PT-2015-1687 · Openssl+1 · Openssl+3

David Ramos · Published 2015-03-19 · Updated 2022-12-13 · CVE-2015-0291

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 1.0.2a

Description The issue is related to the sigalgs implementation in OpenSSL, which allows remote attackers to cause a denial of service by using an invalid signature algorithms extension in the ClientHello message during a renegotiation. This can lead to a NULL pointer dereference and daemon crash. The vulnerability is associated with pointer dereference errors.

Recommendations For versions prior to 1.0.2a, update to version 1.0.2a or later to resolve the issue. As a temporary workaround, consider restricting the use of the signature algorithms extension in the ClientHello message to minimize the risk of exploitation.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2015-11033

CVE-2015-0291

Affected Products

Cisco Asa

Cisco Ios Xe

Cisco Nexus

Openssl

References · 23

• https://security.gentoo.org/glsa/201503-11 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=144050155601375&w=2 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150320-openssl · Vendor Advisory
• http://marc.info/?l=bugtraq&m=144050297101809&w=2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-11033 · Security Note
• http://oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html · Patch
• http://marc.info/?l=bugtraq&m=143748090628601&w=2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0291 · Security Note
• https://openssl.org/news/secadv_20150319.txt · Vendor Advisory
• http://oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html · Note
• http://securityfocus.com/bid/73235 · Note
• http://oracle.com/technetwork/topics/security/cpujul2015-2367936.html · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1202338 · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf · Note
• http://fortiguard.com/advisory/2015-03-24-openssl-vulnerabilities-march-2015 · Note