The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

computer weakness CVE-2015-0209

OpenSSL: use after free via d2i_ECPrivateKey

Synthesis of the vulnerability

An attacker can force the usage of a freed memory area in d2i_ECPrivateKey of OpenSSL, in order to trigger a denial of service, and possibly to execute code.
Severity of this bulletin: 3/4.
Creation date: 09/03/2015.
Références of this threat: 1698703, 1701334, 1902519, 1960491, 1964410, 55767, 7043086, 9010031, ARUBA-PSA-2015-007, c04679334, CERTFR-2015-AVI-089, CERTFR-2015-AVI-117, CERTFR-2015-AVI-146, CERTFR-2015-AVI-177, CERTFR-2015-AVI-259, CERTFR-2016-AVI-303, cisco-sa-20150320-openssl, cisco-sa-20150408-ntpd, cpuoct2017, CTX216642, CVE-2015-0209, DSA-3197-1, DSA-3197-2, FEDORA-2015-10047, FEDORA-2015-10108, FEDORA-2015-4300, FEDORA-2015-4303, FEDORA-2015-6855, FreeBSD-SA-15:06.openssl, HPSBUX03334, JSA10680, MDVSA-2015:062, MDVSA-2015:063, NetBSD-SA2015-007, NTAP-20150323-0002, openSUSE-SU-2015:0554-1, openSUSE-SU-2015:1277-1, openSUSE-SU-2016:0640-1, RHSA-2015:0715-01, RHSA-2015:0716-01, RHSA-2015:0752-01, RHSA-2016:1087-01, RHSA-2016:1088-01, RHSA-2016:1089-01, SA40001, SOL16301, SOL16302, SOL16317, SOL16319, SOL16320, SOL16321, SOL16323, SPL-98351, SPL-98531, SSA:2015-111-09, SSRT102000, SUSE-SU-2015:0541-1, SUSE-SU-2015:0553-1, SUSE-SU-2015:0553-2, SUSE-SU-2015:0578-1, TNS-2015-04, TSB16661, USN-2537-1, VIGILANCE-VUL-16341.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

The OpenSSL product implements the Elliptic Curves algorithm.

However, the d2i_ECPrivateKey() function frees a memory area before reusing it.

An attacker can therefore force the usage of a freed memory area in d2i_ECPrivateKey() of OpenSSL, in order to trigger a denial of service, and possibly to execute code.
Full Vigil@nce bulletin... (Free trial)

This vulnerability note impacts software or systems such as ArubaOS, ProxySG par Blue Coat, SGOS by Blue Coat, FabricOS, Brocade Network Advisor, Cisco ASR, AnyConnect VPN Client, Cisco ACE, ASA, AsyncOS, Cisco CSS, Cisco ESA, IOS XE Cisco, Cisco IPS, IronPort Email, IronPort Web, Nexus by Cisco, NX-OS, Prime Infrastructure, Cisco PRSM, Cisco Router, Secure ACS, Cisco CUCM, Cisco Unified CCX, Cisco IP Phone, Cisco MeetingPlace, Cisco Wireless IP Phone, WebNS, Cisco WSA, Debian, BIG-IP Hardware, TMOS, Fedora, FreeBSD, hMailServer, HP-UX, AIX, IRAD, Security Directory Server, Tivoli Directory Server, Tivoli Workload Scheduler, WebSphere MQ, Juniper J-Series, Junos OS, Junos Pulse, Junos Space, Junos Space Network Management Platform, Juniper Network Connect, NSM Central Manager, NSMXpress, Juniper SBR, Data ONTAP 7-Mode, NetBSD, NetScreen Firewall, ScreenOS, OpenBSD, OpenSSL, openSUSE, openSUSE Leap, Oracle Communications, Solaris, pfSense, RHEL, Base SAS Software, SAS SAS/CONNECT, Slackware, Splunk Enterprise, SUSE Linux Enterprise Desktop, SLES, Nessus, Ubuntu, Unix (platform) ~ not comprehensive, WinSCP.

Our Vigil@nce team determined that the severity of this cybersecurity vulnerability is important.

The trust level is of type confirmed by the editor, with an origin of document.

An attacker with a expert ability can exploit this computer threat note.

Solutions for this threat

OpenSSL: version 1.0.2a.
The version 1.0.2a is fixed:
  https://www.openssl.org/

OpenSSL: version 1.0.1m.
The version 1.0.1m is fixed:
  https://www.openssl.org/

OpenSSL: version 1.0.0r.
The version 1.0.0r is fixed:
  https://www.openssl.org/

OpenSSL: version 0.9.8zf.
The version 0.9.8zf is fixed:
  https://www.openssl.org/

OpenSSL: patch for d2i_ECPrivateKey.
A patch is available in information sources.

ArubaOS: solution for OpenSSL.
The solution is indicated in information sources.

Blue Coat ProxySG: version 6.2.16.4.
The version 6.2.16.4 is fixed.

Blue Coat ProxySG: version 6.5.7.5.
The version 6.5.7.5 is fixed.

Brocade: solution for OpenSSL (12/05/2015).
The solution is indicated in information sources.

Cisco: solution for OpenSSL.
The solution is indicated in information sources.

Citrix NetScaler: fixed versions for LOM Firmware.
Fixed versions are indicated in information sources.

Citrix NetScaler Platform IPMI LOM: solution.
The solution is indicated in information sources.

Debian: new openssl packages.
New packages are available:
  Debian 7: openssl 1.0.1e-2+deb7u16

F5 BIG-IP: solution for OpenSSL.
The solution is indicated in information sources.

Fedora 21: new mingw-openssl packages.
New packages are available:
  Fedora 21: mingw-openssl 1.0.2a-1.fc21

Fedora: new openssl packages (22/06/2015).
New packages are available:
  Fedora 22: openssl 1.0.1k-10.fc22
  Fedora 21: openssl 1.0.1k-10.fc21

Fedora: new openssl packages (23/03/2015).
New packages are available:
  Fedora 20: openssl 1.0.1e-42.fc20
  Fedora 21: openssl 1.0.1k-6.fc21

FreeBSD: patch for OpenSSL.
A patch is available:
FreeBSD 8.4, 9.3:
  https://security.FreeBSD.org/patches/SA-15:06/openssl-0.9.8.patch
  https://security.FreeBSD.org/patches/SA-15:06/openssl-0.9.8-errata.patch
FreeBSD 10.1:
  fetch https://security.FreeBSD.org/patches/SA-15:06/openssl-1.0.1.patch
  fetch https://security.FreeBSD.org/patches/SA-15:06/openssl-1.0.1-errata.patch

hMailServer: version 5.6.2.
The version 5.6.2 is fixed:
  https://www.hmailserver.com/download

HP-UX: fixed versions for OpenSSL.
Fixed versions are indicated in information sources.

IBM AIX: patch for OpenSSL.
A patch is available:
  ftp://aix.software.ibm.com/aix/efixes/security/openssl_fix13.tar

IBM Rational Application Developer: solution for OpenSSL.
The solution is indicated in information sources.

IBM Security/Tivoli Directory Server: patch for GSKit.
A patch is available in information sources.

IBM Tivoli Workload Scheduler Application: solution for OpenSSL.
The solution is indicated in information sources.

Juniper: fixed versions for OpenSSL-19/03/2015.
Fixed versions are indicated in information sources.

Juniper: solution for OpenSSL.
The solution is indicated in information sources.

LibreSSL: version 2.1.6.
The version 2.1.6 is fixed:
  http://www.libressl.org/

Mandriva BS1: new openssl packages.
New packages are available:
  Mandriva BS1: openssl 1.0.0r-1.mbs1

Mandriva BS2: new openssl packages.
New packages are available:
  Mandriva BS2: openssl 1.0.1m-1.mbs2

Nessus: version 5.2.9.
The version 5.2.9 is fixed:
  http://www.tenable.com/

Nessus: version 6.3.4.
The version 6.3.4 is fixed:
  http://www.tenable.com/

NetApp Data ONTAP: patch for OpenSSL 03/2015.
A patch is available:
  Data ONTAP Edge: http://mysupport.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=899856
  Data ONTAP operating in 7-Mode: http://mysupport.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=899855
  Data ONTAP SMI-S Agent: http://mysupport.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=899852

NetBSD: patch for OpenSSL (20/08/2015).
A patch is available in information sources.

OpenBSD: patch for OpenSSL.
A patch is available:
  http://ftp.openbsd.org/pub/OpenBSD/patches/5.5/common/024_openssl.patch.sig
  http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/020_openssl.patch.sig

openSUSE 13.2: new libressl packages.
New packages are available:
  openSUSE 13.2: libressl 2.2.1-2.3.1

openSUSE: new libopenssl0_9_8 packages.
New packages are available:
  openSUSE 13.2: libopenssl0_9_8 0.9.8zh-9.3.1
  openSUSE Leap 42.1: libopenssl0_9_8 0.9.8zh-14.1

openSUSE: new openssl packages.
New packages are available:
  openSUSE 13.1: openssl 1.0.1k-11.68.1
  openSUSE 13.2: openssl 1.0.1k-2.20.1

Oracle Communications: CPU of October 2017.
A Critical Patch Update is available.

pfSense: version 2.2.2.
The version 2.2.2 is fixed:
  https://pfsense.org/products/

Red Hat JBoss Web Server: version 3.0.3.
The version 3.0.3 is fixed.

Red Hat Storage Server 2.1: new openssl packages.
New packages are available:
  RHEL 6: openssl 1.0.1e-30.el6_6.7

RHEL: new openssl packages.
New packages are available:
  RHEL 6: openssl 1.0.1e-30.el6_6.7
  RHEL 7: openssl 1.0.1e-42.el7_1.4

SAS: solution for OpenSSL.
The solution is indicated in information sources.

Slackware: new openssl packages.
New packages are available:
  Slackware 13.0: openssl 0.9.8zf-*-1_slack13.0
  Slackware 13.1: openssl 0.9.8zf-*-1_slack13.1
  Slackware 13.37: openssl 0.9.8zf-*-1_slack13.37
  Slackware 14.0: openssl 1.0.1m-*-1_slack14.0
  Slackware 14.1: openssl 1.0.1m-*-1_slack14.1

Snare Enterprise Agent for MSSQL: version 1.3.4.
The version 1.3.4 is fixed:
  https://snaresupport.intersectalliance.com/

Snare Enterprise Agent for Windows: version 4.2.12.
The version 4.2.12 is fixed:
  https://snaresupport.intersectalliance.com/

Solaris: patch for OpenSSL.
A patch is available:
  https://support.oracle.com/rs?type=doc&id=1448883.1

Splunk Enterprise: version 6.2.3.
The version 6.2.3 is fixed:
  http://www.splunk.com/

Splunk Enterprise: versions 5.0.13, 6.0.9 and 6.1.8.
Versions 5.0.13, 6.0.9 and 6.1.8 are fixed:
  http://www.splunk.com/

SUSE LE 12: new openssl packages.
New packages are available:
  SUSE LE 12: openssl 1.0.1i-20.1

Ubuntu: new libssl packages.
New packages are available:
  Ubuntu 14.10: libssl1.0.0 1.0.1f-1ubuntu9.4
  Ubuntu 14.04 LTS: libssl1.0.0 1.0.1f-1ubuntu2.11
  Ubuntu 12.04 LTS: libssl1.0.0 1.0.1-4ubuntu5.25
  Ubuntu 10.04 LTS: libssl0.9.8 0.9.8k-7ubuntu8.27

WebSphere MQ: version 8.0.0.3.
The version 8.0.0.3 is fixed:
  http://www-01.ibm.com/support/docview.wss?rs=171&uid=swg21959554

WinSCP: version 5.7.1.
The version 5.7.1 is fixed:
  http://winscp.net/
Full Vigil@nce bulletin... (Free trial)

Computer vulnerabilities tracking service

Vigil@nce provides a systems vulnerabilities note. The Vigil@nce security watch publishes vulnerability bulletins about threats impacting the information system. The technology watch team tracks security threats targeting the computer system. The Vigil@nce vulnerability database contains several thousand vulnerabilities.