10 - SUN-102711

Executive Summary

Summary
Title	Sun Alert 102711 Security Vulnerabilities in OpenSSL May Lead to a Denial of Service (DoS) to Applications or Execution of Arbitrary Code With Elevated Privileges

Informations
Name	SUN-102711	First vendor Publication	2007-06-26
Vendor	Sun	Last vendor Modification	2007-12-03
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score	10	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Product: Solaris 10 Operating System

Two security vulnerabilities in the OpenSSL product (see openssl(5)) shipped with Solaris 10 may affect applications which make use of this product. Depending on the individual application, the first issue may allow a local or remote unprivileged user to execute arbitrary code with the privileges of the user running the application.

The second issue may allow a remote user who controls a server to which an application connects to crash that application, causing a Denial of Service (DoS) condition.

These issues are also referenced in the following documents:

http://www.openssl.org/news/secadv_20060928.txt

CVE-2006-3738 at http://www.security-database.com/detail.php?cve=CVE-2006-3738

CVE-2006-4343 at http://www.security-database.com/detail.php?cve=CVE-2006-4343

Sun wishes to acknowledge with thanks, Tavis Ormandy and Will Drewry (Google Security Team) for bringing these issues to our attention.

Avoidance: Patch

State: Resolved

First released: 09-Nov-2006

Sun Alert Link:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102711-1

Original Source

Url : http://blogs.sun.com/security/entry/sun_alert_102711_security_vulnerabilities

CWE : Common Weakness Enumeration

%	Id	Name
50 %	CWE-476	NULL Pointer Dereference
50 %	CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10207

Oval ID:	oval:org.mitre.oval:def:10207
Title:	The get_server_hello function in the SSLv2 client code in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows remote servers to cause a denial of service (client crash) via unknown vectors that trigger a null pointer dereference.
Description:	The get_server_hello function in the SSLv2 client code in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows remote servers to cause a denial of service (client crash) via unknown vectors that trigger a null pointer dereference.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2006-4343	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section openssl-perl is earlier than 0:0.9.7a-33.21 AND openssl-devel is earlier than 0:0.9.7a-33.21 AND openssl is earlier than 0:0.9.7a-33.21 AND openssl096b is earlier than 0:0.9.6b-16.46 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section openssl-perl is earlier than 0:0.9.7a-43.14 AND openssl-devel is earlier than 0:0.9.7a-43.14 AND openssl is earlier than 0:0.9.7a-43.14 AND openssl096b is earlier than 0:0.9.6b-22.46

Definition Id: oval:org.mitre.oval:def:4256

Oval ID:	oval:org.mitre.oval:def:4256
Title:	Security Vulnerabilities in OpenSSL May Lead to a Denial of Service (DoS) to Applications or Execution of Arbitrary Code With Elevated Privileges
Description:	Buffer overflow in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions has unspecified impact and remote attack vectors involving a long list of ciphers.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2006-3738	Version:	1
Platform(s):	Sun Solaris 10	Product(s):
Definition Synopsis:
Solaris 10 (SPARC) meets Sun Alert 102711 Solaris 10 (SPARC) is installed AND NOT Patch 121229-02 or later installed OR Patch 121229-02 or later installed AND NOT Patch 118562-13 or later installed AND Pkg SUNWcry (Supplemental Encryption) is installed OR Solaris 10 (x86) meets Sun Alert 102711 Solaris 10 (x86) is installed AND NOT Patch 121230-02 or later installed OR Patch 121230-02 or later installed AND NOT Patch 118563-13 or later installed AND Pkg SUNWcry (Supplemental Encryption) is installed

Definition Id: oval:org.mitre.oval:def:4356

Oval ID:	oval:org.mitre.oval:def:4356
Title:	Security Vulnerabilities in OpenSSL May Lead to a Denial of Service (DoS) to Applications or Execution of Arbitrary Code With Elevated Privileges
Description:	The get_server_hello function in the SSLv2 client code in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows remote servers to cause a denial of service (client crash) via unknown vectors that trigger a null pointer dereference.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2006-4343	Version:	1
Platform(s):	Sun Solaris 10	Product(s):
Definition Synopsis:
Solaris 10 (SPARC) meets Sun Alert 102711 Solaris 10 (SPARC) is installed AND NOT Patch 121229-02 or later installed OR Patch 121229-02 or later installed AND NOT Patch 118562-13 or later installed AND Pkg SUNWcry (Supplemental Encryption) is installed OR Solaris 10 (x86) meets Sun Alert 102711 Solaris 10 (x86) is installed AND NOT Patch 121230-02 or later installed OR Patch 121230-02 or later installed AND NOT Patch 118563-13 or later installed AND Pkg SUNWcry (Supplemental Encryption) is installed

Definition Id: oval:org.mitre.oval:def:9370

Oval ID:	oval:org.mitre.oval:def:9370
Title:	Buffer overflow in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions has unspecified impact and remote attack vectors involving a long list of ciphers.
Description:	Buffer overflow in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions has unspecified impact and remote attack vectors involving a long list of ciphers.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2006-3738	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section openssl-perl is earlier than 0:0.9.7a-33.21 AND openssl-devel is earlier than 0:0.9.7a-33.21 AND openssl is earlier than 0:0.9.7a-33.21 AND openssl096b is earlier than 0:0.9.6b-16.46 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section openssl-perl is earlier than 0:0.9.7a-43.14 AND openssl-devel is earlier than 0:0.9.7a-43.14 AND openssl is earlier than 0:0.9.7a-43.14 AND openssl096b is earlier than 0:0.9.6b-22.46

CPE : Common Platform Enumeration

Type	Description	Count
Application	Openssl cpe:2.3:a:openssl:openssl:0.9.8c:::::::* cpe:2.3:a:openssl:openssl:0.9.8b:::::::* cpe:2.3:a:openssl:openssl:0.9.8a:::::::* cpe:2.3:a:openssl:openssl:0.9.8:-:::::: cpe:2.3:a:openssl:openssl:0.9.7k:::::::* cpe:2.3:a:openssl:openssl:0.9.7j:::::::* cpe:2.3:a:openssl:openssl:0.9.7i:::::::* cpe:2.3:a:openssl:openssl:0.9.7h:::::::* cpe:2.3:a:openssl:openssl:0.9.7g:::::::* cpe:2.3:a:openssl:openssl:0.9.7f:::::::* cpe:2.3:a:openssl:openssl:0.9.7e:::::::* cpe:2.3:a:openssl:openssl:0.9.7d:::::::* cpe:2.3:a:openssl:openssl:0.9.7c:::::::* cpe:2.3:a:openssl:openssl:0.9.7b:::::::* cpe:2.3:a:openssl:openssl:0.9.7a:::::::* cpe:2.3:a:openssl:openssl:0.9.7:-::::::	16
Os	Canonical Ubuntu Linux cpe:2.3:o:canonical:ubuntu_linux:6.06::::lts::: cpe:2.3:o:canonical:ubuntu_linux:5.10:::::::* cpe:2.3:o:canonical:ubuntu_linux:5.04:::::::*	3
Os	Debian Debian Linux cpe:2.3:o:debian:debian_linux:3.1:::::::*	1

ExploitDB Exploits

id	Description
2006-09-28	OpenSSL SSLv2 Null Pointer Dereference Client Denial of Service Vulnerability
2007-12-23	OpenSSL < 0.9.7l / 0.9.8d - SSLv2 Client Crash Exploit

OpenVAS Exploits

Date	Description
2010-02-03	Name : Solaris Update for Kernel 122301-48 File : nvt/gb_solaris_122301_48.nasl
2010-02-03	Name : Solaris Update for Kernel 122300-48 File : nvt/gb_solaris_122300_48.nasl
2009-11-17	Name : Mac OS X Version File : nvt/macosx_version.nasl
2009-10-13	Name : Solaris Update for Kernel 122301-44 File : nvt/gb_solaris_122301_44.nasl
2009-10-13	Name : Solaris Update for Kernel 122300-44 File : nvt/gb_solaris_122300_44.nasl
2009-10-13	Name : Solaris Update for /usr/bin/ssh 114357-18 File : nvt/gb_solaris_114357_18.nasl
2009-10-13	Name : Solaris Update for pkg utilities 113713-28 File : nvt/gb_solaris_113713_28.nasl
2009-10-13	Name : Solaris Update for /usr/bin/ssh 114356-19 File : nvt/gb_solaris_114356_19.nasl
2009-10-10	Name : SLES9: Security update for OpenSSL File : nvt/sles9p5018586.nasl
2009-09-23	Name : Solaris Update for pkg utilities 114568-27 File : nvt/gb_solaris_114568_27.nasl
2009-09-23	Name : Solaris Update for Kernel 122301-42 File : nvt/gb_solaris_122301_42.nasl
2009-06-03	Name : Solaris Update for /usr/bin/ssh 114357-17 File : nvt/gb_solaris_114357_17.nasl
2009-06-03	Name : Solaris Update for kernel 127128-11 File : nvt/gb_solaris_127128_11.nasl
2009-06-03	Name : Solaris Update for kernel 127127-11 File : nvt/gb_solaris_127127_11.nasl
2009-06-03	Name : Solaris Update for bootconfchk 123377-01 File : nvt/gb_solaris_123377_01.nasl
2009-06-03	Name : Solaris Update for bootconfchk 123376-01 File : nvt/gb_solaris_123376_01.nasl
2009-06-03	Name : Solaris Update for wanboot 122715-02 File : nvt/gb_solaris_122715_02.nasl
2009-06-03	Name : Solaris Update for /usr/bin/ssh 114356-18 File : nvt/gb_solaris_114356_18.nasl
2009-06-03	Name : Solaris Update for Kernel 122301-40 File : nvt/gb_solaris_122301_40.nasl
2009-06-03	Name : Solaris Update for Kernel 122300-40 File : nvt/gb_solaris_122300_40.nasl
2009-06-03	Name : Solaris Update for kernel 120011-14 File : nvt/gb_solaris_120011_14.nasl
2009-06-03	Name : Solaris Update for wanboot 117123-08 File : nvt/gb_solaris_117123_08.nasl
2009-06-03	Name : Solaris Update for pkg utilities 114568-26 File : nvt/gb_solaris_114568_26.nasl
2009-06-03	Name : Solaris Update for pkg utilities 113713-27 File : nvt/gb_solaris_113713_27.nasl
2009-05-05	Name : HP-UX Update for Apache Remote Execution of Arbitrary Code HPSBUX02186 File : nvt/gb_hp_ux_HPSBUX02186.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200805-07 (ltsp) File : nvt/glsa_200805_07.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200710-06 (openssl) File : nvt/glsa_200710_06.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200610-11 (openssl) File : nvt/glsa_200610_11.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200612-11 (emul-linux-x86-baselibs) File : nvt/glsa_200612_11.nasl
2008-09-04	Name : FreeBSD Ports: openssl File : nvt/freebsd_openssl2.nasl
2008-09-04	Name : FreeBSD Security Advisory (FreeBSD-SA-06:23.openssl.asc) File : nvt/freebsdsa_openssl4.nasl
2008-01-17	Name : Debian Security Advisory DSA 1195-1 (openssl096) File : nvt/deb_1195_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 1185-1 (openssl) File : nvt/deb_1185_1.nasl
0000-00-00	Name : Slackware Advisory SSA:2006-272-01 openssl File : nvt/esoft_slk_ssa_2006_272_01.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
29263	OpenSSL SSLv2 get_server_hello Function Remote DoS OpenSSL contains a flaw that may allow a remote denial of service. The issue is triggered when an unspecified error occurs in the get_server_hello function, and will result in loss of availability for the client.
29262	OpenSSL SSL_get_shared_ciphers Function Unspecified Remote Overflow A remote overflow exists in OpenSSL. OpenSSL contains an unspecified issue in the SSL_get_shared_ciphers function. With a specially crafted request, an attacker can cause an unspecified impact.

Snort® IPS/IDS

Date	Description
2014-01-10	SSLv2 openssl get shared ciphers overflow attempt RuleID : 8440 - Revision : 11 - Type : IMAP
2014-01-10	SSLv3 openssl get shared ciphers overflow attempt RuleID : 8439 - Revision : 16 - Type : IMAP
2014-01-10	SSLv2 openssl get shared ciphers overflow attempt RuleID : 8438 - Revision : 16 - Type : IMAP
2014-01-10	SSLv2 openssl get shared ciphers overflow attempt RuleID : 8437 - Revision : 15 - Type : SMTP
2014-01-10	SSLv2 openssl get shared ciphers overflow attempt RuleID : 8436 - Revision : 14 - Type : SMTP
2014-01-10	SSLv3 openssl get shared ciphers overflow attempt RuleID : 8435 - Revision : 16 - Type : SMTP
2014-01-10	SSLv3 openssl get shared ciphers overflow attempt RuleID : 8434 - Revision : 16 - Type : SMTP
2014-01-10	SSLv2 openssl get shared ciphers overflow attempt RuleID : 8433 - Revision : 15 - Type : SMTP
2014-01-10	SSLv2 openssl get shared ciphers overflow attempt RuleID : 8432 - Revision : 15 - Type : SMTP
2014-01-10	SSLv2 openssl get shared ciphers overflow attempt RuleID : 8431 - Revision : 14 - Type : POP3
2014-01-10	SSLv3 openssl get shared ciphers overflow attempt RuleID : 8430 - Revision : 15 - Type : POP3
2014-01-10	SSLv2 openssl get shared ciphers overflow attempt RuleID : 8429 - Revision : 14 - Type : POP3
2014-01-10	SSLv2 openssl get shared ciphers overflow attempt RuleID : 8428 - Revision : 21 - Type : SERVER-OTHER
2014-01-10	SSLv2 openssl get shared ciphers overflow attempt RuleID : 8427 - Revision : 18 - Type : MISC
2014-01-10	SSLv3 openssl get shared ciphers overflow attempt RuleID : 8426 - Revision : 20 - Type : SERVER-OTHER

Nessus® Vulnerability Scanner

Date	Description
2015-09-18	Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL8106.nasl - Type : ACT_GATHER_INFO
2014-10-10	Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL6734.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2006-0661.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2006-0695.nasl - Type : ACT_GATHER_INFO
2012-01-04	Name : The remote server is affected by multiple vulnerabilities. File : openssl_0_9_7l_0_9_8d.nasl - Type : ACT_GATHER_INFO
2010-03-11	Name : The remote web server has multiple SSL-related vulnerabilities. File : openssl_0_9_8m.nasl - Type : ACT_GATHER_INFO
2010-01-10	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0629.nasl - Type : ACT_GATHER_INFO
2010-01-10	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0525.nasl - Type : ACT_GATHER_INFO
2010-01-10	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0264.nasl - Type : ACT_GATHER_INFO
2009-07-27	Name : The remote VMware ESX host is missing one or more security-related patches. File : vmware_VMSA-2008-0013.nasl - Type : ACT_GATHER_INFO
2008-04-02	Name : The remote Windows host has an application that is affected by multiple issues. File : vmware_multiple_vmsa_2008_0005.nasl - Type : ACT_GATHER_INFO
2007-12-13	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_compat-openssl097g-2163.nasl - Type : ACT_GATHER_INFO
2007-12-13	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_openssl-2141.nasl - Type : ACT_GATHER_INFO
2007-11-10	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-522-1.nasl - Type : ACT_GATHER_INFO
2007-11-10	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-353-1.nasl - Type : ACT_GATHER_INFO
2007-10-17	Name : The remote openSUSE host is missing a security update. File : suse_compat-openssl097g-2171.nasl - Type : ACT_GATHER_INFO
2007-10-17	Name : The remote openSUSE host is missing a security update. File : suse_openssl-2140.nasl - Type : ACT_GATHER_INFO
2007-10-09	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-193.nasl - Type : ACT_GATHER_INFO
2007-10-09	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200710-06.nasl - Type : ACT_GATHER_INFO
2007-10-03	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1379.nasl - Type : ACT_GATHER_INFO
2007-07-01	Name : The remote multi-function device is affected by multiple issues. File : xerox_xrx07_001.nasl - Type : ACT_GATHER_INFO
2007-02-27	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_0f37d765c5d411db9f82000e0c2e438a.nasl - Type : ACT_GATHER_INFO
2007-02-18	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-178.nasl - Type : ACT_GATHER_INFO
2007-02-18	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-177.nasl - Type : ACT_GATHER_INFO
2007-02-18	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-172.nasl - Type : ACT_GATHER_INFO
2007-02-18	Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2006_058.nasl - Type : ACT_GATHER_INFO
2007-01-17	Name : The remote Fedora Core host is missing a security update. File : fedora_2006-1004.nasl - Type : ACT_GATHER_INFO
2006-12-14	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200612-11.nasl - Type : ACT_GATHER_INFO
2006-10-25	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200610-11.nasl - Type : ACT_GATHER_INFO
2006-10-20	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1195.nasl - Type : ACT_GATHER_INFO
2006-10-14	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1185.nasl - Type : ACT_GATHER_INFO
2006-10-02	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2006-0695.nasl - Type : ACT_GATHER_INFO
2006-09-29	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0695.nasl - Type : ACT_GATHER_INFO
2006-09-29	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2006-272-01.nasl - Type : ACT_GATHER_INFO
2004-07-12	Name : The remote host is missing Sun Security Patch number 114568-29 File : solaris9_x86_114568.nasl - Type : ACT_GATHER_INFO
2004-07-12	Name : The remote host is missing Sun Security Patch number 113713-30 File : solaris9_113713.nasl - Type : ACT_GATHER_INFO

Global Informations

Type	Count
CWE ID(s)	2
Oval ID(s)	4
CPE ID(s)	20
osvdb(s)	2
ExploitDB Exploit(s)	2
Openvas Exploit(s)	34
Snort® Rule(s)	15
Nessus® Exploit(s)	36

	Related
10	CVE-2006-3738
4.3	CVE-2006-4343
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 2 more Alert(s)