Out-of-bounds read in openssl (Alpine package)

1) Out-of-bounds read

EUVDB-ID: #VU5420

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2017-3731

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause denial of service conditions.

The vulnerability exists due to out-of-bounds read in OpenSSL when processing truncated packets on 32-bit system using certain ciphers. A remote attacker can send a specially crafted truncated packet using CHACHA20/POLY1305 cipher for OpenSSL 1.1.0 or RC4-MD5 for 1.0.2 and trigger denial of service.

Successful exploitation of the vulnerability may allow an attacker to perform denial of service (DoS) attack against vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

openssl (Alpine package): 1.0.2c-r0 - 1.0.2j-r2

CPE2.3

• cpe:2.3:a:alpine:openssl_alpine_package:1.0.2c-r0:*:*:*:*:alpine_linux:*:3.1
• cpe:2.3:a:alpine:openssl_alpine_package:1.0.2i-r0-r0:*:*:*:*:alpine_linux:*:3.2
• cpe:2.3:a:alpine:openssl_alpine_package:1.0.2h-r0:*:*:*:*:alpine_linux:*:3.1

External links

https://git.alpinelinux.org/aports/commit/?id=3eb2d51b3b6d1670a7763dddd331789b32fc36ad
https://git.alpinelinux.org/aports/commit/?id=a84acb79718101fdfd08d8fd21c5b8ce30cb6531
https://git.alpinelinux.org/aports/commit/?id=f8bf827fae4885976509355d07182af03796ddda

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.