PT-2017-3943 · Openssl+2 · Openssl+2

Guido Vranken · Published 2017-01-26 · Updated 2019-04-25 · CVE-2017-3730

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.1.0 through 1.1.0d

Description The issue is related to a null pointer dereference in the OpenSSL library. This can be exploited by a remote attacker to cause a denial of service. If a malicious server provides bad parameters for a DHE or ECDHE key exchange, the client may attempt to dereference a null pointer, leading to a client crash. This could be exploited in a denial of service attack.

Recommendations For versions 1.1.0 through 1.1.0d, update to version 1.1.0d or later to resolve the issue. As a temporary workaround, consider restricting the use of DHE or ECDHE key exchange until a patch is available.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2020-02908

CVE-2017-3730

Affected Products

Cisco Ios Xe

Huawei Vrp

Openssl

References · 21

• 🔥 https://exploit-db.com/exploits/41192 · Exploit
• 🔥❌ https://github.com/guidovranken/CVE-2017-3730 · Exploit, Deleted
• https://github.com/openssl/openssl/commit/efbe126e3ebb9123ac9d058aa2bb044261342aaa · Patch
• https://openssl.org/news/secadv/20170126.txt · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpujan2018-3236628.html · Patch
• https://security-tracker.debian.org/tracker/CVE-2017-3730 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170130-openssl · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-3730 · Vendor Advisory
• https://security.gentoo.org/glsa/201702-07 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3730 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3730 · Security Note
• https://oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html · Patch
• http://oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html · Patch
• https://bdu.fstec.ru/vul/2020-02908 · Security Note
• https://osv.dev/vulnerability/CVE-2017-3730 · Vendor Advisory