Bug 1202351 (CVE-2015-0207)

Summary: CVE-2015-0207 openssl: DTLS segmentation fault in DTLSv1_listen
Product: [Other] Security Response Reporter: Martin Prpič <mprpic>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aavati, acathrow, alonbl, bazulay, bmcclain, cdewolf, cfergeau, dandread, darran.lofthouse, dblechte, dknox, ecohen, erik-fedora, gklein, idith, iheim, jason.greene, jawilson, jboss-set, jclere, jdoyle, ktietz, lfarkas, lgao, lsurette, marcandre.lureau, mehmetgelisin, michal.skrivanek, myarboro, nlevinki, pgier, pslavice, rbalakri, rfortier, rhs-bugs, rh-spice-bugs, rjones, rsvoboda, security-response-team, sgirijan, smohan, ssaha, tmraz, twalsh, vbellur, vtunka, weli, yeylon
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: openssl 1.0.2a Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-03-18 03:43:14 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1202442    

Description Martin Prpič 2015-03-16 13:02:53 UTC 
The DTLSv1_listen function is intended to be stateless and processes the initial ClientHello from many peers. It is common for user code to loop over the call to DTLSv1_listen until a valid ClientHello is received with an associated cookie. A defect in the implementation of DTLSv1_listen means that the state is preserved in the SSL object from one invocation to the next, leading to a segmentation fault. Errors processing the initial ClientHello can trigger this scenario. An example of such an error could be that a DTLS 1.0 only client is attempting to connect to a DTLS 1.2 only server.

This issue affects OpenSSL version 1.0.2, and is fixed in version 1.0.2a.

Acknowledgements:

Red Hat would like to thank the OpenSSL project for reporting this issue. Upstream acknowledges Per Allansson as the original reporters.
Comment 1 Huzaifa S. Sidhpurwala 2015-03-18 03:43:14 UTC 
Statement:

This issue did not affect the versions of openssl as shipped with Red Hat Enterprise Linux 5, 6, and 7.
Comment 2 Martin Prpič 2015-03-19 14:34:51 UTC 
External References:

https://openssl.org/news/secadv_20150319.txt
https://access.redhat.com/articles/1384453
Comment 3 Tomas Hoger 2015-03-19 15:43:17 UTC 
Upstream commit:

https://git.openssl.org/?p=openssl.git;a=commitdiff;h=819418110b6fff4a7b96f01a5d68f71df3e3b736