The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a vigilance database and tools to fix them.

Vulnerability of OpenSSL: six vulnerabilities

Synthesis of the vulnerability 

An attacker can use several vulnerabilities of OpenSSL.
Vulnerable products: SDS, SES, SNS, Tomcat, Mac OS X, StormShield, Blue Coat CAS, ProxyAV, ProxySG par Blue Coat, Cisco ASR, Cisco Aironet, Cisco ATA, Cisco AnyConnect Secure Mobility Client, Cisco ACE, ASA, Cisco Catalyst, Cisco Content SMA, Cisco ESA, IOS by Cisco, IOS XE Cisco, IOS XR Cisco, Cisco IPS, IronPort Email, IronPort Encryption, Nexus by Cisco, NX-OS, Cisco Prime Access Registrar, Prime Collaboration Assurance, Cisco Prime DCNM, Prime Infrastructure, Cisco Prime LMS, Cisco PRSM, Cisco Router, Secure ACS, Cisco CUCM, Cisco IP Phone, Cisco MeetingPlace, Cisco Wireless IP Phone, Cisco WSA, Cisco Wireless Controller, XenServer, Debian, PowerPath, Unisphere EMC, VNX Operating Environment, VNX Series, Black Diamond, ExtremeXOS, Summit, BIG-IP Hardware, TMOS, Fedora, FileZilla Server, FortiAnalyzer, FortiAnalyzer Virtual Appliance, FortiOS, FreeBSD, Android OS, HP Operations, HP Switch, AIX, IRAD, QRadar SIEM, IBM System x Server, Tivoli Storage Manager, Tivoli Workload Scheduler, WebSphere MQ, Juniper J-Series, Junos OS, Junos Space, NSM Central Manager, NSMXpress, MariaDB ~ precise, McAfee NSM, Meinberg NTP Server, MySQL Community, MySQL Enterprise, Data ONTAP 7-Mode, NETASQ, NetScreen Firewall, ScreenOS, Nodejs Core, OpenBSD, OpenSSL, openSUSE, openSUSE Leap, Oracle Communications, Oracle Directory Server, Oracle Directory Services Plus, Oracle Fusion Middleware, Oracle GlassFish Server, Oracle Identity Management, Oracle iPlanet Web Proxy Server, Oracle iPlanet Web Server, Solaris, Tuxedo, VirtualBox, WebLogic, Oracle Web Tier, Palo Alto Firewall PA***, PAN-OS, Percona Server, pfSense, Pulse Connect Secure, Puppet, Python, RHEL, JBoss EAP by Red Hat, SAS Management Console, Shibboleth SP, Slackware, Splunk Enterprise, stunnel, SUSE Linux Enterprise Desktop, SLES, Synology DSM, Synology DS***, Synology RS***, Nessus, Ubuntu, VxWorks, X2GoClient.
Severity of this weakness: 3/4.
Number of vulnerabilities in this bulletin: 6.
Creation date: 03/05/2016.
Références of this bulletin: 1982949, 1985850, 1987779, 1993215, 1995099, 1998797, 2003480, 2003620, 2003673, 510853, 9010083, bulletinapr2016, bulletinapr2017, CERTFR-2016-AVI-151, CERTFR-2016-AVI-153, CERTFR-2018-AVI-160, cisco-sa-20160504-openssl, cpuapr2017, cpujan2018, cpujul2016, cpujul2017, cpujul2018, cpuoct2016, cpuoct2017, cpuoct2018, CTX212736, CTX233832, CVE-2016-2105, CVE-2016-2106, CVE-2016-2107, CVE-2016-2108, CVE-2016-2109, CVE-2016-2176, DLA-456-1, DSA-2019-197, DSA-2020-062, DSA-3566-1, ESA-2017-142, FEDORA-2016-05c567df1a, FEDORA-2016-1e39d934ed, FEDORA-2016-e1234b65a2, FG-IR-16-026, FreeBSD-SA-16:17.openssl, HPESBGN03728, HPESBHF03756, HT206903, JSA10759, K23230229, K36488941, K51920288, K75152412, K93600123, MBGSA-1603, MIGR-5099595, MIGR-5099597, NTAP-20160504-0001, openSUSE-SU-2016:1237-1, openSUSE-SU-2016:1238-1, openSUSE-SU-2016:1239-1, openSUSE-SU-2016:1240-1, openSUSE-SU-2016:1241-1, openSUSE-SU-2016:1242-1, openSUSE-SU-2016:1243-1, openSUSE-SU-2016:1273-1, openSUSE-SU-2016:1566-1, openSUSE-SU-2017:0487-1, PAN-SA-2016-0020, PAN-SA-2016-0028, RHSA-2016:0722-01, RHSA-2016:0996-01, RHSA-2016:1137-01, RHSA-2016:1648-01, RHSA-2016:1649-01, RHSA-2016:1650-01, RHSA-2016:2054-01, RHSA-2016:2055-01, RHSA-2016:2056-01, RHSA-2016:2073-01, SA123, SA40202, SB10160, SOL23230229, SOL36488941, SOL51920288, SOL75152412, SP-CAAAPPQ, SPL-119440, SPL-121159, SPL-123095, SSA:2016-124-01, STORM-2016-002, SUSE-SU-2016:1206-1, SUSE-SU-2016:1228-1, SUSE-SU-2016:1231-1, SUSE-SU-2016:1233-1, SUSE-SU-2016:1267-1, SUSE-SU-2016:1290-1, SUSE-SU-2016:1360-1, SUSE-SU-2018:0112-1, TNS-2016-10, USN-2959-1, VIGILANCE-VUL-19512, VN-2016-006, VN-2016-007.

Description of the vulnerability 

Several vulnerabilities were announced in OpenSSL.

An attacker can act as a Man-in-the-Middle and use the AES CBC algorithm with a server supporting AES-NI, in order to read or write data in the session. This vulnerability was initially fixed in versions 1.0.1o and 1.0.2c, but it was not disclosed at that time. [severity:3/4; CVE-2016-2108]

An attacker can act as a Man-in-the-Middle and use the AES CBC algorithm with a server supporting AES-NI, in order to read or write data in the session. [severity:3/4; CVE-2016-2107]

An attacker can generate a buffer overflow in EVP_EncodeUpdate(), which is mainly used by command line applications, in order to trigger a denial of service, and possibly to run code. [severity:2/4; CVE-2016-2105]

An attacker can generate a buffer overflow in EVP_EncryptUpdate(), which is difficult to reach, in order to trigger a denial of service, and possibly to run code. [severity:2/4; CVE-2016-2106]

An attacker can trigger an excessive memory usage in d2i_CMS_bio(), in order to trigger a denial of service. [severity:2/4; CVE-2016-2109]

An attacker can force a read at an invalid address in applications using X509_NAME_oneline(), in order to trigger a denial of service, or to obtain sensitive information. [severity:2/4; CVE-2016-2176]
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

This cybersecurity vulnerability impacts software or systems such as SDS, SES, SNS, Tomcat, Mac OS X, StormShield, Blue Coat CAS, ProxyAV, ProxySG par Blue Coat, Cisco ASR, Cisco Aironet, Cisco ATA, Cisco AnyConnect Secure Mobility Client, Cisco ACE, ASA, Cisco Catalyst, Cisco Content SMA, Cisco ESA, IOS by Cisco, IOS XE Cisco, IOS XR Cisco, Cisco IPS, IronPort Email, IronPort Encryption, Nexus by Cisco, NX-OS, Cisco Prime Access Registrar, Prime Collaboration Assurance, Cisco Prime DCNM, Prime Infrastructure, Cisco Prime LMS, Cisco PRSM, Cisco Router, Secure ACS, Cisco CUCM, Cisco IP Phone, Cisco MeetingPlace, Cisco Wireless IP Phone, Cisco WSA, Cisco Wireless Controller, XenServer, Debian, PowerPath, Unisphere EMC, VNX Operating Environment, VNX Series, Black Diamond, ExtremeXOS, Summit, BIG-IP Hardware, TMOS, Fedora, FileZilla Server, FortiAnalyzer, FortiAnalyzer Virtual Appliance, FortiOS, FreeBSD, Android OS, HP Operations, HP Switch, AIX, IRAD, QRadar SIEM, IBM System x Server, Tivoli Storage Manager, Tivoli Workload Scheduler, WebSphere MQ, Juniper J-Series, Junos OS, Junos Space, NSM Central Manager, NSMXpress, MariaDB ~ precise, McAfee NSM, Meinberg NTP Server, MySQL Community, MySQL Enterprise, Data ONTAP 7-Mode, NETASQ, NetScreen Firewall, ScreenOS, Nodejs Core, OpenBSD, OpenSSL, openSUSE, openSUSE Leap, Oracle Communications, Oracle Directory Server, Oracle Directory Services Plus, Oracle Fusion Middleware, Oracle GlassFish Server, Oracle Identity Management, Oracle iPlanet Web Proxy Server, Oracle iPlanet Web Server, Solaris, Tuxedo, VirtualBox, WebLogic, Oracle Web Tier, Palo Alto Firewall PA***, PAN-OS, Percona Server, pfSense, Pulse Connect Secure, Puppet, Python, RHEL, JBoss EAP by Red Hat, SAS Management Console, Shibboleth SP, Slackware, Splunk Enterprise, stunnel, SUSE Linux Enterprise Desktop, SLES, Synology DSM, Synology DS***, Synology RS***, Nessus, Ubuntu, VxWorks, X2GoClient.

Our Vigil@nce team determined that the severity of this vulnerability is important.

The trust level is of type confirmed by the editor, with an origin of internet client.

This bulletin is about 6 vulnerabilities.

An attacker with a expert ability can exploit this weakness alert.

Solutions for this threat 

OpenSSL: version 1.0.2h.
The version 1.0.2h is fixed:
  https://www.openssl.org/source/

OpenSSL: version 1.0.1t.
The version 1.0.1t is fixed:
  https://www.openssl.org/source/

AIX: patch OpenSSL.
A patch is available:
   https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=aixbp

Android: fixed versions.
Fixed versions are indicated in information sources.

Android OS: patches 2017-07-01 and 2017-07-05.
A patch is indicated in information sources.

Apache Tomcat: version 7.0.70.
The version 7.0.70 is fixed:
  http://tomcat.apache.org/download-70.cgi

Apple Mac OS X: version 10.11.6.
The version 10.11.6 is fixed:
  http://www.apple.com/support/downloads/

Blue Coat CAS, ProxyAV: solution for OpenSSL.
The solution is indicated in information sources.

Blue Coat ProxySG: versions 6.5.9.8, 6.6.4.1.
Versions 6.5.9.8 and 6.6.4.1 are fixed.

Cisco: solution for OpenSSL.
The solution is indicated in information sources.

Citrix XenServer 7.2: patch for OpenSSL.
A patch is available:
  https://support.citrix.com/article/CTX233880

Citrix XenServer: patch.
A patch is indicated in information sources.

Copssh: version 5.5.3.
The version 5.5.3 is fixed:
  https://www.itefix.net/copssh

Debian: new openssl packages.
New packages are available:
  Debian 7: openssl 1.0.1e-2+deb7u21
  Debian 8: openssl 1.0.1k-3+deb8u5

Dell EMC Unisphere for PowerMax: solution.
The solution is indicated in information sources.

Dell EMC VNXe: version MR4 Service Pack 5.
The version MR4 Service Pack 5 is fixed:
  https://www.dell.com/support/

EMC PowerPath: solution for OpenSSL.
The solution is indicated in information sources.

Extreme Networks: solution for OpenSSL.
The solution is indicated in information sources.

F5 BIG-IP: fixed versions for OpenSSL.
Fixed versions are indicated in information sources.

Fedora 23: new mingw-openssl packages.
New packages are available:
  Fedora 23: mingw-openssl 1.0.2h-1.fc23

Fedora: new openssl packages.
New packages are available:
  Fedora 22: openssl 1.0.1k-15.fc22
  Fedora 23: openssl 1.0.2h-1.fc23

FileZilla Server: version 0.9.57.
The version 0.9.57 is fixed:
  https://filezilla-project.org/

FortiNet FortiOS, FortiAnalyzer: versions 5.4.1, 5.2.8.
Versions 5.4.1, 5.2.8 are fixed.

FreeBSD: patch for OpenSSL.
A patch is available:
  https://security.FreeBSD.org/patches/SA-16:17/openssl-9.patch
  https://security.FreeBSD.org/patches/SA-16:17/openssl-10.patch

Google Android/Pixel: patch for July 2018.
A patch is indicated in information sources.

HPE Operations Agent: version 11.16.
The version 11.16 is fixed.

HPE Switch Comware: fixed versions for OpenSSL.
Fixed versions are indicated in information sources.

IBM BigFix Platform: fixed versions for OpenSSL.
Fixed versions are indicated in information sources.

IBM IMM for System x: version YUOOH4B - 1.53.
The version YUOOH4B - 1.53 is fixed:
  http://www.ibm.com/support/fixcentral/

IBM QRadar SIEM: fixed versions for OpenSSL.
Fixed versions are indicated in information sources.

IBM Rational Application Developer: patch for OpenSSL.
A patch is indicated in information sources.

IBM Spectrum Protect: versions 7.1.6.5 and 8.1.0.2.
Versions 7.1.6.5 and 8.1.0.2 are fixed:
  Version 7.1.6.5 : http://www-01.ibm.com/support/docview.wss?uid=swg24042496
  Version 8.1.0.2: http://www.ibm.com/support/docview.wss?uid=swg24043351

IBM WebSphere MQ: version 8.0.0.6.
The version 8.0.0.6 is fixed:
  http://www-01.ibm.com/support/docview.wss?uid=swg21995100

Juniper: solution for OpenSSL.
The solution is indicated in information sources.

McAfee Network Security Manager: patch for OpenSSL.
A patch is available:
  http://www.mcafee.com/us/downloads/downloads.aspx

Meinberg LANTIME: version 6.18.017.
The version 6.18.017 is fixed:
  https://www.meinbergglobal.com/

Meinberg NTP Server: version 4.2.8p8.
The version 4.2.8p8 is fixed:
  http://www.microsoft.com/en-us/download/details.aspx?id=29

MySQL: version 5.5.55.
The version 5.5.55 is fixed.

MySQL: version 5.6.36.
The version 5.6.36 is fixed.

MySQL: version 5.7.13.
The version 5.7.13 is fixed:
  MySQL Community: https://support.oracle.com/
  MySQL Enterprise : http://dev.mysql.com/downloads/

MySQL: version 5.7.18.
The version 5.7.18 is fixed.

Nessus: version 6.7.
The version 6.7 is fixed:
  http://www.tenable.com/

NetApp Data ONTAP: solution for OpenSSL.
The solution is indicated in information sources.

Node.js Core: versions 0.10.45, 0.12.14, 4.4.4 and 5.11.1.
Versions 0.10.45, 0.12.14, 4.4.4 and 5.11.1 are fixed:
  https://nodejs.org/en/download/

OpenBSD: patch for libcrypto.
A patch is available:
  http://ftp.openbsd.org/pub/OpenBSD/patches/5.8/common/013_crypto.patch.sig
  http://ftp.openbsd.org/pub/OpenBSD/patches/5.8/common/015_crypto.patch.sig
  http://ftp.openbsd.org/pub/OpenBSD/patches/5.9/common/005_crypto.patch.sig
  http://ftp.openbsd.org/pub/OpenBSD/patches/5.9/common/009_crypto.patch.sig

openSUSE Leap 42.1: new compat-openssl098 packages.
New packages are available:
  openSUSE Leap 42.1: compat-openssl098 0.9.8j-12.2

openSUSE Leap 42.1: new openssl packages.
New packages are available:
  openSUSE Leap 42.1: openssl 1.0.1i-21.1

openSUSE: new libopenssl0_9_8 packages.
New packages are available:
  openSUSE 11.4: libopenssl0_9_8 0.9.8zh-14.1
  openSUSE 13.1: libopenssl0_9_8 0.9.8zh-5.3.1
  openSUSE 13.2: libopenssl0_9_8 0.9.8zh-9.6.1
  openSUSE Leap 42.1: libopenssl0_9_8 0.9.8zh-17.1

openSUSE: new nodejs packages.
New packages are available:
  openSUSE Leap 42.1: nodejs 4.4.5-27.1
  openSUSE 13.2: nodejs 4.4.5-18.1

openSUSE: new openssl packages.
New packages are available:
  openSUSE 11.4: openssl 1.0.1p-74.1
  openSUSE 13.1: openssl 1.0.1k-11.87.1
  openSUSE 13.2: openssl 1.0.1k-2.36.1
  openSUSE Leap 42.1: openssl 1.0.1i-15.1

Oracle Communications: CPU of April 2017.
A Critical Patch Update is available:
  https://support.oracle.com/rs?type=doc&id=2247453.1
  https://support.oracle.com/rs?type=doc&id=2248470.1
  https://support.oracle.com/rs?type=doc&id=2251718.1
  https://support.oracle.com/rs?type=doc&id=2245233.1
  https://support.oracle.com/rs?type=doc&id=2248526.1
  https://support.oracle.com/rs?type=doc&id=2250567.1

Oracle Communications: CPU of July 2017.
A Critical Patch Update is available.

Oracle Communications: CPU of July 2018.
A Critical Patch Update is available:
  https://support.oracle.com/rs?type=doc&id=2410237.1
  https://support.oracle.com/rs?type=doc&id=2406191.1
  https://support.oracle.com/rs?type=doc&id=2410234.1
  https://support.oracle.com/rs?type=doc&id=2408211.1
  https://support.oracle.com/rs?type=doc&id=2406689.1
  https://support.oracle.com/rs?type=doc&id=2408212.1
  https://support.oracle.com/rs?type=doc&id=2410243.1
  https://support.oracle.com/rs?type=doc&id=2410198.1

Oracle Communications: CPU of October 2016.
A Critical Patch Update is available:
  https://support.oracle.com/rs?type=doc&id=2188694.1

Oracle Communications: CPU of October 2017.
A Critical Patch Update is available.

Oracle Communications: CPU of Octobre 2018.
A Critical Patch Update is available:
  https://support.oracle.com/rs?type=doc&id=2451363.1
  https://support.oracle.com/rs?type=doc&id=2450339.1
  https://support.oracle.com/rs?type=doc&id=2450354.1
  https://support.oracle.com/rs?type=doc&id=2450340.1
  https://support.oracle.com/rs?type=doc&id=2452772.1
  https://support.oracle.com/rs?type=doc&id=2451007.1

Oracle Fusion Middleware: CPU of January 2018.
A Critical Patch Update is available:
  https://support.oracle.com/rs?type=doc&id=2325393.1

Oracle Fusion Middleware: CPU of October 2016.
A Critical Patch Update is available:
  https://support.oracle.com/rs?type=doc&id=2171485.1

Oracle Solaris: patch for third party software of April 2017 v1.
A patch is available:
  https://support.oracle.com/rs?type=doc&id=1448883.1

Oracle VM VirtualBox: version 5.0.22.
The version 5.0.22 is fixed:
  https://support.oracle.com/rs?type=doc&id=2151065.1

PAN-OS: versions 5.0.20, 5.1.13, 6.0.14, 6.1.13, 7.0.9 and 7.1.4.
Versions 5.0.20, 5.1.13, 6.0.14, 6.1.13, 7.0.9 and 7.1.4 are fixed.

pfSense: version 2.3.1.
The version 2.3.1 is fixed:
  https://pfsense.org/download/

Pulse Connect Secure: solution for OpenSSL.
Versions 8.2r4, 8.1r10, 8.0r16, 7.4r13.7 and C5.2R7 are fixed.

Puppet Labs Puppet Enterprise: version 2016.2.0.
The version 2016.2.0 is fixed.

Python: version 2.7.12.
The version 2.7.12 is fixed:
  https://www.python.org/downloads/release/python-2712/

Red Hat JBoss Enterprise Application Platform: version 6.4.10.
The version 6.4.10 is fixed:
  https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=6.4

Red Hat JBoss Web Server: version 2.1.1.
The version 2.1.1 is fixed:
  https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/2.1/html/2.1.1_Release_Notes/index.html

RHEL 6.7: new openssl packages.
New packages are available:
  RHEL 6: openssl 1.0.1e-42.el6_7.5

RHEL: new openssl packages.
New packages are available:
  RHEL 5: openssl 0.9.8e-40.el5_11
  RHEL 6: openssl 1.0.1e-48.el6_8.1
  RHEL 7: openssl 1.0.1e-51.el7_2.5

SAS Web Server: fixed version for OpenSSL.
The SAS Note 58194 is available:
  http://support.sas.com/kb/58/194.html

Shibboleth Service Provider: version 2.6.0.
The version 2.6.0 is fixed.

Slackware: new openssl packages.
New packages are available:
  Slackware 14.0: openssl 1.0.1t-*-1_slack14.0
  Slackware 14.1: openssl 1.0.1t-*-1_slack14.1

Snare Enterprise Agent: fixed versions for OpenSSL.
Fixed versions are:
  Snare Enterprise Agent for Windows: 4.3.6
  Snare Enterprise Agent for MSSQL: 1.4.7

Solaris: patch for Third Party software 04/2016.
A patch is available:
  https://support.oracle.com/rs?type=doc&id=1448883.1

Splunk Enterprise: versions 6.4.2, 6.2.10, 6.1.11 and 6.0.12.
Versions 6.4.2, 6.2.10, 6.1.11 and 6.0.12 are fixed:
  http://www.splunk.com/en_us/download.html

Splunk Enterprise: versions 6.4.2, 6.3.6, 6.2.11, 6.1.11, 6.0.12 and 5.0.16.
Versions 6.4.2, 6.3.6, 6.2.11, 6.1.11, 6.0.12 and 5.0.16 are fixed:
  http://www.splunk.com/en_us/download.html

Stormshield: solution for OpenSSL.
The solution is indicated in information sources.

stunnel: version 5.32.
The version 5.32 is fixed:
  https://www.stunnel.org/downloads.html

SUSE LE 11: new compat-openssl097g packages.
New packages are available:
  SUSE LE 11 SP3: compat-openssl097g 0.9.7g-146.22.44.1
  SUSE LE 11 SP4: compat-openssl097g 0.9.7g-146.22.44.1

SUSE LE 11: new openssl1 packages.
New packages are available:
  SUSE LE 11: openssl1 1.0.1g-0.47.1

SUSE LE 12: new compat-openssl098 packages.
New packages are available:
  SUSE LE 12 RTM: compat-openssl098 0.9.8j-97.1
  SUSE LE 12 SP1: compat-openssl098 0.9.8j-97.1

SUSE LE 12 RTM: new openssl packages (17/01/2018).
New packages are available:
  SUSE LE 12 RTM: openssl 1.0.1i-27.28.1

SUSE LE: new openssl packages.
New packages are available:
  SUSE LE 10 SP4: openssl 0.9.8a-18.96.1
  SUSE LE 11 SP4: openssl 0.9.8j-0.97.1
  SUSE LE 12 RTM: openssl 1.0.1i-27.16.1
  SUSE LE 12 SP1: openssl 1.0.1i-47.1

Synology DSM: solution for OpenSSL.
The solution is indicated in information sources.

Synology DS/RS: version 5.2-5967-1.
The version 5.2-5967-1 is fixed:
  https://www.synology.com/

Synology DS/RS: version 6.0-7321-6.
The version 6.0-7321-6 is fixed:
  https://www.synology.com/

Tivoli Workload Scheduler: patch for OpenSSL.
A patch is indicated in information sources.

Ubuntu: new libssl1.0.0 packages.
New packages are available:
  Ubuntu 16.04 LTS: libssl1.0.0 1.0.2g-1ubuntu4.1
  Ubuntu 15.10: libssl1.0.0 1.0.2d-0ubuntu1.5
  Ubuntu 14.04 LTS: libssl1.0.0 1.0.1f-1ubuntu2.19
  Ubuntu 12.04 LTS: libssl1.0.0 1.0.1-4ubuntu5.36

Wind River Linux: solution for OpenSSL.
The solution is indicated in information sources.

Wind River VxWorks: solution for OpenSSL.
The solution is indicated in information sources.

X2Go: version 4.0.5.1-2016.08.18.
The version 4.0.5.1-2016.08.18 is fixed:
  http://wiki.x2go.org/doku.php/download:start
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

Computer vulnerabilities tracking service 

Vigil@nce provides a cybersecurity patch. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications.