The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

computer vulnerability CVE-2016-2177

OpenSSL: out-of-bounds memory reading

Synthesis of the vulnerability

An attacker can force a memory access at an invalid address in OpenSSL, in order to trigger a denial of service, or to obtain sensitive information.
Severity of this announce: 1/4.
Creation date: 09/06/2016.
Références of this computer vulnerability: 1991866, 1991867, 1991870, 1991871, 1991875, 1991876, 1991878, 1991880, 1991882, 1991884, 1991885, 1991886, 1991887, 1991889, 1991892, 1991894, 1991896, 1991902, 1991903, 1991951, 1991955, 1991959, 1991960, 1991961, 1996096, 1999395, 1999421, 1999474, 1999478, 1999479, 1999488, 1999532, 1999724, 2000095, 2000209, 2000544, 2001805, 2002770, 2002870, 2003480, 2003620, 2003673, 2008828, bulletinapr2016, bulletinapr2017, bulletinjul2016, CERTFR-2016-AVI-333, cisco-sa-20160927-openssl, cpuapr2017, cpujan2018, cpuoct2017, CVE-2016-2177, DLA-637-1, DSA-3673-1, DSA-3673-2, FEDORA-2016-97454404fe, FEDORA-2016-a555159613, FG-IR-16-047, FG-IR-16-048, FG-IR-17-127, FreeBSD-SA-16:26.openssl, HPESBHF03763, HPESBHF03856, JSA10759, openSUSE-SU-2016:2391-1, openSUSE-SU-2016:2407-1, openSUSE-SU-2016:2537-1, openSUSE-SU-2018:0458-1, RHSA-2016:1940-01, RHSA-2017:1548-01, RHSA-2017:1549-01, RHSA-2017:1550-01, RHSA-2017:1551-01, RHSA-2017:1552-01, RHSA-2017:1658-01, RHSA-2017:1659-01, SA132, SA40312, SB10165, SB10215, SOL23873366, SP-CAAAPUE, SPL-129207, SSA:2016-266-01, SUSE-SU-2016:2387-1, SUSE-SU-2016:2394-1, SUSE-SU-2016:2458-1, SUSE-SU-2016:2468-1, SUSE-SU-2016:2469-1, TNS-2016-16, USN-3087-1, USN-3087-2, USN-3181-1, VIGILANCE-VUL-19855.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

The source code of OpenSSL includes many loops where a pointer is used to go through a buffer.

The definition of the C language allows a pointer to be off by one byte after the buffer, but the behavior of any further access is undefined. Several end of loop tests follows the forme "pointer + current data length > end pointer" in such a way that these 2 expressions are not always defined according to the language specification. An attacker which can control dynamic memory allocations can trigger evaluation of undefined conditions and perhaps invalid memory access.

An attacker can therefore force a memory access at an invalid address in OpenSSL, in order to trigger a denial of service, or to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

This weakness bulletin impacts software or systems such as Blue Coat CAS, ProxyAV, ProxySG par Blue Coat, SGOS by Blue Coat, Cisco ASR, Cisco Aironet, Cisco ATA, Cisco AnyConnect Secure Mobility Client, Cisco ACE, ASA, AsyncOS, Cisco Catalyst, Cisco Content SMA, Cisco ESA, IOS by Cisco, IOS XE Cisco, IOS XR Cisco, Cisco IPS, Nexus by Cisco, NX-OS, Cisco Prime Access Registrar, Prime Collaboration Assurance, Cisco Prime DCNM, Prime Infrastructure, Cisco Prime LMS, Cisco Router, Secure ACS, Cisco CUCM, Cisco Manager Attendant Console, Cisco Unified CCX, Cisco IP Phone, Cisco MeetingPlace, Cisco Wireless IP Phone, Cisco WSA, Cisco Wireless Controller, Debian, BIG-IP Hardware, TMOS, Fedora, FileZilla Server, FortiAnalyzer, FortiAnalyzer Virtual Appliance, FortiGate, FortiGate Virtual Appliance, FortiOS, FreeBSD, FreeRADIUS, hMailServer, HP Switch, AIX, DB2 UDB, QRadar SIEM, Tivoli Storage Manager, Tivoli Workload Scheduler, WebSphere MQ, Juniper J-Series, Junos OS, Junos Space, NSM Central Manager, NSMXpress, McAfee Email Gateway, ePO, NetScreen Firewall, ScreenOS, Nodejs Core, OpenSSL, openSUSE, openSUSE Leap, Oracle Communications, Oracle Directory Server, Oracle Directory Services Plus, Oracle Fusion Middleware, Oracle GlassFish Server, Oracle Identity Management, Oracle iPlanet Web Server, Solaris, Tuxedo, WebLogic, Oracle Web Tier, pfSense, Pulse Connect Secure, Pulse Secure Client, Pulse Secure SBR, RHEL, JBoss EAP by Red Hat, SAS Add-in for Microsoft Office, SAS Analytics Pro, Base SAS Software, SAS Enterprise BI Server, SAS Enterprise Guide, SAS Management Console, SAS OLAP Server, SAS SAS/ACCESS, SAS SAS/AF, SAS SAS/CONNECT, SAS SAS/EIS, SAS SAS/ETS, SAS SAS/FSP, SAS SAS/GRAPH, SAS SAS/IML, SAS SAS/OR, SAS SAS/STAT, SAS SAS/Web Report Studio, Slackware, Splunk Enterprise, stunnel, SUSE Linux Enterprise Desktop, SLES, Synology DS***, Synology RS***, Nessus, Ubuntu, WinSCP.

Our Vigil@nce team determined that the severity of this computer weakness is low.

The trust level is of type confirmed by the editor, with an origin of internet client.

An attacker with a expert ability can exploit this vulnerability announce.

Solutions for this threat

OpenSSL: version 1.0.2i.
The version 1.0.2i is fixed:
  https://www.openssl.org/source/openssl-1.0.2i.tar.gz

OpenSSL: version 1.0.1u.
The version 1.0.1u is fixed:
  https://www.openssl.org/source/openssl-1.0.1u.tar.gz

OpenSSL: version 1.1.0a.
The version 1.1.0a is fixed:
  https://www.openssl.org/source/openssl-1.1.0a.tar.gz

OpenSSL: patch for pointer tests.
A patch is available:
  https://github.com/openssl/openssl/commit/a004e72b95835136d3f1ea90517f706c24c03da7

AIX: patch for OpenSSL.
A patch is available:
  https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=aixbp
  openssl-1.0.1.517.tar.Z
  openssl-1.0.2.1000.tar.Z
  openssl-20.13.101.500.tar.Z
  openssl-20.13.102.1000.tar.Z

Blue Coat: solution for OpenSSL.
The solution is indicated in information sources.

Cisco: solution for OpenSSL.
The solution is indicated in information sources.

Comware: solution for OpenSSL.
The solution is indicated in information sources.

Debian 7: new openssl packages.
New packages are available:
  Debian 7: openssl 1.0.1t-1+deb7u1

Debian: new openssl packages.
New packages are available:
  Debian 8: openssl 1.0.1t-1+deb8u5

F5 BIG-IP: solution for OpenSSL.
The solution is indicated in information sources.

Fedora: new openssl packages.
New packages are available:
  Fedora 23: openssl 1.0.2j-1.fc23
  Fedora 24: openssl 1.0.2j-1.fc24

FileZilla Server: version 0.9.59.
The version 0.9.59 is fixed:
  http://sourceforge.net/projects/filezilla/files/FileZilla%20Server/0.9.59/FileZilla_Server-0_9_59.exe/download

Fortinet FortiAnalyzer: version 5.4.2.
The version 5.4.2 is fixed.

Fortinet FortiOS: version 5.6.0.
The version 5.6.0 is fixed.

FreeBSD: patch for openssl.
A patch is indicated in information sources.

FreeRADIUS: version 3.0.12.
The version 3.0.12 is fixed:
  ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-3.0.12.tar.bz2

FreeRADIUS: version 3.0.13.
The version 3.0.13 is fixed:
  ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-3.0.13.tar.bz2

hMailServer: version 5.6.6.
The version 5.6.6 is fixed:
  https://www.hmailserver.com/download

HPE Comware: solution for OpenSSL.
The solution is indicated in information sources.

IBM BigFix Inventory: solution for OpenSSL.
The solution is indicated in information sources.

IBM BigFix Platform: solution for OpenSSL (02/05/2017).
The solution is indicated in information sources.

IBM BigFix Platform: solution for OpenSSL (20/04/2017).
The solution is indicated in information sources.

IBM BigFix Remote Control: solution.
The solution is indicated in information sources.
See also the bulletin VIGILANCE-SOL-52145.

IBM Cognos Analytics: solution.
The solution is indicated in information sources.

IBM DB2: solution for FCM.
The solution is indicated in information sources.

IBM QRadar SIEM: version 7.2.8 Patch 4.
The version 7.2.8 Patch 4 is fixed:
  https://www-945.ibm.com/support/fixcentral/swg/downloadFixes?product=ibm/Other+software/IBM+Security+QRadar+SIEM&release=7.2.0&platform=Linux&function=fixId&fixids=7.2.8-QRADAR-QRSIEM-20170224202650&includeRequisites=1&includeSupersedes=0&downloadMethod=http&source=fc

IBM Spectrum Protect: versions 7.1.6.5 and 8.1.0.2.
Versions 7.1.6.5 and 8.1.0.2 are fixed:
  Version 7.1.6.5 : http://www-01.ibm.com/support/docview.wss?uid=swg24042496
  Version 8.1.0.2: http://www.ibm.com/support/docview.wss?uid=swg24043351

IBM Tivoli Workload Scheduler: patch for OpenSSL.
A patch reference is provided in the information sources for each supported version of Workload Scheduler.

IBM WebSphere MQ Advanced Message Security: version 8.0.0.6.
The version 8.0.0.6 is fixed:
  http://www-01.ibm.com/support/docview.wss?uid=swg21995100

IBM WebSphere MQ: version 5.3.1.13.
The version 5.3.1.13 is fixed:
  https://www-945.ibm.com/support/fixcentral/swg/selectFixes?product=ibm/WebSphere/WebSphere+MQ&release=All&platform=HP+NonStop&function=fixId&fixids=5.3.1.13-WS-MQ-HPNSS-FP013&source=fc

Juniper: solution for OpenSSL.
The solution is indicated in information sources.

McAfee Email Gateway: patch for OpenSSL.
A patch is indicated in information sources.

McAfee ePolicy Orchestrator: patch for OpenSSL.
A patch is available:
  EPO5xHF1147158.zip
  https://kc.mcafee.com/corporate/index?page=content&id=KB56057

Node.js: versions 6.7.0, 4.6.0, 0.12.16, 0.10.47.
Versions 6.7.0, 4.6.0, 0.12.16, 0.10.47 are fixed:
  https://nodejs.org/en/download/

openSUSE Leap 42.1: new compat-openssl098 packages.
New packages are available:
  openSUSE Leap 42.1: compat-openssl098 0.9.8j-15.1

openSUSE Leap: new openssl-steam packages.
New packages are available:
  openSUSE Leap 42.3: libopenssl1_0_0-steam 1.0.2k-4.3.1

openSUSE: new openssl packages.
New packages are available:
  openSUSE 13.2: openssl 1.0.1k-2.39.1
  openSUSE Leap 42.1: openssl 1.0.1i-18.1

Oracle Communications: CPU of October 2017.
A Critical Patch Update is available.

Oracle Fusion Middleware: CPU of April 2017.
A Critical Patch Update is available:
  https://support.oracle.com/rs?type=doc&id=2228898.1

Oracle Fusion Middleware: CPU of January 2018.
A Critical Patch Update is available:
  https://support.oracle.com/rs?type=doc&id=2325393.1

Oracle Solaris: patch for third party software of April 2017 v1.
A patch is available:
  https://support.oracle.com/rs?type=doc&id=1448883.1

pfSense: version 2.3.2-p1.
The version 2.3.2-p1 is fixed:
  https://www.pfsense.org/download/

Pulse Secure: solution for OpenSSL.
The solution is indicated in information sources.

Red Hat JBoss EAP: version 6.4.16.
The version 6.4.16 is fixed.

RHEL: new openssl packages.
New packages are available:
  RHEL 6: openssl 1.0.1e-48.el6_8.3
  RHEL 7: openssl 1.0.1e-51.el7_2.7

SAS 9.4: patch for OpenSSL, Apache.
A patch is available:
  http://support.sas.com/kb/59371.html

Slackware: new openssl packages.
New packages are available:
  Slackware 14.0: openssl 1.0.1u-*-1_slack14.0
  Slackware 14.1: openssl 1.0.1u-*-1_slack14.1
  Slackware 14.2: openssl 1.0.2i-*-1_slack14.2

Snare Enterprise Agent for MSSQL: version 1.4.9.
The version 1.4.9 is fixed:
  https://snaresupport.intersectalliance.com/

Snare Enterprise Agent for Windows: version 4.3.8.
The version 4.3.8 is fixed:
  https://snaresupport.intersectalliance.com/

Solaris: patch for Third Party software 04/2016.
A patch is available:
  https://support.oracle.com/rs?type=doc&id=1448883.1

Solaris: patch for third party software of July 2016 v2.
A patch is available:
  https://support.oracle.com/rs?type=doc&id=1448883.1

Splunk Enterprise: versions 6.0.13, 6.1.12, 6.2.12, 6.3.8, 6.4.5 and 6.5.1.
Versions 6.0.13, 6.1.12, 6.2.12, 6.3.8, 6.4.5 and 6.5.1 are fixed:
  http://www.splunk.com/

stunnel: version 5.36.
The version 5.36 is fixed:
  https://www.stunnel.org/downloads/stunnel-5.36-installer.exe
  https://www.stunnel.org/downloads/stunnel-5.36.tar.gz

SUSE LE 11: new openssl1 packages.
New packages are available:
  SUSE LE 11: openssl1 1.0.1g-0.52.1

SUSE LE 11: new openssl packages.
New packages are available:
  SUSE LE 11 SP2: openssl 0.9.8j-0.102.2
  SUSE LE 11 SP3: openssl 0.9.8j-0.102.2
  SUSE LE 11 SP4: openssl 0.9.8j-0.102.2

SUSE LE 12: new compat-openssl098 packages.
New packages are available:
  SUSE LE 12 RTM: compat-openssl098 0.9.8j-102.1
  SUSE LE 12 SP1: compat-openssl098 0.9.8j-102.1

SUSE LE 12: new openssl packages.
New packages are available:
  SUSE LE 12 RTM: openssl 1.0.1i-27.21.1
  SUSE LE 12 SP1: openssl 1.0.1i-52.1

Synology RS/DS: version 6.0.2-8451-2.
The version 6.0.2-8451-2 is fixed:
  https://www.synology.com/

Tenable Nessus: version 6.9.0.
The version 6.9.0 is fixed:
  http://www.tenable.com/

Ubuntu: new libssl1.0.0 packages.
New packages are available:
  Ubuntu 16.10: libssl1.0.0 1.0.2g-1ubuntu9.1
  Ubuntu 16.04 LTS: libssl1.0.0 1.0.2g-1ubuntu4.6
  Ubuntu 14.04 LTS: libssl1.0.0 1.0.1f-1ubuntu2.22
  Ubuntu 12.04 LTS: libssl1.0.0 1.0.1-4ubuntu5.39

Ubuntu: new openssl packages.
New packages are available:
  Ubuntu 16.04 LTS: libssl1.0.0 1.0.2g-1ubuntu4.5
  Ubuntu 14.04 LTS: libssl1.0.0 1.0.1f-1ubuntu2.21
  Ubuntu 12.04 LTS: libssl1.0.0 1.0.1-4ubuntu5.38

Wind River Linux: solution for OpenSSL.
The solution is indicated in information sources.

WinSCP: version 5.9.3.
The version 5.9.3 is fixed:
  https://winscp.net/
Full Vigil@nce bulletin... (Free trial)

Computer vulnerabilities tracking service

Vigil@nce provides a computers vulnerabilities database. The technology watch team tracks security threats targeting the computer system. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications. The Vigil@nce computer vulnerability tracking service alerts your teams of vulnerabilities or threats impacting your information system.