Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.0386.2
SA141: OpenSSL Vulnerabilities 26-Jan-2017
10 February 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Bluecoat products
Publisher: Bluecoat
Operating System: Network Appliance
Impact/Access: Access Privileged Data -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2017-3732 CVE-2017-3731 CVE-2017-3730
Reference: ASB-2017.0012
ESB-2017.0317
ESB-2017.0254
Original Bulletin:
https://bto.bluecoat.com/security-advisory/sa141
Revision History: February 10 2017: Corrected publisher name
February 10 2017: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
https://bto.bluecoat.com/security-advisory/sa141SA141: OpenSSL Vulnerabilities 26-Jan-2017
Back to all Security AdvisoriesFollow
Security Advisories ID: SA141
Published Date: February 9, 2017
Advisory Status: Interim
Advisory Severity: Medium
CVSS v2 base score: TBD
CVE Number:
CVE-2017-3730
CVE-2017-3731
CVE-2017-3732
Blue Coat products using affected versions of OpenSSL are susceptible to
several vulnerabilities. A remote attacker can exploit these vulnerabilities
to cause denial of service and obtain private key information.
CVSS v2 base scores will be provided when the National Vulnerability Database
(NVD) scoring is complete. The advisory severity may be adjusted once the CVSS
v2 base scores become available.
Affected Products:
The following products are vulnerable:
CacheFlow
CacheFlow 3.4 is vulnerable to CVE-2017-3731. All SSL interfaces are affected.
Director
Director 6.1.22.1 is vulnerable to CVE-2017-3731. All SSL interfaces are
affected. Director 6.1 releases prior to 6.1.22.1 are not vulnerable.
IntelligenceCenter
IntelligenceCenter 3.3 is vulnerable to CVE-2017-3731. All SSL interfaces are
affected.
Malware Analysis Appliance
MAA 4.2 is vulnerable to CVE-2017-3732. All SSL interfaces are affected.
PacketShaper
PacketShaper 9.2 is vulnerable to CVE-2017-3731. All SSL interfaces are
affected.
PolicyCenter
PolicyCenter 9.2 is vulnerable to CVE-2017-3731. All SSL interfaces are
affected.
ProxyAV
ProxyAV 3.5 is vulnerable to CVE-2017-3731. All SSL interfaces are affected.
ProxySG
ProxySG 6.5 and 6.6 are vulnerable to CVE-2017-3731. All SSL interfaces are
affected.
SSL Visibility
SSLV 3.9, 3.10, and 3.11 are vulnerable to CVE-2017-3732. All SSL interfaces
are affected. SSL 3.8.4FC is not vulnerable.
Unified Agent
UA 4.6 and 4.7 are vulnerable to CVE-2017-3732. All SSL interfaces are
affected. UA 4.1 is not vulnerable.
The following products contain a vulnerable version of OpenSSL, but are not
vulnerable to known vectors of attack:
Advanced Secure Gateway
ASG 6.6 has a vulnerable version of OpenSSL.
Android Mobile Agent
Android Mobile Agent 1.3 prior to 1.3.8 has a vulnerable version of OpenSSL.
Content Analysis System
CAS 1.3 has a vulnerable version of OpenSSL.
Mail Threat Defense
MTD 1.1 has a vulnerable version of OpenSSL.
Management Center
MC 1.8 has a vulnerable version of OpenSSL.
Norman Shark Industrial Control System Protection
ICSP 5.3 has a vulnerable version of OpenSSL.
Norman Shark Network Protection
NNP 5.3 has a vulnerable version of OpenSSL.
Norman Shark SCADA Protection
NSP 5.3 has a vulnerable version of OpenSSL.
PacketShaper S-Series
PS S-Series 11.5, 11.6, and 11.7 have a vulnerable version of OpenSSL.
PolicyCenter S-Series
PC S-Series 1.1 has a vulnerable version of OpenSSL.
Reporter
Reporter 9.5 and 10.1 have a vulnerable version of OpenSSL. Reporter 9.4 is
not vulnerable.
Security Analytics
Security Analytics 6.6, 7.1, and 7.2 have a vulnerable version of OpenSSL.
X-Series XOS
XOS 9.7, 10.0, and 11.0 have a vulnerable version of OpenSSL.
The following products are not vulnerable:
AuthConnector
BCAAA
Blue Coat HSM Agent for the Luna SP
Client Connector
Cloud Data Protection for Salesforce
Cloud Data Protection for Salesforce Analytics
Cloud Data Protection for ServiceNow
Cloud Data Protection for Oracle CRM On Demand
Cloud Data Protection for Oracle Field Service Cloud
Cloud Data Protection for Oracle Sales Cloud
Cloud Data Protection Integration Server
Cloud Data Protection Communication Server
Cloud Data Protection Policy Builder
General Auth Connector Login Application
IntelligenceCenter Data Collector
K9
ProxyClient
ProxyAV ConLog and ConLogXP
Blue Coat no longer provides vulnerability information for the following
products:
DLP
Please, contact Digital Guardian technical support regarding vulnerability
information for DLP.
Advisory Details:
This Security Advisory addresses multiple vulnerabilities announced in OpenSSL
Security Advisory [26 Jan 2017]. Blue Coat products that include a vulnerable
version of OpenSSL and make use of the affected functionality are vulnerable.
CVE-2017-3730 is a NULL pointer dereference flaw in the SSL client
implementation. A remote attacker can send crafted DHE or ECDHE key
exchange parameters to an SSL client and cause an application crash,
resulting in denial of service.
CVE-2017-3731 is an out-of-bounds read flaw in the SSL client and server
implementations on 32-bit platforms. A remote attacker can send crafted
packets and cause an application crash, resulting in denial of service.
CVE-2017-3732 is a flaw in the 64-bit Montgomery squaring implementation
used in the RSA, DSA, and DHE algorithms. A remote attacker can exploit the
vulnerability to obtain private key information.
Blue Coat products that use a native installation of OpenSSL but do not install
or maintain that implementation are not vulnerable to any of these CVEs.
However, the underlying platform or application that installs and maintains
OpenSSL may be vulnerable. Blue Coat urges our customers to update the
versions of OpenSSL that are natively installed for Client Connector for OS X,
Proxy Client for OS X, and Reporter 9.x for Linux.
Some Blue Coat products do not enable or use all functionality within OpenSSL.
The products listed below do not utilize the functionality described in the
CVEs below and are thus not known to be vulnerable to them. However, fixes for
these CVEs will be included in the patches that are provided.
Android Mobile Agent: CVE-2017-3731
ASG: CVE-2017-3731
CAS: CVE-2017-3731
Director 6.1.22.1: CVE-2017-3732
MTD: CVE-2017-3731
MAA: CVE-2017-3731
MC: CVE-2017-3731
ICSP: CVE-2017-3731
NNP: CVE-2017-3731
NSP: CVE-2017-3731
PacketShaper S-Series: CVE-2017-3731
PolicyCenter S-Series: CVE-2017-3731
Reporter 9.5 and 10.1: CVE-2017-3731
Security Analytics: CVE-2017-3731
SSLV: CVE-2017-3731
Unified Agent: CVE-2017-3731
Patches:
Advanced Secure Gateway
ASG 6.6 - a fix is not available at this time.
Android Mobile Agent
Android Mobile Agent 1.3 - a fix is available in 1.3.8.
CacheFlow
CacheFlow 3.4 - a fix is not available at this time.
Content Analysis System
CAS 1.3 - a fix is not available at this time.
Director
Director 6.1 - a fix is not available at this time.
IntelligenceCenter
IntelligenceCenter 3.3 - a fix is not available at this time.
Mail Threat Defense
MTD 1.1 - a fix is not available at this time.
Malware Analysis Appliance
MAA 4.2 - a fix is not available at this time.
Management Center
MC 1.8 - a fix is not available at this time.
Norman Shark Industrial Control System Protection
ICSP 5.3 - a fix is not available at this time.
Norman Shark Network Protection
NNP 5.3 - a fix is not available at this time.
Norman Shark SCADA Protection
NSP 5.3 - a fix is not available at this time.
PacketShaper
PacketShaper 9.2 - a fix is not available at this time.
PacketShaper S-Series
PS S-Series 11.7 - a fix is not available at this time.
PS S-Series 11.6 - a fix will not be provided. Please upgrade to the latest
version with the vulnerability fixes.
PS S-Series 11.5 - a fix will not be provided. Please upgrade to the latest
version with the vulnerability fixes.
PolicyCenter
PolicyCenter 9.2 - a fix is not available at this time.
PolicyCenter S-Series
PC S-Series 1.1 - a fix is not available at this time.
ProxyAV
ProxyAV 3.5 - a fix is not available at this time.
ProxySG
ProxySG 6.6 - a fix is not available at this time.
ProxySG 6.5 - a fix is not available at this time.
Reporter
Reporter 10.1 - a fix is not available at this time.
Reporter 9.5 - a fix will not be provided. Please upgrade to the latest version
with the vulnerability fixes.
Security Analytics
Security Analytics 7.2 - a fix is not available at this time.
Security Analytics 7.1 - a fix will not be provided. Please upgrade to the
latest version with the vulnerability fixes.
Security Analytics 6.6 - a fix will not be provided. Please upgrade to the
latest version with the vulnerability fixes.
SSL Visibility
SSLV 3.11 - a fix is not available at this time.
SSLV 3.10 - a fix is not available at this time.
SSLV 3.9 - a fix will not be provided. Please upgrade to the latest version
with the vulnerability fixes.
Unified Agent
UA 4.7 - a fix is not available at this time.
UA 4.6 - a fix will not be provided. Please upgrade to the latest version with
the vulnerability fixes.
X-Series XOS
XOS 11.0 - a fix is not available at this time.
XOS 10.0 - a fix will not be provided. Please upgrade to the latest version
with the vulnerability fixes.
XOS 9.7 - a fix will not be provided. Please upgrade to the latest version with
the vulnerability fixes.
References:
OpenSSL Security Advisory - https://www.openssl.org/news/secadv/20170126.txt
CVE-2017-3730 - https://access.redhat.com/security/cve/CVE-2017-3730
CVE-2017-3731 - https://access.redhat.com/security/cve/CVE-2017-3731
CVE-2017-3732 - https://access.redhat.com/security/cve/CVE-2017-3732
Advisory History:
2017-02-09 initial public release
Copyright 2017, Blue Coat Systems, Inc. All rights reserved.
Feedback
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWJ0S4Yx+lLeg9Ub1AQiCVw/+Kh8ObjQtKnYptAjZv2V0wtJuEF47FBEG
BUYqdw58uAn0W34YHUMXS/k/gbovyMBlA3BF3Xa69ClHCvttrmcFA74uwgDvfljn
JhEOoXWpkZmU21ZAgqfr1yK5VtMYl6567sh/XEm6bhQjmOXo7YEr5iRi4Ohxyq+k
qTM9Ong7ndCDnD12AbkEIyA0A+FgLDamZjmtGVuS3+cOzKL8/sjqwntOEp+e4STg
AsxFeKak19HLkpWLHANnvpz48kB84fXoLCrHKXyhxk8IYamQNgfIibLv4XoBslkr
4lEww72I4C3PRiPt7O692e4mb4g/JEFAlbjlHRgP/uiN05CFWZoqJu3MmYg5PAOf
zXCjrjbBsX9SWds1Ox5+5v7p1X1vUdZmIIUInzjN887jzt9xdM58mQCaIEJ0yeKc
BcwNOsbr0bK+2d7YQkHjD85HO2olDdeh5c4k7ZnRfmqRgIqHFf8OcSXMZddIzihm
Zd+CfCkzVgC2LqeIMOjlEqkjBVupgFbHi4ZWiH5GKCXb0ctsDmDZ98kbj+YN+yBa
+FiyFmSuizQX2ZSE9pqs03sx4XJhVp+texhQ5F0mKJuNY/qvtQThiR8on6FkpGYI
ywOGwjOyt/KvxSdfGEvmN6aXuL25ZLT3bti8xjhFprIkY5RGKycGponR6qoXL8sQ
mRn9JyCd1W8=
=nCQm
-----END PGP SIGNATURE-----