OpenSSL Flaw in Encrypt-Then-Mac Extension Negotiation Lets Remote Authenticated Users Cause the Target Service to Crash
SecurityTracker Alert ID: 1037846|
SecurityTracker URL: http://securitytracker.com/id/1037846
(Links to External Site)
Date: Feb 16 2017
Denial of service via network|
Fix Available: Yes Vendor Confirmed: Yes |
Version(s): 1.1.0 to 1.1.0e|
A vulnerability was reported in OpenSSL. A remote authenticated user can cause the target service to crash.|
A remote authenticated user can trigger a crash during a renegotiate handshake and cause the target service to crash, depending on the selected cipher suite.
Negotiating the Encrypt-Then-Mac extension when the original handshake did not include the extension can trigger this flaw. Negotiating without the Encrypt-Then-Mac extension when the original handshake included the extension can also trigger this flaw.
Clients and servers are affected.
The vendor was notified on January 31, 2017.
Joe Orton (Red Hat) reported this vulnerability.
A remote authenticated user can cause the target service to crash.|
The vendor has issued a fix (1.1.0e).|
The vendor advisory is available at:
Vendor URL: www.openssl.org/news/secadv/20170216.txt (Links to External Site)
|Underlying OS: Linux (Any), UNIX (Any), Windows (Any)|
This archive entry has one or more follow-up message(s) listed below.|
Source Message Contents
Date: Thu, 16 Feb 2017 12:21:24 +0000|
Subject: [openssl-announce] OpenSSL Security Advisory
-----BEGIN PGP SIGNED MESSAGE-----
OpenSSL Security Advisory [16 Feb 2017]
Encrypt-Then-Mac renegotiation crash (CVE-2017-3733)
During a renegotiation handshake if the Encrypt-Then-Mac extension is
negotiated where it was not in the original handshake (or vice-versa) then this
can cause OpenSSL to crash (dependent on ciphersuite). Both clients and servers
OpenSSL 1.1.0 users should upgrade to 1.1.0e
This issue does not affect OpenSSL version 1.0.2.
This issue was reported to OpenSSL on 31st January 2017 by Joe Orton (Red Hat).
The fix was developed by Matt Caswell of the OpenSSL development team.
Support for version 1.0.1 ended on 31st December 2016. Support for versions
0.9.8 and 1.0.0 ended on 31st December 2015. Those versions are no longer
receiving security updates.
URL for this Security Advisory:
Note: the online version of the advisory may be updated with additional details
For details of OpenSSL severity classifications please see:
-----BEGIN PGP SIGNATURE-----
-----END PGP SIGNATURE-----
openssl-announce mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-announce