WinSCP: version 5.7.1.
The version 5.7.1 is fixed:
  http://winscp.net/
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

Computer vulnerabilities tracking service

Vigil@nce provides a software vulnerability announce. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications.