Security Features in Nettle - CVE-2015-8803

Vulnerability identifier: #VU32325

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-8803

CWE-ID: CWE-254

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8805.

Nettle
nettle (Alpine package)
compat-nettle27
nettle
nettle (Red Hat package)
mingw-nettle
mingw-gnutls
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server for ARM
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Fedora

Install update from vendor's website.

Nettle - update to 3.2
nettle (Alpine package) - update to 2.7.1-r1
compat-nettle27 - update to 2.7.1-2.fc23
nettle - addressed in versions 2.7.1-6.fc22, 3.2-1.fc23
nettle (Red Hat package) - update to 2.7.1-8.el7
mingw-nettle - update to 3.2-1.fc23
mingw-gnutls - update to 3.4.9-1.fc23

• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176807.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177229.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177473.html
• http://lists.opensuse.org/opensuse-updates/2016-02/msg00091.html
• http://lists.opensuse.org/opensuse-updates/2016-02/msg00093.html
• http://lists.opensuse.org/opensuse-updates/2016-02/msg00100.html
• http://rhn.redhat.com/errata/RHSA-2016-2582.html
• http://www.openwall.com/lists/oss-security/2016/02/02/2
• http://www.openwall.com/lists/oss-security/2016/02/03/1
• http://www.ubuntu.com/usn/USN-2897-1
• https://blog.fuzzing-project.org/38-Miscomputations-of-elliptic-curve-scalar-multiplications-in-Nettle.html
• https://git.lysator.liu.se/nettle/nettle/commit/c71d2c9d20eeebb985e3872e4550137209e3ce4d
• https://lists.gnu.org/archive/html/info-gnu/2016-01/msg00006.html
• https://lists.lysator.liu.se/pipermail/nettle-bugs/2015/003028.html

• Security Features in GNU Nettle
• Security Features in nettle (Alpine package)
• Fedora 23 update for nettle
• Fedora 23 update for mingw-gnutls, mingw-nettle
• Fedora 22 update for nettle
• Fedora 23 update for compat-nettle27
• Red Hat Enterprise Linux 7 update for nettle