ISS X-Force Database: openssl-sslgetsharedciphers-bo(29237): OpenSSL SSL_get_shared

OpenSSL SSL_get_shared_ciphers() buffer overflow

openssl-sslgetsharedciphers-bo (29237)

High Risk

Description:

OpenSSL is vulnerable to a buffer overflow, caused by improper bounds checking by the SSL_get_shared_ciphers() function. By sending an overly long list of ciphers to an application that uses the vulnerable function, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash.

Platforms Affected:

Apple, Mac OS X 10.3.9
Apple, Mac OS X 10.4.8
Apple, Mac OS X Server 10.3.9
Apple, Mac OS X Server 10.4.8
Canonical, Ubuntu 5.04
Canonical, Ubuntu 5.10
Canonical, Ubuntu 6.06 LTS
Cisco, Access Registrar
Cisco, Application and Content Networking Software
Cisco, Application Control Engine Module 1.1
Cisco, CallManager Express
Cisco, CiscoWorks Common Management Foundation
Cisco, CiscoWorks Common Services
Cisco, Content Services Switch 11500 7.50
Cisco, Content Services Switch 11500 8.10
Cisco, CS-MARS 4.2.2
Cisco, GSS 4480 Global Site Selector
Cisco, GSS 4490 Global Site Selector
Cisco, GSS 4491 Global Site Selector
Cisco, GSS 4492 Global Site Selector
Cisco, IDS
Cisco, MDS 9500
Cisco, ONS 15454
Cisco, Secure Access Control Server
Cisco, Security Agent 5.1
Cisco, SIP Proxy Server
Cisco, Unified CallManager 4.1
Cisco, Unified Presence Server
Cisco, Wide Area Application Services
Cisco, Wide Area File Services Software
Cisco, Wireless LAN Controller 4.0
Compaq, Insight Management Agents 3.5.2
Compaq, Tru64 5.1b3
Compaq, Tru64 5.1b4
Debian, Debian Linux 3.1
FreeBSD, FreeBSD
Gentoo, Linux
HP, System Management Homepage 2.1
HP, System Management Homepage 2.1.1
HP, System Management Homepage 2.1.2
HP, System Management Homepage 2.1.3
HP, System Management Homepage 2.1.4
HP, System Management Homepage 2.1.5
HP, System Management Homepage 2.1.6
Kolab, Kolab Server 2.0.4 and prior
Kolab, Kolab Server 2.1 beta 2 and prior
MandrakeSoft, Mandrake Linux 2006
MandrakeSoft, Mandrake Linux 2006 X86_64
MandrakeSoft, Mandrake Linux 2007
MandrakeSoft, Mandrake Linux 2007 X86_64
MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
MandrakeSoft, Mandrake Linux Corporate Server 3.0
MandrakeSoft, Mandrake Linux Corporate Server 4.0 X86_64
MandrakeSoft, Mandrake Linux Corporate Server 4.0
MandrakeSoft, Mandrake Multi Network Firewall 2.0
Novell, Linux Desktop 9
Novell, Linux POS 9
Novell, Open Enterprise Server
Novell, Open Enterprise Server
Novell, UnitedLinux 1.0
OpenPKG, OpenPKG 2-STABLE
OpenPKG, OpenPKG 2.5
OpenPKG, OpenPKG CURRENT
OpenSSL, OpenSSL 0.9.7
OpenSSL, OpenSSL 0.9.7 Beta6
OpenSSL, OpenSSL 0.9.7 Beta5
OpenSSL, OpenSSL 0.9.7 Beta4
OpenSSL, OpenSSL 0.9.7 Beta3
OpenSSL, OpenSSL 0.9.7 Beta2
OpenSSL, OpenSSL 0.9.7 Beta1
OpenSSL, OpenSSL 0.9.7a
OpenSSL, OpenSSL 0.9.7b
OpenSSL, OpenSSL 0.9.7c
OpenSSL, OpenSSL 0.9.7d
OpenSSL, OpenSSL 0.9.7e
OpenSSL, OpenSSL 0.9.7f
OpenSSL, OpenSSL 0.9.7g
OpenSSL, OpenSSL 0.9.7h
OpenSSL, OpenSSL 0.9.7i
OpenSSL, OpenSSL 0.9.7j
OpenSSL, OpenSSL 0.9.7k
OpenSSL, OpenSSL 0.9.8
OpenSSL, OpenSSL 0.9.8a
OpenSSL, OpenSSL 0.9.8b
OpenSSL, OpenSSL 0.9.8c
OpenVPN, OpenVPN 2.0.9
RedHat, Enterprise Linux 2.1 ES
RedHat, Enterprise Linux 2.1 WS
RedHat, Enterprise Linux 2.1 AS
RedHat, Enterprise Linux 3 Desktop
RedHat, Enterprise Linux 3 WS
RedHat, Enterprise Linux 3 ES
RedHat, Enterprise Linux 3 AS
RedHat, Enterprise Linux 4 ES
RedHat, Enterprise Linux 4 AS
RedHat, Enterprise Linux 4 WS
RedHat, Enterprise Linux 4 Desktop
RedHat, Enterprise Linux ES
RedHat, Enterprise Linux WS
RedHat, Enterprise Linux AS
RedHat, Linux Advanced Workstation 2.1 Itanium
RedHat, Network Satellite Server 4.2
RedHat, Network Satellite Server 5.0
RedHat, Network Satellite Server 5.1
Slackware, Slackware Linux 10.0
Slackware, Slackware Linux 9.0
Slackware, Slackware Linux 9.1
Sun, Solaris 10 x86
Sun, Solaris 10 SPARC
Sun, Solaris 9 SPARC
Sun, Solaris 9 x86
SuSE, Linux Enterprise Server 8
SuSE, SuSE Linux 10.0
SuSE, SuSE Linux 10.1
SuSE, SuSE Linux 9.2
SuSE, SuSE Linux 9.3
SuSE, SuSE Linux Desktop 1.0
SuSE, SuSE Linux OpenExchange Server 4
SuSE, SuSE Linux Retail Solution 8
SuSE, SuSE Linux School Server
SuSE, SuSE Linux Standard Server 8
SuSE, SuSE SLED 10
SuSE, SuSE SLES 10
SuSE, SuSE SLES 9
Turbolinux, Turbolinux 10 Desktop
Turbolinux, Turbolinux 10 F...
Turbolinux, Turbolinux 10 Server
Turbolinux, Turbolinux 10 Server x64 Ed
Turbolinux, Turbolinux 11 Server
Turbolinux, Turbolinux 11 Server x64 Ed
Turbolinux, Turbolinux 7 Server
Turbolinux, Turbolinux 8 Server
Turbolinux, Turbolinux FUJI
Turbolinux, Turbolinux Home
Turbolinux, Turbolinux Multimedia
Turbolinux, Turbolinux Personal
Turbolinux, Turbolinux wizpy
Turbolinux, Turbolinux Appliance Server 1.0 Hosting Ed
Turbolinux, Turbolinux Appliance Server 1.0 Workgroup Ed
Turbolinux, Turbolinux Appliance Server 2.0
Xerox, WorkCentre 7655
Xerox, WorkCentre 7665
Xerox, WorkCentre 232
Xerox, WorkCentre 238
Xerox, WorkCentre 245
Xerox, WorkCentre 255
Xerox, WorkCentre 265
Xerox, WorkCentre 275

Remedy:

Apply Apple Security Update 2006-007, available from the Apple Web site. See References.

Upgrade to the latest version of OpenSSL (0.9.7l or 0.9.8d or later), as listed in OpenSSL Security Advisory [28th September 2006]. See References.

For Ubuntu Linux:
Refer to USN-353-1 for patch, upgrade, or workaround information. See References.

For FreeBSD:
Refer to FreeBSD-SA-06:23.openssl for patch, upgrade, or workaround information. See References.

For Debian GNU/Linux:
Refer to DSA-1185-1 for patch, upgrade, or suggested workaround information. See References.

For Debian GNU/Linux (openssl096):
Refer to DSA-1195-1 for patch, upgrade, or suggested workaround information. See References.

For Red Hat Linux:
Refer to RHSA-2006:0695-12 for patch, upgrade, or suggested workaround information. See References.

For Kolab Server:
Refer to Kolab Security Issue 11 20061002 for patch, upgrade, or suggested workaround information. See References.

For Mandriva Linux:
Refer to MDKSA-2006:172-1 for patch, upgrade, or suggested workaround information. See References.

For OpenVPN:
Refer to OpenVPNT 2.0.x Change Log for patch, upgrade, or suggested workaround information. See References.

For Gentoo Linux:
Refer to Gentoo Linux Security Announcement GLSA 200610-11 for patch, upgrade, or suggested workaround information. See References.

For Gentoo Linux AMD64 x86:
Refer to Gentoo Linux Security Announcement GLSA 200612-11 for patch, upgrade, or suggested workaround information. See References.

For Cisco:
Refer to cisco-sr-20061108-openssl for upgrade information. See References.

For VMware:
Refer to Full-Disclosure Mailing List, Tue Jan 9 02:17:36 GMT 2007 for patch, upgrade, or suggested workaround information. See References.

For SUSE Linux:
Refer to SUSE-SA:2006:058 for patch, upgrade, or suggested workaround information. See References.

For HP Tru64 UNIX (OpenSSL):
Refer to HPSBTU02207 SSRT061239 rev.2 for patch, upgrade, or suggested workaround information. See References.

For HP System Management Homepage:
Refer to HPSBMA02250 SSRT061275 rev.1 for patch, upgrade, or suggested workaround information. See References.

For Sun Solaris:
Refer to Sun Alert ID: 102711 for patch, upgrade, or suggested workaround information. See References.

For Xerox:
Refer to XEROX SECURITY BULLETIN XRX07-001 for patch, upgrade, or suggested workaround information. See References.

For other distributions:
Apply the appropriate update for your system. See References.

Consequences:

Gain Access

References:

Apple Security Update 2006-007, About the security content of Security Update 2006-007 at http://docs.info.apple.com/article.html?artnum=304829.
cisco-sr-20061108-openssl, Cisco Security Response: Multiple Vulnerabilities in OpenSSL Library at http://www.cisco.com/warp/public/707/cisco-sr-20061108-openssl.shtml.
FreeBSD-SA-06:23.openssl , Multiple problems in crypto(3) at http://security.FreeBSD.org/advisories/FreeBSD-SA-06:23.openssl.asc.
Full-Disclosure Mailing List, Mon Jan 08 2007 - 20:17:36 CST, VMware ESX server security updates at http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0170.html.
Full-Disclosure Mailing List, Thu Sep 28 2006 - 07:44:23 CDT, [SECURITY] OpenSSL 0.9.8d and 0.9.7l released at http://archives.neohapsis.com/archives/fulldisclosure/2006-09/0508.html.
HPSBMA02250 SSRT061275 rev.1 , HP System Management Homepage (SMH) for Linux and Windows, Remote Execution of Arbitrary Code and Denial of Service (DoS) at http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01118771&jumpid=reg_R1002_USEN.
HPSBTU02207 SSRT061239 rev.2 , HP Tru64 UNIX OpenSSL and BIND Remote Arbitrary Code Execution or Denial of Service (DoS) at http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00967144.
IBM Systems Support Web site, Support for HMC at https://www14.software.ibm.com/webapp/set2/sas/f/hmc/power5/install/v61.Readme.html#MH01110.
Kolab Security Issue 11 20061002, openssl at http://kolab.org/security/kolab-vendor-notice-11.txt.
Nortel Networks Technical Bulletin Document ID 2006007439, Nortel response to OpenSSL SSL_Get_Shared_Ciphers Buffer Overflow Vulnerability - CVE-2006-3738 at http://www116.nortelnetworks.com/pub/repository/CLARIFY/DOCUMENT/2006/44/021420-01.pdf.
OpenSSL Security Advisory [28th September 2006], New OpenSSL releases are now available to correct four security issues. at http://www.openssl.org/news/secadv_20060928.txt.
OpenSSL Web site, OpenSSL:The Open Source toolkit for SSL/TLS at http://www.openssl.org/.
OpenVPN Web site, OpenVPNT 2.0.x Change Log at http://openvpn.net/changelog.html.
Sun Alert ID: 102711, Security Vulnerabilities in OpenSSL May Lead to a Denial of Service (DoS) to Applications or Execution of Arbitrary Code With Elevated Privileges at http://sunsolve.sun.com/search/document.do?assetkey=1-26-102711-1.
Xerox Web Site, XEROX SECURITY BULLETIN XRX07-001 at http://www.xerox.com/downloads/usa/en/c/cert_ESSNetwork_XRX07001_v1.pdf.
ASA-2006-220: openssl security update (RHSA-2006-0695)
ASA-2006-260: HP-UX OpenSSL Denial of Service (DoS) Increase Privilege (HPSBUX02174)
ASA-2007-006: Sun Alert Notifications from Sun Weekly Report dated Nov 11 2006
BID-20249: OpenSSL SSL_Get_Shared_Ciphers Buffer Overflow Vulnerability
BID-22083: Oracle January 2007 Security Update Multiple Vulnerabilities
CVE-2006-3738: Buffer overflow in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions has unspecified impact and remote attack vectors involving a long list of ciphers.
DSA-1185: openssl -- denial of service
DSA-1195: openssl096 -- denial of service (multiple)
GLSA-200610-11: OpenSSL: Multiple vulnerabilities
GLSA-200612-11: AMD64 x86 emulation base libraries: OpenSSL multiple vulnerabilities
GLSA-200710-06: OpenSSL: Multiple vulnerabilities
MDKSA-2006:172: Updated openssl packages fix vulnerabilities
MDKSA-2006:172-1: Updated openssl packages fix vulnerabilities
OpenPKG-SA-2006.021: OpenSSL
OSVDB ID: 29262: OpenSSL SSL_get_shared_ciphers Function Unspecified Remote Overflow
RHSA-2006-0695: openssl security update
RHSA-2008-0264: Moderate: Red Hat Network Satellite Server Solaris client security update
RHSA-2008-0525: Moderate: Red Hat Network Satellite Server Solaris client security update
RHSA-2008-0629: Moderate: Red Hat Network Satellite Server Solaris client security update
SA22094: FileZilla / FileZilla Server Multiple Vulnerabilities
SA22130: OpenSSL Multiple Vulnerabilities
SA22216: Kolab Server Multiple Vulnerabilities
SA22284: Serv-U FTP Server OpenSSL Multiple Vulnerabilities
SA22385: Avaya Products OpenSSL Multiple Vulnerabilities
SA22460: Sun Grid Engine Multiple OpenSSL Vulnerabilities
SA22626: SnapGear Multiple Vulnerabilities
SA22633: Nortel Products OpenSSL Vulnerability
SA22654: Nortel Communication Server OpenSSL Vulnerability
SA22758: Cisco Products OpenSSL Vulnerabilities
SA22772: cwRsync OpenSSL Vulnerabilities and OpenSSH Weakness
SA22791: Sun Solaris OpenSSL Vulnerabilities
SA22799: Cisco Products OpenSSL Vulnerabilities
SA23038: IBM HMC OpenSSH / OpenSSL Vulnerabilities
SA23155: Mac OS X Security Update Fixes Multiple Vulnerabilities
SA23340: Avaya PDS HP-UX Secure Shell / OpenSSL Multiple Vulnerabilities
SA23680: VMWare ESX Server Multiple Vulnerabilities
SA23794: Oracle Products Multiple Vulnerabilities
SA24930: HP Tru64 UNIX Multiple SSL and BIND Vulnerabilities
SA24950: HP Insight Management Agents SSL Vulnerabilities
SA25889: Xerox ESS/ Network Controller OpenSSL Vulnerabilities
SA26329: HP System Management Homepage Apache and OpenSSL Vulnerabilities
SA30161: Gentoo ltsp Multiple Vulnerabilities
SECTRACK ID: 1016943: OpenSSL ASN.1 Bugs, SSL_get_shared_ciphers() Buffer Overflow, and SSLv2 Client Error Lets Remote Users Denial of Service or Execute Arbitrary Code
SECTRACK ID: 1017522: Oracle Database and Other Products Have 52 Unspecified Vulnerabilities With Unspecified Impact
SUSE-SA:2006:058: openssl security problems
SUSE-SR:2006:024: SUSE Security Summary Report

Reported:

Sep 28, 2006

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page