As announced earlier this week, the OpenSSL Project today released an update for the 1.1.0 branch to address several vulnerabilities, including a high severity denial-of-service (DoS) issue reported by a security expert at Google.
OpenSSL 1.1.0c fixes three vulnerabilities. The most serious of them, tracked as CVE-2016-7054, is a heap-based buffer overflow related to TLS connections using *-CHACHA20-POLY1305 cipher suites. Corrupting larger payloads can lead to a DoS condition, which can result in a crash of OpenSSL.
According to the OpenSSL Project, the flaw does not affect versions prior to 1.1.0 and there is no evidence that it’s exploitable beyond a DoS attack. The issue was found by Robert
Święcki of the Google Security Team using the honggfuzz fuzzer. OpenSSL developers were notified about the bug on September 25.
The latest OpenSSL 1.1.0 update also patches a moderate severity flaw that can cause applications to crash (CVE-2016-7053). This issue also only affects OpenSSL 1.1.0.
OpenSSL 1.1.0c also resolves a low severity bug tracked as CVE-2016-7055. The weakness, related to the Broadwell-specific Montgomery multiplication procedure, was initially not viewed as a security problem, but experts have demonstrated that it is exploitable in very specific circumstances.
This vulnerability also affects OpenSSL 1.0.2, but an update has not been released for this branch due to it being a low severity issue. The patch will be included in the next 1.0.2 update.
The OpenSSL Project has once again reminded users that version 1.0.1 will no longer be supported after December 31, 2016. This version will not receive security updates after that date.
Related: Over a Dozen Vulnerabilities Patched in OpenSSL
Related: OpenSSL Patch for Low Severity Issue Creates Critical Flaw
Related: Non-Security OpenSSL Bugs Lead to Serious Vulnerability