ESB-2018.1127 - [Juniper] OpenSSL: Multiple vulnerabilities 2018-04-12
Printable versionPGP/GPG verifiable version
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2018.1127 Security Bulletin: OpenSSL Security Advisory [07 Dec 2017] 12 April 2018 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: OpenSSL Publisher: Juniper Networks Operating System: Juniper Impact/Access: Access Confidential Data -- Remote/Unauthenticated Denial of Service -- Remote/Unauthenticated Provide Misleading Information -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2017-3738 CVE-2017-3737 CVE-2017-3736 CVE-2017-3735 Reference: ASB-2017.0209 ASB-2017.0202 ESB-2017.2838 ESB-2017.2822 Original Bulletin: https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10851 - --------------------------BEGIN INCLUDED TEXT-------------------- 2018-04 Security Bulletin: OpenSSL Security Advisory [07 Dec 2017] CVSS Score: 6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Risk Level: Medium Risk Assessment: Information for how Juniper Networks uses CVSS can be found at KB 16446 "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories." Product Affected: This issue affects many products and platforms, including Junos OS, NorthStar, NSM, CTPView, and CTPOS Problem: The OpenSSL project has published a security advisory for vulnerabilities resolved in the OpenSSL library on December 7, 2017. The following is a summary of these vulnerabilities and their status with respect to Juniper products: CVE CVSS Summary 5.3 ( While parsing an IPAddressFamily extension in an X.509 CVSS:3.0/ certificate, it is possible to do a one-byte overread. AV:N/AC:L This would result in an incorrect text display of the CVE-2017-3735 /PR:N/ certificate. This bug has been present since 2006 and UI:N/S:U/ is present in all versions of OpenSSL before 1.0.2m and C:N/I:L/ 1.1.0g. A:N) There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH 6.5 ( are considered just feasible (although very difficult) CVSS:3.0/ because most of the work necessary to deduce AV:N/AC:L information about a private key may be performed CVE-2017-3736 /PR:L/ offline. The amount of resources required for such an UI:N/S:U/ attack would be very significant and likely only C:H/I:N/ accessible to a limited number of attackers. An A:N) attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen. OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), 5.9 ( however due to a bug it does not work correctly if CVSS:3.0/ SSL_read() or SSL_write() is called directly. In that AV:N/AC:H scenario, if the handshake fails then a fatal error CVE-2017-3737 /PR:N/ will be returned in the initial function call. If UI:N/S:U/ SSL_read()/SSL_write() is subsequently called by the C:H/I:N/ application for the same SSL object then it will A:N) succeed and the data is passed without being decrypted/ encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read ()/SSL_write() being issued after having already received a fatal error. OpenSSL version 1.0.2b-1.0.2m are affected. Fixed in OpenSSL 1.0.2n. OpenSSL 1.1.0 is not affected. There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of 5.9 ( resources required for such an attack would be CVSS:3.0/ significant. However, for an attack on TLS to be AV:N/AC:H meaningful, the server would have to share the DH1024 CVE-2017-3738 /PR:N/ private key among multiple clients, which is no longer UI:N/S:U/ an option since CVE-2016-0701. This only affects C:H/I:N/ processors that support the AVX2 but not ADX extensions A:N) like Intel Haswell (4th generation). Note: The impact from this issue is similar to CVE-2017-3736, CVE-2017-3732 and CVE-2015-3193. OpenSSL version 1.0.2-1.0.2m and 1.1.0-1.1.0g are affected. Fixed in OpenSSL 1.0.2n. Due to the low severity of this issue we are not issuing a new release of OpenSSL 1.1.0 at this time. The fix will be included in OpenSSL 1.1.0h when it becomes available. The fix is also available in commit e502cc86d in the OpenSSL git repository. Solution: Junos: The following software releases have been updated to resolve this specific issue: 12.3X48-D70, 14.1R9, 14.1X53-D130, 14.1X53-D47, 15.1R6-S6, 15.1R7, 15.1X49-D130, 15.1X53-D233, 15.1X53-D471, 15.1X53-D59, 15.1X53-D67, 16.1R3-S8, 16.1R5-S4, 16.1R6-S3, 16.2R1-S6, 16.2R2-S5, 17.1R2-S6, 17.2R2-S3, 17.3R3*, 17.4R2*, 18.1R1, and all subsequent releases. *Late availability NorthStar: The following software releases have been updated to resolve this specific issue: NorthStar 3.0.2, 3.1.1, 3.2.1, and all subsequent releases. NSM: The following software releases have been updated to resolve this specific issue: 2012.2R14, and all subsequent releases. CTPView: The following software releases have been updated to resolve this specific issue: 7.3R4, 7.4R2, and all subsequent releases. CTPOS: The following software releases have been updated to resolve this specific issue: 7.3R4, 7.4R1, and all subsequent releases. This advisory will be updated as additional products are analyzed and fixes become available. These issues are being tracked as PR 1328891, 1328901, 1328898, 1328896, 1328895 and 1250405 which are visible on the Customer Support website. Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL). Workaround: Junos: Since SSL is used for remote network configuration and management applications such as J-Web and SSL Service for JUNOScript (XNM-SSL), viable workarounds for this issue in Junos may include: Disabling J-Web Disable SSL service for JUNOScript and only use Netconf, which makes use of SSH, to make configuration changes Limit access to J-Web and XNM-SSL from only trusted networks Others: Limit the exploitable attack surface of critical infrastructure networking equipment. Use access lists or firewall filters to limit access to the device via SSL only from trusted, administrative networks or hosts. Implementation: Software Releases, patches and updates are available at https://www.juniper.net/support/downloads/. Modification History: 2018-04-11: Initial Publication - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBWs69vIx+lLeg9Ub1AQiWOQ/+LzbPPSIUvbtsnjR0sUtO7JkcRvhCgccc pnjkCjAtHyifqmxrJkeap/dmJb2Gxqx44i2Bc24nGN7sKzzzYDboYJTW+J2xW/q7 5JQ/MLXTJYVTX+zjCSaxobkQxfZJTG+ypuHw8Tb7LkcIyemMBFOXpe5aS1bhppUC E2m5j3sgTNmrsU4Kp5nVKPGEU44765NUppW8LO/WBEhNoNc//UZ6/hQKzPLFYQbi 7v1UHsqqlS4hZTuq0NarOr9pgX1bC1MC3rOksn/oyqSpf3tEh6u+ba2oa0UTxx1/ V7SI64qhwcItQU5Fx5QzwbgNJ/cArbaQzS1rIGmD/Pmb9PkZ7NSYSCPXik5DZrd3 gyh5AuEnJ7uER+48BSfw5P5C/nftPlsDjoSjnz0ZsLTs2nP0lA2nbmrJ7JIQNq4o u795Z3Gz3q/A9u/ex8BvXE7NKYoMpnfMKf5yKgN1MCVOgGiB6tZepL0p//zlfoSd cs+nLyb4UghIH06TzgelA6rT9ogf1gKik4dM4R6z/37TmTc/kSbKF+n64SKoKSWJ LiG5NsYtzSb3eZv5xKSs/UDM6N5gHHPzEov/C0m2jRuksLH0lkYVSSqbj6O1ocuE CM7bNFBG/mjaoZDEKwSH+zKb9elFGz55MccyzMwrCVO8qSaiCAp2CXsFOHUvxAEe jl8eU+7+Cmg= =yEse -----END PGP SIGNATURE-----« Back to bulletins