OpenSSL SSL2 master key buffer overflow

openssl-ssl2-masterkey-bo (9714) The risk level is classified as HighHigh Risk

Description:

OpenSSL is vulnerable to a buffer overflow, caused by improper handling of SSL2 client master keys. By sending an overly long SSL2 client master key, a remote attacker could overflow a buffer and execute arbitrary code with elevated privileges or cause the system to crash.

Platforms Affected:

  • Compaq, OpenVMS
  • Debian, Debian Linux 2.2
  • Debian, Debian Linux 3.0
  • EngardeLinux, Secure Linux
  • MandrakeSoft, Mandrake Linux 7.1
  • MandrakeSoft, Mandrake Linux 7.2
  • MandrakeSoft, Mandrake Linux 8.0 PPC
  • MandrakeSoft, Mandrake Linux 8.0
  • MandrakeSoft, Mandrake Linux 8.1 IA64
  • MandrakeSoft, Mandrake Linux 8.1
  • MandrakeSoft, Mandrake Linux 8.2
  • MandrakeSoft, Mandrake Linux 8.2 PPC
  • MandrakeSoft, Mandrake Linux Corporate Server 1.0.1
  • OpenPKG, OpenPKG 1.0
  • OpenPKG, OpenPKG CURRENT
  • OpenSSL, OpenSSL 0.9.6 Beta3
  • OpenSSL, OpenSSL 0.9.6 Beta2
  • OpenSSL, OpenSSL 0.9.6
  • OpenSSL, OpenSSL 0.9.6 Beta1
  • OpenSSL, OpenSSL 0.9.6a
  • OpenSSL, OpenSSL 0.9.6a Beta3
  • OpenSSL, OpenSSL 0.9.6a Beta2
  • OpenSSL, OpenSSL 0.9.6a Beta1
  • OpenSSL, OpenSSL 0.9.6b
  • OpenSSL, OpenSSL 0.9.6c
  • OpenSSL, OpenSSL 0.9.6d
  • OpenSSL, OpenSSL 0.9.7
  • OpenSSL, OpenSSL 0.9.7 Beta2
  • OpenSSL, OpenSSL 0.9.7 Beta1
  • Oracle, Application Server 1.0.2.0
  • Oracle, Application Server 1.0.2.1
  • Oracle, Application Server 1.0.2.2
  • RedHat, Enterprise Linux 2.1 AS
  • RedHat, Linux 6.2
  • RedHat, Linux 7
  • RedHat, Linux 7.1
  • RedHat, Linux 7.2
  • RedHat, Linux 7.3
  • Trustix, Secure Linux 1.1
  • Trustix, Secure Linux 1.2
  • Trustix, Secure Linux 1.5

Remedy:

For vulnerability detection:

Enable the following checks in the ISS Protection Platform:
OpensslSsl2MasterkeyBo
openssl-ssl2-masterkey-bo

For Virtual Patch:

Enable the following checks in the ISS Protection Platform:
SSL2_Master_Key_Overflow

For Manual Protection:

Upgrade to the latest version of OpenSSL (0.9.6e or later), available from the OpenSSL Project Web site. See References.

— OR —

Apply the patch for this vulnerability, available from the OpenSSL Project Web site. See References.

For OpenPKG 1.0:
Upgrade to the latest OpenSSL package (0.9.6b-1.0.1 or later) or (0.9.6e or later), as listed in OpenPKG Security Advisory OpenPKG-SA-2002.008. See References.

For Debian GNU/Linux 3.0:
Upgrade to the latest OpenSSL packages (0.9.4-6 or later), (0.9.5a-6 or later), and (0.9.6c-2 or later), as listed in DSA-136-1. See References.

For EnGarde Secure Linux Community Edition:
Upgrade to the latest OpenSSL package (0.9.6-1.0.16 or later), as listed in EnGarde Secure Linux Security Advisory ESA-20020730-019. See References.

For Trustix Secure Linux:
Upgrade to the latest OpenSSL package, as listed below. Refer to Trustix Secure Linux Security Advisory #2002-0063 for more information. See References.

Trustix 1.1 and 1.2: openssl-0.9.6-3tr or later

Trustix 1.5: openssl-0.9.6-10tr

For Red Hat Linux:
Upgrade to the latest OpenSSL package, as listed below. Refer to RHSA-2002:155-11 for more information. See References.

Red Hat 6.2: openssl-0.9.5a-26 or later

Red Hat 7.0 and 7.1: openssl-0.9.6-10 or later

Red Hat 7.2 and 7.3: openssl096-0.9.6-9 or later

For SuSE Linux:
Upgrade to the latest OpenSSL package, as listed below. Refer to SuSE Security Announcement SuSE-SA:2002:027 for more information. See References.

SuSE Linux 8.0 (Intel): 0.9.6c-78 or later
SuSE Linux 7.3 (Intel): 0.9.6b-147 or later
SuSE Linux 7.1 and 7.2 (Intel): 0.9.6a-63 or later
SuSE Linux 7.0 (Intel): 0.9.5a-59 or later
SuSE Linux 7.3 (Sparc): 0.9.6b-136 or later
SuSE Linux 7.1 (Sparc): 0.9.6a-23 or later
SuSE Linux 7.0 (Sparc): 0.9.5a-8 or later

For Mandrake Linux:
Upgrade to the latest OpenSSL package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2002:046 : openssl for more information. See References.

Linux Mandrake 7.1, Corporate Server 1.0.1: 0.9.5a-4.1mdk or later
Linux Mandrake 7.2 and Single Network Firewall 7.2: 0.9.5a-9.1mdk or later
Mandrake Linux 8.0: 0.9.6-8.1mdk or later
Mandrake Linux 8.1: 0.9.6b-1.1mdk or later
Mandrake Linux 8.2: 0.9.6c-2.1mdk or later

For Caldera OpenLinux 3.1 and 3.1.1 Workstation and Server: Upgrade to the latest OpenSSL packages (0.9.6-19 or later), as listed in Caldera International, Inc. Security Advisory CSSA-2002-033.1. See References.

For FreeBSD:
Apply the patch for this vulnerability, as listed in FreeBSD, Inc. Security Advisory FreeBSD-SA-02:33.openssl. See References.

For Compaq/Hewlett-Packard:
Apply SoftPaq SP21932 for this vulnerability, as listed in the Hewlett-Packard Software and Drivers Web page. See References.

For other distributions:
Contact your vendor for upgrade or patch information.

Consequences:

Gain Access

References:

Reported:

Jul 30, 2002

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.

For corrections or additions please email xforce@iss.net

Return to the main page