ISS X-Force Database: openssl-sslgetshared-bo(36837): OpenSSL SSL_get_shared

OpenSSL SSL_get_shared_ciphers() off-by-one buffer overflow

openssl-sslgetshared-bo (36837)

High Risk

Description:

OpenSSL is vulnerable to an off-by-one buffer overflow, caused by improper bounds checking by the SSL_get_shared_ciphers() function. By sending multiple cipher strings to the last character of the current cipher string, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash.

Platforms Affected:

Apple, Mac OS X 10.4.11
Apple, Mac OS X 10.5.4
Apple, Mac OS X Server 10.4.11
Apple, Mac OS X Server 10.5.4
Avaya, Application Enablement Services 3.1.2
Avaya, Application Enablement Services 3.1.3
Avaya, Application Enablement Services 3.1.4
Avaya, Communication Manager 3.0
Avaya, Converged Communications Server 2.0
Avaya, Converged Communications Server 2.0.1
Avaya, Converged Communications Server 2.1
Avaya, Converged Communications Server 3.0
Avaya, Converged Communications Server 3.1
Avaya, Expanded Meet-Me Conferencing 1.017
Avaya, Expanded Meet-Me Conferencing 1.021
Avaya, SIP Enablement Services 2.0
Avaya, SIP Enablement Services 2.0.1
Avaya, SIP Enablement Services 2.1
Avaya, SIP Enablement Services 3.0
Avaya, SIP Enablement Services 3.1
Canonical, Ubuntu 6.06 LTS
Canonical, Ubuntu 6.10
Canonical, Ubuntu 7.04
Debian, Debian Linux 3.1
Debian, Debian Linux 4.0
FreeBSD, FreeBSD
Gentoo, Linux
IBM, HMC 6 R1.3
IBM, HMC 7 R3.2.0
MandrakeSoft, Mandrake Linux 2007 X86_64
MandrakeSoft, Mandrake Linux 2007
MandrakeSoft, Mandrake Linux 2007.1 X86_64
MandrakeSoft, Mandrake Linux 2007.1
MandrakeSoft, Mandrake Linux 2008.0 X86_64
MandrakeSoft, Mandrake Linux Corporate Server 3.0
MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
MandrakeSoft, Mandrake Linux Corporate Server 4.0 X86_64
MandrakeSoft, Mandrake Linux Corporate Server 4.0
MandrakeSoft, Mandrake Multi Network Firewall 2.0
OpenBSD, OpenBSD prior to 4.2
OpenSSL, OpenSSL 0.9.7
OpenSSL, OpenSSL 0.9.7 Beta1
OpenSSL, OpenSSL 0.9.7 Beta2
OpenSSL, OpenSSL 0.9.7 Beta3
OpenSSL, OpenSSL 0.9.7 Beta4
OpenSSL, OpenSSL 0.9.7 Beta5
OpenSSL, OpenSSL 0.9.7 Beta6
OpenSSL, OpenSSL 0.9.7a
OpenSSL, OpenSSL 0.9.7b
OpenSSL, OpenSSL 0.9.7c
OpenSSL, OpenSSL 0.9.7d
OpenSSL, OpenSSL 0.9.7e
OpenSSL, OpenSSL 0.9.7f
OpenSSL, OpenSSL 0.9.7g
OpenSSL, OpenSSL 0.9.7h
OpenSSL, OpenSSL 0.9.7i
OpenSSL, OpenSSL 0.9.7j
OpenSSL, OpenSSL 0.9.7k
OpenSSL, OpenSSL 0.9.8
OpenSSL, OpenSSL 0.9.8a
OpenSSL, OpenSSL 0.9.8b
OpenSSL, OpenSSL 0.9.8c
OpenSSL, OpenSSL 0.9.8d
OpenSSL, OpenSSL 0.9.8e
RedHat, Enterprise Linux 2.1 WS
RedHat, Enterprise Linux 2.1 ES
RedHat, Enterprise Linux 2.1 AS
RedHat, Enterprise Linux 3 Desktop
RedHat, Enterprise Linux 3 WS
RedHat, Enterprise Linux 3 ES
RedHat, Enterprise Linux 3 AS
RedHat, Enterprise Linux 4 WS
RedHat, Enterprise Linux 4 ES
RedHat, Enterprise Linux 4 AS
RedHat, Enterprise Linux 4 Desktop
RedHat, Enterprise Linux 5
RedHat, Enterprise Linux 5 Client Workstation
RedHat, Enterprise Linux 5 Client
RedHat, Linux Advanced Workstation 2.1 Itanium
Sun, Solaris 10 SPARC
Sun, Solaris 10 x86
SuSE, SuSE Linux
Turbolinux, Turbolinux 10 Server
Turbolinux, Turbolinux 10 Server x64 Ed
Turbolinux, Turbolinux 11 Server
Turbolinux, Turbolinux 11 Server x64 Ed
Turbolinux, Turbolinux 8 Server
Turbolinux, Turbolinux FUJI
Turbolinux, Turbolinux Multimedia
Turbolinux, Turbolinux Personal
Turbolinux, Turbolinux wizpy
Turbolinux, Turbolinux Appliance Server 1.0 Hosting Ed
Turbolinux, Turbolinux Appliance Server 1.0 Workgroup Ed
Turbolinux, Turbolinux Appliance Server 2.0
VMware, ESX Server 2.5.4
VMware, ESX Server 2.5.5
VMware, ESX Server 3.0.1
VMware, ESX Server 3.0.2
VMware, ESXi Server 3.5

Remedy:

Upgrade to the latest version of OpenSSL (0.98f or later), available from the OpenSSL Web site. See References.

For IBM HMC 6 Release 1.3:
Apply the Security fix for HMC Version 6 Release 1.3, available from the IBM Subscription service. See References.

For IBM HMC 7 Release 3.2.0:
Apply the Security fix for HMC Version 7 Release 3.2.0, available from the IBM Subscription service. See References.

Refer to VMSA-2008-0001 for patch, upgrade or suggested workaround information, available from the Security-announce Mailing List, Mon Jan 7 17:46:23 PST 2008. See References.

For other distributions:
Apply the appropriate update for your system. See References.

Consequences:

Gain Access

References:

Apple Web site, About Security Update 2008-005 at http://support.apple.com/kb/HT2647.
BugTraq Mailing List, Thu Sep 27 2007 - 11:21:40 CDT , OpenSSL SSL_get_shared_ciphers() off-by-one buffer overflow at http://archives.neohapsis.com/archives/bugtraq/2007-09/0383.html.
FreeBSD-SA-07:08.openssl , Buffer overflow in OpenSSL SSL_get_shared_ciphers() at http://security.freebsd.org/advisories/FreeBSD-SA-07:08.openssl.asc.
IBM Subscription service, Security fix for HMC Version 7 Release 3.2.0 at http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=4038.
IBM Subscription service, Security fix for HMC Version 6 Release 1.3 at http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=4037.
IBM Systems Support Web site, Support for HMC at https://www14.software.ibm.com/webapp/set2/sas/f/hmc/power5/install/v61.Readme.html#MH01110.
OpenBSD 4.2 release errata & patch list: 002: SECURITY FIX: October 10, 2007 , The SSL_get_shared_ciphers() function in OpenSSL contains an off-by-one overflow. at http://www.openbsd.org/errata42.html#002_openssl.
OpenSSL CVS Repository, OpenSSL_0_9_8-stable branch at http://cvs.openssl.org/.
OpenSSL Security Advisory [12-Oct-2007], flaw in OpenSSL's DTLS implementation which could lead to the compromise of clients and servers with DTLS enabled at http://www.openssl.org/news/secadv_20071012.txt.
OpenSSL Web site, OpenSSL:The Open Source toolkit for SSL/TLS at http://www.openssl.org/.
Security-announce Mailing List, Mon Jan 7 17:46:23 PST 2008 , VMSA-2008-0001 Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages at http://lists.vmware.com/pipermail/security-announce/2008/000002.html.
Sun Alert ID: 103130, Security Vulnerability in Solaris 10 OpenSSL SSL_get_shared_ciphers() Function at http://sunsolve.sun.com/search/document.do?assetkey=1-26-103130-1.
Sun Alert ID: 200858, Security Vulnerability in Solaris 10 OpenSSL SSL_get_shared_ciphers() Function at http://sunsolve.sun.com/search/document.do?assetkey=1-66-200858-1.
VMSA-2008-0013, Updated ESX packages for OpenSSL, net-snmp, perl at http://www.vmware.com/security/advisories/VMSA-2008-0013.html.
ASA-2007-481: Security Vulnerability in Solaris 10 OpenSSL SSL_get_shared_ciphers() Function (Sun 103130)
ASA-2007-485: OpenSSL security update (RHSA-2007-0813)
ASA-2007-522: HP-UX Running Apache Remote Execution of Arbitrary Code (HPSBUX02292)
ASA-2007-524: OpenSSL security and bug fix update (RHSA-2007-1003)
BID-25831: OpenSSL SSL_Get_Shared_Ciphers Off-by-One Buffer Overflow Vulnerability
CVE-2007-5135: Off-by-one error in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 up to 0.9.7l, and 0.9.8 up to 0.9.8f, might allow remote attackers to execute arbitrary code via a crafted packet that triggers a one-byte buffer underflow. NOTE: this issue was introduced as a result of a fix for CVE-2006-3738. As of 20071012, it is unknown whether code execution is possible.
DSA-1379: openssl -- off-by-one error/buffer overflow
FrSIRT/ADV-2007-3325: OpenSSL SSL_Get_Shared_Ciphers() Off-by-One Buffer Overflow Issue
FrSIRT/ADV-2007-3625: Sun Solaris OpenSSL SSL_get_shared_ciphers() Off-by-One Overflow
FrSIRT/ADV-2007-4042: HP-UX Security Update Fixes Apache OpenSSL Buffer Overflow Issue
FrSIRT/ADV-2007-4144: IBM Hardware Management Console Remote and Local Vulnerabilities
FrSIRT/ADV-2008-0064: VMware ESX Server Code Execution and Security Bypass Vulnerabilities
FrSIRT/ADV-2008-2268: Apple Mac OS X Code Execution and Security Bypass Vulnerabilities
GLSA-200710-06: OpenSSL: Multiple vulnerabilities
MDKSA-2007:193: Updated openssl packages fix vulnerabilities
RHSA-2007-0813: Moderate: openssl security update
RHSA-2007-0964: Important: openssl security update
RHSA-2007-1003: Moderate: openssl security and bug fix update
SA22130: OpenSSL Multiple Vulnerabilities
SA27394: Sun Solaris 10 OpenSSL "SSL_get_shared_ciphers()" Vulnerability
SA27870: Avaya Products OpenSSL Vulnerabilities
SA27961: IBM HMC Multiple Vulnerabilities
SA28368: VMware ESX Server Multiple Security Updates
SA28667: IBM Hardware Management Console Pegasus CIM Denial of Service
SA30161: Gentoo ltsp Multiple Vulnerabilities
SA31326: Apple Mac OS X Security Update Fixes Multiple Vulnerabilities
SA31467: VMware updates for OpenSSL, net-snmp, and perl
SA31489: VMware ESXi OpenSSL Vulnerabilities
SECTRACK ID: 1018755: OpenSSL Off-by-one Overflow in SL_get_shared_ciphers() Lets Remote Users Execute Arbitrary Code
SUSE-SR:2007:020: SUSE Security Summary Report
SUSE-SR:2008:005: SUSE Security Summary Report

Reported:

Sep 27, 2007

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page