oss-security - OpenSSL ASN1 BIO vulnerability (CVE-2012-2110)

Openwall GNU/*/Linux 3.0 - a small security-enhanced Linux distro for servers

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Fri, 20 Apr 2012 13:11:19 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: Tavis Ormandy <taviso@...xchg8b.com>
Subject: OpenSSL ASN1 BIO vulnerability (CVE-2012-2110)

Hi,

This should have been posted in here yesterday (and by someone more
familiar with the topic), but better a bit late than never.

Tavis Ormandy of Google Security Team found a vulnerability in OpenSSL:

incorrect integer conversions in OpenSSL can result in memory corruption.
http://lists.openwall.net/full-disclosure/2012/04/19/4

Advisory from OpenSSL:
http://openssl.org/news/secadv_20120419.txt

Fortunately, the SSL/TLS code of OpenSSL is not affected - but some
other uses of OpenSSL are.

There are updates for 1.0.1, 1.0.0, and 0.9.8.

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.