SB2017022107 - Fedora EPEL 5 update for openssl101e

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2017-3731)

The vulnerability allows a remote attacker to cause denial of service conditions.

The vulnerability exists due to out-of-bounds read in OpenSSL when processing truncated packets on 32-bit system using certain ciphers. A remote attacker can send a specially crafted truncated packet using CHACHA20/POLY1305 cipher for OpenSSL 1.1.0 or RC4-MD5 for 1.0.2 and trigger denial of service.

Successful exploitation of the vulnerability may allow an attacker to perform denial of service (DoS) attack against vulnerable system.

2) Denial of service (CVE-ID: CVE-2016-8610)

The vulnerability allows a remote unauthenticated user to exhaust memory on the target system.
The weakness is due to improper handling of certain packets by the ssl3_read_bytes() function in 'ssl/s3_pkt.c.
By sending a flood of SSL3_AL_WARNING alerts during the SSL handshake, a remote attacker can consume excessive CPU resources that may lead to OpenSSL library being unavailable.
Successful exploitation of the vulnerability results in denial of service on the vulnerable system.

3) Information disclosure (CVE-ID: CVE-2016-7056)

The vulnerability allows a local user obtain potentially sensitive information.

The vulnerability exists due the OpenSSL does not properly set the BN_FLG_CONSTTIME for nonces when signing with the P-256 elliptic curve in ecdsa_sign_setup() function in crypto/ec/ecdsa_ossl.c. A local attacker can conduct a cache-timing attack and recover ECDSA P-256 private keys

Successful exploitation of this vulnerability may allow an attacker to obtain potentially sensitive information.

The vulnerability is discovered in OpenSSL 1.0.1u. Other versions may also be affected.

Remediation

Install update from vendor's website.

References

• https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2017-90b2cbfdaf