Out-of-bounds read in OpenSSL - CVE-2017-3735

Vulnerability identifier: #VU8487

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-3735

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to one-byte out-of-bounds read when parsing an IPAddressFamily extension in an X.509 certificate. A remote attacker can disguise text display of the certificate.

OpenSSL
FL SWITCH 3006T-2FX ST
FL SWITCH 4008T-2GT-3FX SM
FL SWITCH 4008T-2GT-4FX SM
FL SWITCH 4008T-2SFP
FL SWITCH 3006T-2FX SM
FL SWITCH 3016T
FL SWITCH 3016
FL SWITCH 3016E
FL SWITCH 3012E-2SFX
FL SWITCH 4808E-16FX LC-4GC
FL SWITCH 3006T-2FX
FL SWITCH 3008T
FL SWITCH 3008
FL SWITCH 3004T-FX ST
FL SWITCH 3004T-FX
FL SWITCH 3005T
FL SWITCH 3005
FL SWITCH 4824E-4GC
FL SWITCH 4004T-8POE-4SFP
FL SWITCH 4000T-4POE-1SFP
FL SWITCH 3012E-2FX
FL SWITCH 4000T-8POE-2SFP-R
FL SWITCH 3012E-2FX SM
FL SWITCH 4800E-24FX SM-4GC
FL SWITCH 4800E-24FX-4GC
FL SWITCH 4012T-2GT-2FX ST
FL SWITCH 4012T 2GT 2FX
FL SWITCH 4808E-16FX SM LC-4GC
FL SWITCH 4808E-16FX-4GC
FL SWITCH 4808E-16FX ST-4GC
FL SWITCH 4808E-16FX SM ST-4GC
FL SWITCH 4808E-16FX SM-4GC
Amazon Linux AMI
Debian Linux
Arch Linux
Gentoo Linux
IBM AIX
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power
FreeBSD
macOS
SUSE Linux
Ubuntu
openEuler
Fedora
openssl (Alpine package)
openssl
compat-openssl10
shim-debuginfo
shim-debugsource
shim
Tivoli Network Manager IP Edition
IBM MQ
NetWorker
IBM Cognos Business Intelligence Server
Cognos Insight
IBM Cognos Analytics
Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch Firmware
SBR Carrier

Update to version 1.0.2m or 1.1.0g.

openssl (Alpine package) - addressed in versions 1.0.2m-r0, 1.0.2n-r0
IBM Cognos Analytics - update to 11.0.13
openssl - addressed in versions 1.0.2m-1.fc25, 1.1.0g-1.fc26, 1.1.0g-1.fc27
compat-openssl10 - addressed in versions 1.0.2m-1.fc26, 1.0.2m-1.fc27
Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch Firmware - update to 3.6.6000
SBR Carrier - addressed in versions 8.4.1R13, 8.5.0R4
shim-debuginfo - update to 15-23
shim-debugsource - update to 15-23
shim - update to 15-23
NetWorker - update to 19.10.0.0

• https://www.openssl.org/news/secadv/20170828.txt
• https://www.openssl.org/news/secadv/20171102.txt

• Spoofing attack in OpenSSL
• Debian update for openssl1.0
• Debian update for openssl
• Ubuntu update for OpenSSL
• Arch Linux update for openssl
• Arch Linux update for lib32-openssl
• SUSE Linux update for openssl
• FreeBSD update for OpenSSL
• Multiple vulnerabilities in Apple macOS/OS X
• Gentoo update for OpenSSL
• Arch Linux update for openssl-1.0
• Spoofing attack in IBM AIX
• Arch Linux update for lib32-openssl-1.0
• SUSE Linux update for openssl
• SUSE Linux update for openssl
• Multiple vulnerabilities in IBM WebSphere MQ
• Multiple vulnerabilities in IBM Cognos Insight
• Multiple vulnerabilities in IBM Cognos Business Intelligence Server
• Multiple vulnerabilities in IBM Cognos Analytics
• Amazon Linux AMI update for openssl
• Multiple vulnerabilities in PHOENIX CONTACT FL SWITCH
• Red Hat update for openssl
• Out-of-bounds read in openssl (Alpine package)
• Out-of-bounds read in IBM Tivoli Network Manager IP Edition
• Juniper Networks Steel-Belted Radius (SBR) Carrier update for OpenSSL
• Multiple vulnerabilities in Dell Networker
• openEuler update for shim
• Fedora 27 update for openssl
• Fedora 26 update for openssl
• Fedora 25 update for openssl
• Fedora 27 update for compat-openssl10
• Fedora 26 update for compat-openssl10
• Multiple vulnerabilities in IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch Firmware