OpenSSL fixes serious denial-of-service bug, 11 other flaws

The scare of a second Heartbleed was unjustified

The mystery high-severity flaw that people were expected to be fixed in OpenSSL is no Heartbleed, but it is serious and users should update.

Earlier this week, the OpenSSL Project advised users that patches scheduled to be released Thursday will address several security flaws, one of which was classified as high severity. The announcement gave rise to speculation and some people thought the upcoming vulnerability might have wide-ranging impact, on par with the critical Heartbleed flaw disclosed last April, which affected Web servers, client software, mobile apps and even hardware appliances.

OpenSSL released versions 1.0.2a, 1.0.1m, 1.0.0r and 0.9.8zf Thursday to address 12 flaws, but not all OpenSSL versions were affected by all 12 flaws.

The most serious of those vulnerabilities is tracked as CVE-2015-0291 and can lead to denial-of-service attacks. The issue only affects the 1.0.2 branch of OpenSSL.

"If a client connects to an OpenSSL 1.0.2 server and renegotiates with an invalid signature algorithms extension, a NULL pointer dereference will occur," the OpenSSL Project said in a security advisory.

A remote attacker could exploit the bug to cause servers to crash, which could lead to denial of service, OpenSSL Project member Mark Cox explained in a blog post. However, the number of possible targets will be limited, because OpenSSL 1.0.2 was only released a few months ago, so many servers are likely not using it yet, he said.

OpenSSL maintains several different major versions at the same time, so users of OpenSSL 1.0.1, for example, have no reason to upgrade to 1.0.2 if they don't need the new features. They will continue to receive security patches for the 1.0.1 version.

According to Cox, David Ramos of Stanford University, who found and reported the CVE-2015-0291 vulnerability, developed a proof-of-concept exploit, but did not release it publicly.

However, Trey Ford, global security strategist at security firm Rapid7, believes that others will reverse engineer the patch and develop the attack code relatively quickly.

"Steps to push these fixes to internet exposed systems should be prioritized," he said via email.

On Thursday, the OpenSSL Project also reclassified the FREAK vulnerability as high severity. The flaw, which was publicly disclosed at the beginning of March, could allow man-in-the-middle attackers to downgrade the security of SSL connections and then crack the encryption keys protecting them.

The flaw was quietly patched in OpenSSL in January, but it was classified as low severity at the time because it can only be used to attack connections to servers that support an outdated cipher suite known as RSA export, a condition that was thought to be rare.

However, recent studies have shown that support for RSA export cipher suites is far more common than previously believed, which is why the vulnerability has been reclassified as high severity, the OpenSSL Project said.

The new OpenSSL patches also address eight moderate-severity flaws, some of which can also be used for denial-of-service attacks under certain conditions, as well as three low severity issues.

Because its announcement of an upcoming high severity vulnerability generated confusion, the project might change the way in which it classifies flaws.

"We need another security classification; HIGH scared everyone needlessly," said Rich Salz, an OpenSSL Project member on Twitter. "We'll update the policy soon."

There have been previous instances of critical flaws in OpenSSL, so by now CISOs and IT security teams should have a refined process in place for dealing with them, said Cris Thomas, strategist at Tenable Network Security, via email. "It should be a simple matter of following the procedures you developed based on the previous instances."

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags patchessecurityRapid7patch managementencryptionTenable Network SecurityOpenSSL ProjectExploits / vulnerabilities

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?