Bug 1228611 (CVE-2014-8176) - CVE-2014-8176 OpenSSL: Invalid free in DTLS
Summary: CVE-2014-8176 OpenSSL: Invalid free in DTLS
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-8176
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1228618 1228619 1228620 1228621 1231051 1242976 1242977 1242978 1242979
Blocks: 1227577 1395463
TreeView+ depends on / blocked
 
Reported: 2015-06-05 10:23 UTC by Huzaifa S. Sidhpurwala
Modified: 2021-02-17 05:13 UTC (History)
23 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
An invalid-free flaw was found in the way OpenSSL handled certain DTLS handshake messages. A malicious DTLS client or server could send a specially crafted message to the peer, which could cause the application to crash or potentially result in arbitrary code execution.
Clone Of:
Environment:
Last Closed: 2019-06-08 02:41:49 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:1115 0 normal SHIPPED_LIVE Moderate: openssl security update 2015-06-16 00:48:46 UTC
Red Hat Product Errata RHSA-2016:2957 0 normal SHIPPED_LIVE Important: Red Hat JBoss Core Services Apache HTTP 2.4.23 Release 2016-12-16 03:11:19 UTC

Description Huzaifa S. Sidhpurwala 2015-06-05 10:23:49 UTC 
The following was reported by OpenSSL upstream:

This vulnerability does not affect current versions of OpenSSL. It existed in previous OpenSSL versions and was fixed in June 2014.

If a DTLS peer receives application data between the ChangeCipherSpec and Finished messages, buffering of such data may cause an invalid free, resulting in a segmentation fault or potentially, memory corruption.

This issue affected older OpenSSL versions 1.0.1, 1.0.0 and 0.9.8.

OpenSSL 0.9.8 DTLS users should upgrade to 0.9.8za
OpenSSL 1.0.0 DTLS users should upgrade to 1.0.0m.
OpenSSL 1.0.1 DTLS users should upgrade to 1.0.1h.

This issue was originally reported on March 28th 2014 in https://rt.openssl.org/Ticket/Display.html?id=3286 by Praveen Kariyanahalli, and subsequently by Ivan Fratric and Felix Groebert (Google). A fix was developed by zhu qun-ying.


Acknowledgements:

Red Hat would like to thank the OpenSSL project for reporting this issue.
Comment 1 Huzaifa S. Sidhpurwala 2015-06-05 10:39:16 UTC 
Upstream patches:

OpenSSL-1.0.1:
https://github.com/openssl/openssl/commit/bcc31166

OpenSSL-0.9.8:
https://github.com/openssl/openssl/commit/4b258e73
Comment 3 Huzaifa S. Sidhpurwala 2015-06-12 04:18:40 UTC 
Reference:

https://www.openssl.org/news/secadv_20150611.txt
Comment 4 Huzaifa S. Sidhpurwala 2015-06-12 05:56:15 UTC 
Created openssl tracking bugs for this issue:

Affects: fedora-all [bug 1231051]
Comment 5 errata-xmlrpc 2015-06-15 20:49:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 6

Via RHSA-2015:1115 https://rhn.redhat.com/errata/RHSA-2015-1115.html
Comment 6 Huzaifa S. Sidhpurwala 2015-06-16 01:36:24 UTC 
Statement:

This issue does NOT affect the version of OpenSSL package as shipped with Red Hat Enterprise Linux 5.
Comment 13 errata-xmlrpc 2016-12-15 22:14:32 UTC 
This issue has been addressed in the following products:



Via RHSA-2016:2957 https://rhn.redhat.com/errata/RHSA-2016-2957.html
Note You need to log in before you can comment on or make changes to this bug.