Vulnerabilities > CVE-2016-7053 - NULL Pointer Dereference vulnerability in Openssl 1.1.0/1.1.0A/1.1.0B

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
low complexity
openssl
CWE-476
nessus

Summary

In OpenSSL 1.1.0 before 1.1.0c, applications parsing invalid CMS structures can crash with a NULL pointer dereference. This is caused by a bug in the handling of the ASN.1 CHOICE type in OpenSSL 1.1.0 which can result in a NULL value being passed to the structure callback if an attempt is made to free certain invalid encodings. Only CHOICE structures using a callback which do not handle NULL value are affected.

Vulnerable Configurations

Part Description Count
Application
Openssl
3

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyWindows
    NASL idHP_INTELLIGENT_MANAGEMENT_CENTER_7_3_E0504P04.NASL
    descriptionThe version of HPE Intelligent Management Center (iMC) PLAT installed on the Windows host is prior to 7.3 E0504P04. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-5815) - A command injection vulnerability exists in the dbman service due to improper validation of user-supplied input before it is passed to a system call. An unauthenticated, remote attacker can exploit this, via a specially crafted opcode 10008 request, to inject and execute arbitrary OS commands with SYSTEM privileges. (CVE-2017-5816) - Multiple command injection vulnerabilities exist in the dbman service due to improper validation of user-supplied input before it is passed to a system call. An unauthenticated, remote attacker can exploit these, via a specially crafted opcode 10007 request, to inject and execute arbitrary OS commands with SYSTEM privileges. (CVE-2017-5817, CVE-2017-5819) - A flaw exists in the dbman service when handling opcode 10007 requests due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to delete arbitrary files with SYSTEM privileges. (CVE-2017-5818) - A flaw exists in the dbman service when handling opcode 10004 requests due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary code. (CVE-2017-5820) - A flaw exists in the dbman service when handling opcode 10006 and 10010 requests due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially request, to execute arbitrary code. (CVE-2017-5821) - A flaw exists in the dbman service when handling opcode 10010 requests due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary code. (CVE-2017-5822) - A flaw exists in the dbman service when handling opcode 10013 requests due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary code. (CVE-2017-5823) - A NULL pointer deference flaw exists, specifically in the asn1_item_embed_d2i() function within file crypto/asn1/tasn_dec.c, when handling the ASN.1 CHOICE type, which results in a NULL value being passed to the structure callback if an attempt is made to free certain invalid encodings. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-7053) - A heap overflow condition exists in the chacha20_poly1305_cipher() function within file crypto/evp/e_chacha20_poly1305.c when handling TLS connections using *-CHACHA20-POLY1305 cipher suites. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-7054) - A carry propagation error exists in the Broadwell-specific Montgomery multiplication procedure when handling input lengths divisible by but longer than 256 bits. This can result in transient authentication and key negotiation failures or reproducible erroneous outcomes of public-key operations with specially crafted input. A man-in-the-middle attacker can possibly exploit this issue to compromise ECDH key negotiations that utilize Brainpool P-512 curves. (CVE-2016-7055) - An unspecified remote code execution vulnerability exists that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-8948) - A stack-based buffer overflow condition exists due to improper validation of input when copying data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-8956) Note that Intelligent Management Center (iMC) is an HPE product; however, it is branded as H3C.
    last seen2020-06-01
    modified2020-06-02
    plugin id100869
    published2017-06-19
    reporterThis script is Copyright (C) 2017-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/100869
    titleH3C / HPE Intelligent Management Center PLAT < 7.3 E0504P04 Multiple Vulnerabilities
  • NASL familyWeb Servers
    NASL idOPENSSL_1_1_0C.NASL
    descriptionAccording to its banner, the version of OpenSSL running on the remote host is 1.1.0 prior to 1.1.0c. It is, therefore, affected by multiple vulnerabilities : - A NULL pointer deference flaw exists, specifically in the asn1_item_embed_d2i() function within file crypto/asn1/tasn_dec.c, when handling the ASN.1 CHOICE type, which results in a NULL value being passed to the structure callback if an attempt is made to free certain invalid encodings. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-7053) - A heap overflow condition exists in the chacha20_poly1305_cipher() function within file crypto/evp/e_chacha20_poly1305.c when handling TLS connections using *-CHACHA20-POLY1305 cipher suites. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-7054) - A carry propagation error exists in the Broadwell-specific Montgomery multiplication procedure when handling input lengths divisible by but longer than 256 bits. This can result in transient authentication and key negotiation failures or reproducible erroneous outcomes of public-key operations with specially crafted input. An unauthenticated, remote attacker can possibly exploit this issue to compromise ECDH key negotiations that utilize Brainpool P-512 curves. (CVE-2016-7055)
    last seen2020-06-01
    modified2020-06-02
    plugin id94963
    published2016-11-18
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/94963
    titleOpenSSL 1.1.0 < 1.1.0c Multiple Vulnerabilities
  • NASL familyMisc.
    NASL idHP_IMC_73_E0504P04.NASL
    descriptionThe version of HPE Intelligent Management Center (iMC) PLAT installed on the remote host is prior to 7.3 E0504P04. It is, therefore, affected by multiple vulnerabilities : - A NULL pointer deference flaw exists, specifically in the asn1_item_embed_d2i() function within file crypto/asn1/tasn_dec.c, when handling the ASN.1 CHOICE type, which results in a NULL value being passed to the structure callback if an attempt is made to free certain invalid encodings. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-7053) - A heap overflow condition exists in the chacha20_poly1305_cipher() function within file crypto/evp/e_chacha20_poly1305.c when handling TLS connections using *-CHACHA20-POLY1305 cipher suites. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-7054) - A carry propagation error exists in the Broadwell-specific Montgomery multiplication procedure when handling input lengths divisible by but longer than 256 bits. This can result in transient authentication and key negotiation failures or reproducible erroneous outcomes of public-key operations with specially crafted input. A man-in-the-middle attacker can possibly exploit this issue to compromise ECDH key negotiations that utilize Brainpool P-512 curves. (CVE-2016-7055) - An unspecified flaw exists that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-5815) - A command injection vulnerability exists in the dbman service due to improper validation of user-supplied input before it is passed to a system call. An unauthenticated, remote attacker can exploit this, via a specially crafted opcode 10008 request, to inject and execute arbitrary OS commands with SYSTEM privileges. (CVE-2017-5816) - Multiple command injection vulnerabilities exist in the dbman service due to improper validation of user-supplied input before it is passed to a system call. An unauthenticated, remote attacker can exploit these, via a specially crafted opcode 10007 request, to inject and execute arbitrary OS commands with SYSTEM privileges. (CVE-2017-5817, CVE-2017-5819) - A flaw exists in the dbman service when handling opcode 10007 requests due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to delete arbitrary files with SYSTEM privileges. (CVE-2017-5818) - A flaw exists in the dbman service when handling opcode 10004 requests due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary code. (CVE-2017-5820) - A flaw exists in the dbman service when handling opcode 10006 and 10010 requests due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially request, to execute arbitrary code. (CVE-2017-5821) - A flaw exists in the dbman service when handling opcode 10010 requests due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary code. (CVE-2017-5822) - A flaw exists in the dbman service when handling opcode 10013 requests due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary code. (CVE-2017-5823) - An unspecified remote code execution vulnerability exists that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-8948) - A stack-based buffer overflow condition exists due to improper validation of input when copying data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-8956) Note that Intelligent Management Center (iMC) is an HPE product; however, it is branded as H3C.
    last seen2020-06-01
    modified2020-06-02
    plugin id100868
    published2017-06-19
    reporterThis script is Copyright (C) 2017-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/100868
    titleH3C / HPE Intelligent Management Center PLAT < 7.3 E0504P04 Multiple Vulnerabilities
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_50751310A76311E6A881B499BAEBFEAF.NASL
    descriptionOpenSSL reports : - ChaCha20/Poly1305 heap-buffer-overflow (CVE-2016-7054) Severity: High TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger payloads. This can result in an OpenSSL crash. This issue is not considered to be exploitable beyond a DoS. - CMS Null dereference (CVE-2016-7053) Severity: Medium Applications parsing invalid CMS structures can crash with a NULL pointer dereference. This is caused by a bug in the handling of the ASN.1 CHOICE type in OpenSSL 1.1.0 which can result in a NULL value being passed to the structure callback if an attempt is made to free certain invalid encodings. Only CHOICE structures using a callback which do not handle NULL value are affected. - Montgomery multiplication may produce incorrect results (CVE-2016-7055)i Severity: Low There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure that handles input lengths divisible by, but longer than 256 bits.
    last seen2020-06-01
    modified2020-06-02
    plugin id94691
    published2016-11-11
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/94691
    titleFreeBSD : openssl -- multiple vulnerabilities (50751310-a763-11e6-a881-b499baebfeaf)

The Hacker News

idTHN:82BC3700070E6531BDA9B4A8023496B6
last seen2018-01-27
modified2016-11-10
published2016-11-10
reporterMohit Kumar
sourcehttps://thehackernews.com/2016/11/openssl-patch-update.html
titleOpenSSL Releases Patch For "High" Severity Vulnerability