Out-of-bounds read in OpenSSL - CVE-2017-3731

Vulnerability identifier: #VU5420

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-3731

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause denial of service conditions.

The vulnerability exists due to out-of-bounds read in OpenSSL when processing truncated packets on 32-bit system using certain ciphers. A remote attacker can send a specially crafted truncated packet using CHACHA20/POLY1305 cipher for OpenSSL 1.1.0 or RC4-MD5 for 1.0.2 and trigger denial of service.

Successful exploitation of the vulnerability may allow an attacker to perform denial of service (DoS) attack against vulnerable system.

OpenSSL
Arch Linux
Gentoo Linux
Amazon Linux AMI
Fedora
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Server for ARM
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - Extended Update Support
FreeBSD
SUSE Linux
Ubuntu
Slackware Linux
Opensuse
openssl (Alpine package)
Data ONTAP operating in 7-Mode
openssl101e
openssl (Red Hat package)
openssl
MySQL Server

SnapDrive for Windows
NetWorker

Update OpenSSL to version 1.0.2k or 1.1.0d.

openssl (Alpine package) - update to 1.0.2k-r0
SnapDrive for Windows - update to 7.1.4P1
Data ONTAP operating in 7-Mode - update to 8.2.5
openssl101e - update to 1.0.1e-10.el5
openssl (Red Hat package) - addressed in versions 1.0.1e-48.el6_8.4, 1.0.1e-60.el7_3.1
openssl - addressed in versions 1.0.2k-1.fc24, 1.0.2k-1.fc25
NetWorker - update to 19.10.0.0

• https://www.openssl.org/news/secadv/20170126.txt

• Multiple vulnerabilities in OpenSSL
• FreeBSD update for OpenSSL
• Gentoo update for OpenSSL
• Ubuntu update for OpenSSL
• Slackware Linux update for openssl
• Amazon Linux AMI update for openssl
• Multiple vulnerabilities in Oracle MySQL Server
• openSUSE update for openssl-steam
• OpenSUSE Linux update for mysql-community-server
• SUSE Linux update for openssl
• Arch Linux update for lib32-openssl
• Arch Linux update for openssl
• Out-of-bounds read in openssl (Alpine package)
• Multiple vulnerabilities in N series Products
• Multiple vulnerabilities in Dell Networker
• Fedora 25 update for openssl
• Fedora 24 update for openssl
• Fedora EPEL 5 update for openssl101e
• Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7 update for openssl