SB2016051113 - Fedora EPEL 5 update for openssl101e

Description

This security bulletin contains information about 8 secuirty vulnerabilities.

1) Memory corruption (CVE-ID: CVE-2016-2108)

The vulnerability allows a remote user to cause memory corruption on the target system.

The weakness exists due to buffer underflow with an out-of-bounds write in i2c_ASN1_INTEGER. As ASN.1 parser (specifically, d2i_ASN1_TYPE) can misinterpret a large universal tag as a negative zero value, attacker may easily corrupt memory.

Successful exploitation of the vulnerability will allow a malicious user to trigger memory corruption on the vulnerable system.

2) Heap overflow (CVE-ID: CVE-2016-2105)

The vulnerability allows a remote user to cause heap overflow on the target system.

The weakness is caused by insufficient input validation. By sending a great deal of input data attackers are able to cause overflow of the EVP_EncodeUpdate() function used for binary data encoding.

Successful exploitation of the vulnerability may result in heap overflow on the vulnerable system.

3) Input validation error (CVE-ID: CVE-2016-2106)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data.

4) Traffic decryption (CVE-ID: CVE-2016-2107)

The vulnerability allows a remote user to decrypt traffic on the target system.

The weakness is due to access control error.If the connection uses an AES CBC cipher and the server support AES-NI attackers can perform padding oracle attack.

Successful exploitation of the vulnerability leads to traffic decryption on the vulnerable system.

5) Buffer overflow (CVE-ID: CVE-2016-0799)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to fmtstr function in crypto/bio/b_print.c in OpenSSL improperly calculates string lengths. A remote attacker can cause a denial of service (overflow and out-of-bounds read) or possibly have unspecified other impact via a long string.

6) Buffer overflow (CVE-ID: CVE-2016-2842)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a doapr_outch function in crypto/bio/b_print.c in OpenSSL does not verify that a certain memory allocation succeeds. A remote attacker can cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string

7) Excessive memory allocation (CVE-ID: CVE-2016-2109)

The vulnerability allows a remote user to cause excessive memory allocation on the target system.

The weakness exists during reading ASN.1 data by d2i_CMS_bio() function. A short invalid encoding leads to distribution of large amounts of memory for excessive resources or exhausting memory.

Successful exploitation of the vulnerability may result in excessive memory allocation.

8) Information disclosure (CVE-ID: CVE-2016-0800)

The vulnerability allows a remote attacker to decrypt sensitive information.

The vulnerability exists due to usage of weak SSLv2 protocol, which requires to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data. A remote attacker can decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle.

The vulnerability is dubbed "DROWN" attack.

Remediation

Install update from vendor's website.

References

• https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-92e8b90065