The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a vigilance database and tools to fix them.

Vulnerability of OpenSSL: memory corruption via BN_bn2dec

Synthesis of the vulnerability 

An attacker can generate a memory corruption via BN_bn2dec() of OpenSSL, in order to trigger a denial of service, and possibly to run code.
Vulnerable products: Blue Coat CAS, ProxyAV, ProxySG par Blue Coat, SGOS by Blue Coat, Cisco ASR, Cisco Aironet, Cisco ATA, Cisco AnyConnect Secure Mobility Client, Cisco ACE, ASA, AsyncOS, Cisco Catalyst, Cisco Content SMA, Cisco ESA, IOS by Cisco, IOS XE Cisco, IOS XR Cisco, Cisco IPS, Nexus by Cisco, NX-OS, Cisco Prime Access Registrar, Prime Collaboration Assurance, Cisco Prime DCNM, Prime Infrastructure, Cisco Prime LMS, Cisco Router, Secure ACS, Cisco CUCM, Cisco Manager Attendant Console, Cisco Unified CCX, Cisco IP Phone, Cisco MeetingPlace, Cisco Wireless IP Phone, Cisco WSA, Cisco Wireless Controller, Debian, BIG-IP Hardware, TMOS, Fedora, FileZilla Server, FortiAnalyzer, FortiAnalyzer Virtual Appliance, FortiGate, FortiGate Virtual Appliance, FortiOS, FreeBSD, FreeRADIUS, Android OS, hMailServer, HP Switch, AIX, Db2 UDB, QRadar SIEM, Tivoli Storage Manager, Tivoli Workload Scheduler, WebSphere MQ, Juniper J-Series, Junos OS, Junos Space, NSM Central Manager, NSMXpress, McAfee Email Gateway, ePO, NetScreen Firewall, ScreenOS, Nodejs Core, OpenSSL, openSUSE, openSUSE Leap, Oracle Communications, Oracle Directory Server, Oracle Directory Services Plus, Oracle Fusion Middleware, Oracle GlassFish Server, Oracle Identity Management, Oracle iPlanet Web Server, Solaris, Tuxedo, WebLogic, Oracle Web Tier, pfSense, Pulse Connect Secure, Pulse Secure Client, Pulse Secure SBR, RHEL, SAS Add-in for Microsoft Office, SAS Analytics Pro, Base SAS Software, SAS BI Server, SAS Enterprise Guide, SAS Management Console, SAS OLAP Server, SAS SAS/ACCESS, SAS SAS/AF, SAS SAS/CONNECT, SAS SAS/EIS, SAS SAS/ETS, SAS SAS/FSP, SAS SAS/GRAPH, SAS SAS/IML, SAS SAS/OR, SAS SAS/STAT, SAS SAS/Web Report Studio, Slackware, Splunk Enterprise, stunnel, SUSE Linux Enterprise Desktop, SLES, Synology DS***, Synology RS***, Nessus, Ubuntu, WinSCP.
Severity of this weakness: 2/4.
Creation date: 24/08/2016.
Références of this bulletin: 1996096, 1999395, 1999421, 1999474, 1999478, 1999479, 1999488, 1999532, 2000095, 2000209, 2002870, 2003480, 2003620, 2003673, 2008828, bulletinapr2017, bulletinjul2016, CERTFR-2016-AVI-333, cisco-sa-20160927-openssl, cpuapr2017, cpujan2018, cpuoct2017, CVE-2016-2182, DLA-637-1, DSA-3673-1, DSA-3673-2, FEDORA-2016-97454404fe, FEDORA-2016-a555159613, FG-IR-16-047, FG-IR-16-048, FG-IR-17-127, FreeBSD-SA-16:26.openssl, HPESBHF03856, JSA10759, K01276005, openSUSE-SU-2016:2391-1, openSUSE-SU-2016:2407-1, openSUSE-SU-2016:2537-1, openSUSE-SU-2018:0458-1, RHSA-2016:1940-01, SA132, SA40312, SB10171, SB10215, SOL01276005, SP-CAAAPUE, SPL-129207, SSA:2016-266-01, SUSE-SU-2016:2387-1, SUSE-SU-2016:2394-1, SUSE-SU-2016:2458-1, SUSE-SU-2016:2468-1, SUSE-SU-2016:2469-1, TNS-2016-16, USN-3087-1, USN-3087-2, VIGILANCE-VUL-20460.

Description of the vulnerability 

The OpenSSL library works on large numbers to perform operations such are RSA.

The BN_bn2dec() function converts a large number to its decimal representation. However, a special number forces BN_div_word() to return a limit value, then data are written after the end of the memory area.

An attacker can therefore generate a memory corruption via BN_bn2dec() of OpenSSL, in order to trigger a denial of service, and possibly to run code.
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

This vulnerability alert impacts software or systems such as Blue Coat CAS, ProxyAV, ProxySG par Blue Coat, SGOS by Blue Coat, Cisco ASR, Cisco Aironet, Cisco ATA, Cisco AnyConnect Secure Mobility Client, Cisco ACE, ASA, AsyncOS, Cisco Catalyst, Cisco Content SMA, Cisco ESA, IOS by Cisco, IOS XE Cisco, IOS XR Cisco, Cisco IPS, Nexus by Cisco, NX-OS, Cisco Prime Access Registrar, Prime Collaboration Assurance, Cisco Prime DCNM, Prime Infrastructure, Cisco Prime LMS, Cisco Router, Secure ACS, Cisco CUCM, Cisco Manager Attendant Console, Cisco Unified CCX, Cisco IP Phone, Cisco MeetingPlace, Cisco Wireless IP Phone, Cisco WSA, Cisco Wireless Controller, Debian, BIG-IP Hardware, TMOS, Fedora, FileZilla Server, FortiAnalyzer, FortiAnalyzer Virtual Appliance, FortiGate, FortiGate Virtual Appliance, FortiOS, FreeBSD, FreeRADIUS, Android OS, hMailServer, HP Switch, AIX, Db2 UDB, QRadar SIEM, Tivoli Storage Manager, Tivoli Workload Scheduler, WebSphere MQ, Juniper J-Series, Junos OS, Junos Space, NSM Central Manager, NSMXpress, McAfee Email Gateway, ePO, NetScreen Firewall, ScreenOS, Nodejs Core, OpenSSL, openSUSE, openSUSE Leap, Oracle Communications, Oracle Directory Server, Oracle Directory Services Plus, Oracle Fusion Middleware, Oracle GlassFish Server, Oracle Identity Management, Oracle iPlanet Web Server, Solaris, Tuxedo, WebLogic, Oracle Web Tier, pfSense, Pulse Connect Secure, Pulse Secure Client, Pulse Secure SBR, RHEL, SAS Add-in for Microsoft Office, SAS Analytics Pro, Base SAS Software, SAS BI Server, SAS Enterprise Guide, SAS Management Console, SAS OLAP Server, SAS SAS/ACCESS, SAS SAS/AF, SAS SAS/CONNECT, SAS SAS/EIS, SAS SAS/ETS, SAS SAS/FSP, SAS SAS/GRAPH, SAS SAS/IML, SAS SAS/OR, SAS SAS/STAT, SAS SAS/Web Report Studio, Slackware, Splunk Enterprise, stunnel, SUSE Linux Enterprise Desktop, SLES, Synology DS***, Synology RS***, Nessus, Ubuntu, WinSCP.

Our Vigil@nce team determined that the severity of this computer weakness alert is medium.

The trust level is of type confirmed by the editor, with an origin of document.

An attacker with a expert ability can exploit this computer vulnerability.

Solutions for this threat 

OpenSSL: version 1.0.2i.
The version 1.0.2i is fixed:
  https://www.openssl.org/source/openssl-1.0.2i.tar.gz

OpenSSL: version 1.0.1u.
The version 1.0.1u is fixed:
  https://www.openssl.org/source/openssl-1.0.1u.tar.gz

OpenSSL: version 1.1.0a.
The version 1.1.0a is fixed:
  https://www.openssl.org/source/openssl-1.1.0a.tar.gz

OpenSSL: patch for BN_bn2dec.
A patch is indicated in information sources.

AIX: patch for OpenSSL.
A patch is available:
  https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=aixbp
  openssl-1.0.1.517.tar.Z
  openssl-1.0.2.1000.tar.Z
  openssl-20.13.101.500.tar.Z
  openssl-20.13.102.1000.tar.Z

Android OS: patch 2017-03-01 and 2017-03-05.
A patch is indicated in information sources.

Blue Coat: solution for OpenSSL.
The solution is indicated in information sources.

Cisco: solution for OpenSSL.
The solution is indicated in information sources.

Comware: solution for OpenSSL.
The solution is indicated in information sources.

Debian 7: new openssl packages.
New packages are available:
  Debian 7: openssl 1.0.1t-1+deb7u1

Debian: new openssl packages.
New packages are available:
  Debian 8: openssl 1.0.1t-1+deb8u5

F5 BIG-IP: fixed versions for OpenSSL.
Fixed versions are indicated in information sources.

Fedora: new openssl packages.
New packages are available:
  Fedora 23: openssl 1.0.2j-1.fc23
  Fedora 24: openssl 1.0.2j-1.fc24

FileZilla Server: version 0.9.59.
The version 0.9.59 is fixed:
  http://sourceforge.net/projects/filezilla/files/FileZilla%20Server/0.9.59/FileZilla_Server-0_9_59.exe/download

Fortinet FortiAnalyzer: version 5.4.2.
The version 5.4.2 is fixed.

Fortinet FortiOS: version 5.6.0.
The version 5.6.0 is fixed.

FreeBSD: patch for openssl.
A patch is indicated in information sources.

FreeRADIUS: version 3.0.12.
The version 3.0.12 is fixed:
  ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-3.0.12.tar.bz2

FreeRADIUS: version 3.0.13.
The version 3.0.13 is fixed:
  ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-3.0.13.tar.bz2

hMailServer: version 5.6.6.
The version 5.6.6 is fixed:
  https://www.hmailserver.com/download

IBM BigFix Platform: solution for OpenSSL (02/05/2017).
The solution is indicated in information sources.

IBM Cognos Analytics: solution.
The solution is indicated in information sources.

IBM DB2: solution for FCM.
The solution is indicated in information sources.

IBM QRadar SIEM: version 7.2.8 Patch 4.
The version 7.2.8 Patch 4 is fixed:
  https://www-945.ibm.com/support/fixcentral/swg/downloadFixes?product=ibm/Other+software/IBM+Security+QRadar+SIEM&release=7.2.0&platform=Linux&function=fixId&fixids=7.2.8-QRADAR-QRSIEM-20170224202650&includeRequisites=1&includeSupersedes=0&downloadMethod=http&source=fc

IBM Spectrum Protect: versions 7.1.6.5 and 8.1.0.2.
Versions 7.1.6.5 and 8.1.0.2 are fixed:
  Version 7.1.6.5 : http://www-01.ibm.com/support/docview.wss?uid=swg24042496
  Version 8.1.0.2: http://www.ibm.com/support/docview.wss?uid=swg24043351

IBM Tivoli Workload Scheduler: patch for OpenSSL.
A patch reference is provided in the information sources for each supported version of Workload Scheduler.

IBM WebSphere MQ: version 5.3.1.13.
The version 5.3.1.13 is fixed:
  https://www-945.ibm.com/support/fixcentral/swg/selectFixes?product=ibm/WebSphere/WebSphere+MQ&release=All&platform=HP+NonStop&function=fixId&fixids=5.3.1.13-WS-MQ-HPNSS-FP013&source=fc

Juniper: solution for OpenSSL.
The solution is indicated in information sources.

McAfee Email Gateway: patch for OpenSSL.
A patch is indicated in information sources.

McAfee ePO: patch for OpenSSL.
A patch is indicated in information sources.

Node.js: versions 6.7.0, 4.6.0, 0.12.16, 0.10.47.
Versions 6.7.0, 4.6.0, 0.12.16, 0.10.47 are fixed:
  https://nodejs.org/en/download/

openSUSE Leap 42.1: new compat-openssl098 packages.
New packages are available:
  openSUSE Leap 42.1: compat-openssl098 0.9.8j-15.1

openSUSE Leap: new openssl-steam packages.
New packages are available:
  openSUSE Leap 42.3: libopenssl1_0_0-steam 1.0.2k-4.3.1

openSUSE: new openssl packages.
New packages are available:
  openSUSE 13.2: openssl 1.0.1k-2.39.1
  openSUSE Leap 42.1: openssl 1.0.1i-18.1

Oracle Communications: CPU of October 2017.
A Critical Patch Update is available.

Oracle Fusion Middleware: CPU of April 2017.
A Critical Patch Update is available:
  https://support.oracle.com/rs?type=doc&id=2228898.1

Oracle Fusion Middleware: CPU of January 2018.
A Critical Patch Update is available:
  https://support.oracle.com/rs?type=doc&id=2325393.1

Oracle Solaris: patch for third party software of April 2017 v1.
A patch is available:
  https://support.oracle.com/rs?type=doc&id=1448883.1

pfSense: version 2.3.2-p1.
The version 2.3.2-p1 is fixed:
  https://www.pfsense.org/download/

Pulse Secure: solution for OpenSSL.
The solution is indicated in information sources.

RHEL: new openssl packages.
New packages are available:
  RHEL 6: openssl 1.0.1e-48.el6_8.3
  RHEL 7: openssl 1.0.1e-51.el7_2.7

SAS 9.4: patch for OpenSSL, Apache.
A patch is available:
  http://support.sas.com/kb/59371.html

Slackware: new openssl packages.
New packages are available:
  Slackware 14.0: openssl 1.0.1u-*-1_slack14.0
  Slackware 14.1: openssl 1.0.1u-*-1_slack14.1
  Slackware 14.2: openssl 1.0.2i-*-1_slack14.2

Snare Enterprise Agent for MSSQL: version 1.4.9.
The version 1.4.9 is fixed:
  https://snaresupport.intersectalliance.com/

Snare Enterprise Agent for Windows: version 4.3.8.
The version 4.3.8 is fixed:
  https://snaresupport.intersectalliance.com/

Solaris: patch for third party software of July 2016 v4.
A patch is available:
  https://support.oracle.com/rs?type=doc&id=1448883.1

Splunk Enterprise: versions 6.0.13, 6.1.12, 6.2.12, 6.3.8, 6.4.5 and 6.5.1.
Versions 6.0.13, 6.1.12, 6.2.12, 6.3.8, 6.4.5 and 6.5.1 are fixed:
  http://www.splunk.com/

stunnel: version 5.36.
The version 5.36 is fixed:
  https://www.stunnel.org/downloads/stunnel-5.36-installer.exe
  https://www.stunnel.org/downloads/stunnel-5.36.tar.gz

SUSE LE 11: new openssl1 packages.
New packages are available:
  SUSE LE 11: openssl1 1.0.1g-0.52.1

SUSE LE 11: new openssl packages.
New packages are available:
  SUSE LE 11 SP2: openssl 0.9.8j-0.102.2
  SUSE LE 11 SP3: openssl 0.9.8j-0.102.2
  SUSE LE 11 SP4: openssl 0.9.8j-0.102.2

SUSE LE 12: new compat-openssl098 packages.
New packages are available:
  SUSE LE 12 RTM: compat-openssl098 0.9.8j-102.1
  SUSE LE 12 SP1: compat-openssl098 0.9.8j-102.1

SUSE LE 12: new openssl packages.
New packages are available:
  SUSE LE 12 RTM: openssl 1.0.1i-27.21.1
  SUSE LE 12 SP1: openssl 1.0.1i-52.1

Synology RS/DS: version 6.0.2-8451-2.
The version 6.0.2-8451-2 is fixed:
  https://www.synology.com/

Tenable Nessus: version 6.9.0.
The version 6.9.0 is fixed:
  http://www.tenable.com/

Ubuntu: new openssl packages.
New packages are available:
  Ubuntu 16.04 LTS: libssl1.0.0 1.0.2g-1ubuntu4.5
  Ubuntu 14.04 LTS: libssl1.0.0 1.0.1f-1ubuntu2.21
  Ubuntu 12.04 LTS: libssl1.0.0 1.0.1-4ubuntu5.38

Wind River Linux: solution for OpenSSL.
The solution is indicated in information sources.

WinSCP: version 5.9.3.
The version 5.9.3 is fixed:
  https://winscp.net/
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

Computer vulnerabilities tracking service 

Vigil@nce provides an applications vulnerabilities watch. The Vigil@nce security watch publishes vulnerability bulletins about threats impacting the information system.