As announced earlier this week, the OpenSSL Project today released an update for the 1.1.0 branch to address several vulnerabilities, including a high severity denial-of-service (DoS) issue reported by a security expert at Google.
OpenSSL 1.1.0c fixes three vulnerabilities. The most serious of them, tracked as CVE-2016-7054, is a heap-based buffer overflow related to TLS connections using *-CHACHA20-POLY1305 cipher suites. Corrupting larger payloads can lead to a DoS condition, which can result in a crash of OpenSSL.
According to the OpenSSL Project, the flaw does not affect versions prior to 1.1.0 and there is no evidence that it’s exploitable beyond a DoS attack. The issue was found by Robert
Święcki of the Google Security Team using the honggfuzz fuzzer. OpenSSL developers were notified about the bug on September 25.
The latest OpenSSL 1.1.0 update also patches a moderate severity flaw that can cause applications to crash (CVE-2016-7053). This issue also only affects OpenSSL 1.1.0.
OpenSSL 1.1.0c also resolves a low severity bug tracked as CVE-2016-7055. The weakness, related to the Broadwell-specific Montgomery multiplication procedure, was initially not viewed as a security problem, but experts have demonstrated that it is exploitable in very specific circumstances.
This vulnerability also affects OpenSSL 1.0.2, but an update has not been released for this branch due to it being a low severity issue. The patch will be included in the next 1.0.2 update.
The OpenSSL Project has once again reminded users that version 1.0.1 will no longer be supported after December 31, 2016. This version will not receive security updates after that date.
Related: Over a Dozen Vulnerabilities Patched in OpenSSL
Related: OpenSSL Patch for Low Severity Issue Creates Critical Flaw
Related: Non-Security OpenSSL Bugs Lead to Serious Vulnerability
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Siemens License Manager Vulnerabilities Allow ICS Hacking
- CISA Releases Open Source Recovery Tool for ESXiArgs Ransomware
- ICS Cybersecurity Firm Opscura Launches With $9.4 Million in Series A Funding
- Patch Released for Actively Exploited GoAnywhere MFT Zero-Day
- VMware Says No Evidence of Zero-Day Exploitation in ESXiArgs Ransomware Attacks
- Critical Baicells Device Vulnerability Can Expose Telecoms Networks to Snooping
- SecurityWeek Analysis: Over 450 Cybersecurity M&A Deals Announced in 2022
- VMware ESXi Servers Targeted in Ransomware Attack via Old Vulnerability
Latest News
- Siemens License Manager Vulnerabilities Allow ICS Hacking
- UN Experts: North Korean Hackers Stole Record Virtual Assets
- Russian Admits in US Court to Laundering Money for Ryuk Ransomware Gang
- A Deep Dive Into the Growing GootLoader Threat
- CISA Releases Open Source Recovery Tool for ESXiArgs Ransomware
- Patient Information Compromised in Data Breach at San Diego Healthcare Provider
- Germany Appoints Central Bank IT Chief to Head Cybersecurity
- OpenSSL Ships Patch for High-Severity Flaws
