NULL pointer dereference in OpenSSL - CVE-2017-3730
Published: January 27, 2017 / Updated: September 14, 2018
Vulnerability identifier: #VU5440
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-3730
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to cause denial of service.
The vulnerability exists in OpenSSL due to NULL pointer dereference error when processing specially crafted parameters for a Diffie-Hellman Key Exchange (DHE) or Elliptic Curve Diffie-Hellman Exchange (ECDHE), received from malicious server. A remote attacker can trick the victim into connecting to a specially crafted website and trigger NULL pointer dereference error in client software.
Successful exploitation of the vulnerability may allow an attacker to perform denial of service (DoS) attack against vulnerable client software.
Affected software
OpenSSL
Gentoo Linux
SnapDrive for Windows
Storage Defender – Data Protect
Data ONTAP operating in 7-Mode
Gentoo Linux
SnapDrive for Windows
Storage Defender – Data Protect
Data ONTAP operating in 7-Mode
How to mitigate CVE-2017-3730
Update OpenSSL to version 1.1.0d.
SnapDrive for Windows - update to 7.1.4P1
Data ONTAP operating in 7-Mode - update to 8.2.5
Storage Defender – Data Protect - update to 1.4.0
Data ONTAP operating in 7-Mode - update to 8.2.5
Storage Defender – Data Protect - update to 1.4.0