The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

computer threat alert CVE-2016-2179

OpenSSL: denial of service via DTLS Reassembly

Synthesis of the vulnerability

An attacker can send DTLS packets in the wrong order with missing packets to an application compiled with OpenSSL, in order to trigger a denial of service.
Severity of this bulletin: 2/4.
Creation date: 24/08/2016.
Références of this threat: 1996096, 1999395, 1999474, 1999478, 1999479, 1999488, 1999532, 2000095, 2003480, 2003620, 2003673, bulletinapr2017, bulletinjul2016, bulletinjul2018, CERTFR-2016-AVI-333, cisco-sa-20160927-openssl, cpuapr2017, cpujan2018, cpuoct2017, CVE-2016-2179, DLA-637-1, DSA-3673-1, DSA-3673-2, FEDORA-2016-97454404fe, FEDORA-2016-a555159613, FG-IR-16-047, FG-IR-16-048, FG-IR-17-127, FreeBSD-SA-16:26.openssl, HPESBHF03856, JSA10759, openSUSE-SU-2016:2391-1, openSUSE-SU-2016:2407-1, openSUSE-SU-2016:2537-1, openSUSE-SU-2018:0458-1, RHSA-2016:1940-01, SA132, SB10215, SOL23512141, SP-CAAAPUE, SPL-129207, SSA:2016-266-01, SUSE-SU-2016:2387-1, SUSE-SU-2016:2394-1, SUSE-SU-2016:2458-1, SUSE-SU-2016:2468-1, SUSE-SU-2016:2469-1, TNS-2016-16, USN-3087-1, USN-3087-2, VIGILANCE-VUL-20457.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

The OpenSSL library implements DTLS (Datagram Transport Layer Security, for example on UDP).

DTLS packets can be in the wrong order. OpenSSL has to keep them in memory, in order to reassemble them. However, in two cases, message queues are not cleared.

An attacker can therefore send DTLS packets in the wrong order with missing packets to an application compiled with OpenSSL, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

This weakness announce impacts software or systems such as Blue Coat CAS, ProxyAV, ProxySG par Blue Coat, SGOS by Blue Coat, Cisco ASR, Cisco Aironet, Cisco ATA, Cisco AnyConnect Secure Mobility Client, Cisco ACE, ASA, AsyncOS, Cisco Catalyst, Cisco Content SMA, Cisco ESA, IOS by Cisco, IOS XE Cisco, IOS XR Cisco, Cisco IPS, Nexus by Cisco, NX-OS, Cisco Prime Access Registrar, Prime Collaboration Assurance, Cisco Prime DCNM, Prime Infrastructure, Cisco Prime LMS, Cisco Router, Secure ACS, Cisco CUCM, Cisco Manager Attendant Console, Cisco Unified CCX, Cisco IP Phone, Cisco MeetingPlace, Cisco Wireless IP Phone, Cisco WSA, Cisco Wireless Controller, Debian, BIG-IP Hardware, TMOS, Fedora, FileZilla Server, FortiAnalyzer, FortiAnalyzer Virtual Appliance, FortiGate, FortiGate Virtual Appliance, FortiOS, FreeBSD, FreeRADIUS, hMailServer, HP Switch, AIX, QRadar SIEM, Tivoli Storage Manager, Tivoli Workload Scheduler, Juniper J-Series, Junos OS, Junos Space, NSM Central Manager, NSMXpress, McAfee Email Gateway, NetScreen Firewall, ScreenOS, Nodejs Core, OpenSSL, openSUSE, openSUSE Leap, Oracle Communications, Oracle Directory Server, Oracle Directory Services Plus, Oracle Fusion Middleware, Oracle GlassFish Server, Oracle Identity Management, Oracle iPlanet Web Server, Solaris, Tuxedo, WebLogic, Oracle Web Tier, pfSense, RHEL, SAS Add-in for Microsoft Office, SAS Analytics Pro, Base SAS Software, SAS Enterprise BI Server, SAS Enterprise Guide, SAS Management Console, SAS OLAP Server, SAS SAS/ACCESS, SAS SAS/AF, SAS SAS/CONNECT, SAS SAS/EIS, SAS SAS/ETS, SAS SAS/FSP, SAS SAS/GRAPH, SAS SAS/IML, SAS SAS/OR, SAS SAS/STAT, SAS SAS/Web Report Studio, Slackware, Splunk Enterprise, stunnel, SUSE Linux Enterprise Desktop, SLES, Synology DS***, Synology RS***, Nessus, Ubuntu, WinSCP.

Our Vigil@nce team determined that the severity of this vulnerability alert is medium.

The trust level is of type confirmed by the editor, with an origin of internet client.

An attacker with a expert ability can exploit this computer threat announce.

Solutions for this threat

OpenSSL: version 1.0.2i.
The version 1.0.2i is fixed:
  https://www.openssl.org/source/openssl-1.0.2i.tar.gz

OpenSSL: version 1.0.1u.
The version 1.0.1u is fixed:
  https://www.openssl.org/source/openssl-1.0.1u.tar.gz

OpenSSL: version 1.1.0a.
The version 1.1.0a is fixed:
  https://www.openssl.org/source/openssl-1.1.0a.tar.gz

OpenSSL: patch for DTLS Reassembly.
A patch is indicated in information sources.

AIX: patch for OpenSSL.
A patch is available:
  https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=aixbp
  openssl-1.0.1.517.tar.Z
  openssl-1.0.2.1000.tar.Z
  openssl-20.13.101.500.tar.Z
  openssl-20.13.102.1000.tar.Z

Blue Coat: solution for OpenSSL.
The solution is indicated in information sources.

Cisco: solution for OpenSSL.
The solution is indicated in information sources.

Comware: solution for OpenSSL.
The solution is indicated in information sources.

Debian 7: new openssl packages.
New packages are available:
  Debian 7: openssl 1.0.1t-1+deb7u1

Debian: new openssl packages.
New packages are available:
  Debian 8: openssl 1.0.1t-1+deb8u5

F5 BIG-IP: fixed versions for OpenSSL.
Fixed versions are indicated in information sources.

Fedora: new openssl packages.
New packages are available:
  Fedora 23: openssl 1.0.2j-1.fc23
  Fedora 24: openssl 1.0.2j-1.fc24

FileZilla Server: version 0.9.59.
The version 0.9.59 is fixed:
  http://sourceforge.net/projects/filezilla/files/FileZilla%20Server/0.9.59/FileZilla_Server-0_9_59.exe/download

Fortinet FortiAnalyzer: version 5.4.2.
The version 5.4.2 is fixed.

Fortinet FortiOS: version 5.6.0.
The version 5.6.0 is fixed.

FreeBSD: patch for openssl.
A patch is indicated in information sources.

FreeRADIUS: version 3.0.12.
The version 3.0.12 is fixed:
  ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-3.0.12.tar.bz2

FreeRADIUS: version 3.0.13.
The version 3.0.13 is fixed:
  ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-3.0.13.tar.bz2

hMailServer: version 5.6.6.
The version 5.6.6 is fixed:
  https://www.hmailserver.com/download

IBM Cognos Analytics: solution.
The solution is indicated in information sources.

IBM QRadar SIEM: version 7.2.8 Patch 4.
The version 7.2.8 Patch 4 is fixed:
  https://www-945.ibm.com/support/fixcentral/swg/downloadFixes?product=ibm/Other+software/IBM+Security+QRadar+SIEM&release=7.2.0&platform=Linux&function=fixId&fixids=7.2.8-QRADAR-QRSIEM-20170224202650&includeRequisites=1&includeSupersedes=0&downloadMethod=http&source=fc

IBM Spectrum Protect: versions 7.1.6.5 and 8.1.0.2.
Versions 7.1.6.5 and 8.1.0.2 are fixed:
  Version 7.1.6.5 : http://www-01.ibm.com/support/docview.wss?uid=swg24042496
  Version 8.1.0.2: http://www.ibm.com/support/docview.wss?uid=swg24043351

IBM Tivoli Workload Scheduler: patch for OpenSSL.
A patch reference is provided in the information sources for each supported version of Workload Scheduler.

Juniper: solution for OpenSSL.
The solution is indicated in information sources.

McAfee Email Gateway: patch for OpenSSL.
A patch is indicated in information sources.

Node.js: versions 6.7.0, 4.6.0, 0.12.16, 0.10.47.
Versions 6.7.0, 4.6.0, 0.12.16, 0.10.47 are fixed:
  https://nodejs.org/en/download/

openSUSE Leap 42.1: new compat-openssl098 packages.
New packages are available:
  openSUSE Leap 42.1: compat-openssl098 0.9.8j-15.1

openSUSE Leap: new openssl-steam packages.
New packages are available:
  openSUSE Leap 42.3: libopenssl1_0_0-steam 1.0.2k-4.3.1

openSUSE: new openssl packages.
New packages are available:
  openSUSE 13.2: openssl 1.0.1k-2.39.1
  openSUSE Leap 42.1: openssl 1.0.1i-18.1

Oracle Communications: CPU of October 2017.
A Critical Patch Update is available.

Oracle Fusion Middleware: CPU of April 2017.
A Critical Patch Update is available:
  https://support.oracle.com/rs?type=doc&id=2228898.1

Oracle Fusion Middleware: CPU of January 2018.
A Critical Patch Update is available:
  https://support.oracle.com/rs?type=doc&id=2325393.1

Oracle Solaris: patch for third party software of April 2017 v1.
A patch is available:
  https://support.oracle.com/rs?type=doc&id=1448883.1

Oracle Solaris: patch for third party software of July 2018 v2.
A patch is available:
  https://support.oracle.com/rs?type=doc&id=1448883.1

pfSense: version 2.3.2-p1.
The version 2.3.2-p1 is fixed:
  https://www.pfsense.org/download/

RHEL: new openssl packages.
New packages are available:
  RHEL 6: openssl 1.0.1e-48.el6_8.3
  RHEL 7: openssl 1.0.1e-51.el7_2.7

SAS 9.4: patch for OpenSSL, Apache.
A patch is available:
  http://support.sas.com/kb/59371.html

Slackware: new openssl packages.
New packages are available:
  Slackware 14.0: openssl 1.0.1u-*-1_slack14.0
  Slackware 14.1: openssl 1.0.1u-*-1_slack14.1
  Slackware 14.2: openssl 1.0.2i-*-1_slack14.2

Snare Enterprise Agent for MSSQL: version 1.4.9.
The version 1.4.9 is fixed:
  https://snaresupport.intersectalliance.com/

Snare Enterprise Agent for Windows: version 4.3.8.
The version 4.3.8 is fixed:
  https://snaresupport.intersectalliance.com/

Solaris: patch for third party software of July 2016 v4.
A patch is available:
  https://support.oracle.com/rs?type=doc&id=1448883.1

Splunk Enterprise: versions 6.0.13, 6.1.12, 6.2.12, 6.3.8, 6.4.5 and 6.5.1.
Versions 6.0.13, 6.1.12, 6.2.12, 6.3.8, 6.4.5 and 6.5.1 are fixed:
  http://www.splunk.com/

stunnel: version 5.36.
The version 5.36 is fixed:
  https://www.stunnel.org/downloads/stunnel-5.36-installer.exe
  https://www.stunnel.org/downloads/stunnel-5.36.tar.gz

SUSE LE 11: new openssl1 packages.
New packages are available:
  SUSE LE 11: openssl1 1.0.1g-0.52.1

SUSE LE 11: new openssl packages.
New packages are available:
  SUSE LE 11 SP2: openssl 0.9.8j-0.102.2
  SUSE LE 11 SP3: openssl 0.9.8j-0.102.2
  SUSE LE 11 SP4: openssl 0.9.8j-0.102.2

SUSE LE 12: new compat-openssl098 packages.
New packages are available:
  SUSE LE 12 RTM: compat-openssl098 0.9.8j-102.1
  SUSE LE 12 SP1: compat-openssl098 0.9.8j-102.1

SUSE LE 12: new openssl packages.
New packages are available:
  SUSE LE 12 RTM: openssl 1.0.1i-27.21.1
  SUSE LE 12 SP1: openssl 1.0.1i-52.1

Synology RS/DS: version 6.0.2-8451-2.
The version 6.0.2-8451-2 is fixed:
  https://www.synology.com/

Tenable Nessus: version 6.9.0.
The version 6.9.0 is fixed:
  http://www.tenable.com/

Ubuntu: new openssl packages.
New packages are available:
  Ubuntu 16.04 LTS: libssl1.0.0 1.0.2g-1ubuntu4.5
  Ubuntu 14.04 LTS: libssl1.0.0 1.0.1f-1ubuntu2.21
  Ubuntu 12.04 LTS: libssl1.0.0 1.0.1-4ubuntu5.38

Wind River Linux: solution for OpenSSL.
The solution is indicated in information sources.

WinSCP: version 5.9.3.
The version 5.9.3 is fixed:
  https://winscp.net/
Full Vigil@nce bulletin... (Free trial)

Computer vulnerabilities tracking service

Vigil@nce provides a software vulnerabilities bulletin. The technology watch team tracks security threats targeting the computer system. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications. The Vigil@nce vulnerability database contains several thousand vulnerabilities.