OpenSSL Datagram Transport Layer Security Plaintext Recovery Issue
Threat Type:
IntelliShield: Security Issue Alert
IntelliShield ID:
24893
Version:
16
First Published:
2012 January 06 14:37 GMT
Last Published:
2012 December 21 20:47 GMT
Port:
Not Available
CVE:
CVE-2011-4108
BugTraq ID:
51281
Urgency:
Unlikely Use
Credibility:
Confirmed
Severity:
Mild Damage
Version Summary:
VMware has re-released a security advisory and updated software to address the OpenSSL Datagram Transport Layer Security plaintext recovery issue.
Description
OpenSSL versions prior to 0.9.8s and versions prior to 1.0.0f contain an issue that could result in easier recovery of plaintext information from encrypted text.
The issue exists because of an incorrect implementation of the Datagram Transport Layer Security (DTLS) protocol by the affected software. The affected versions of OpenSSL fail to verify the message authentication code (MAC) on packets that have been incorrectly cryptographically padded. The error could result in different timing in decrypting packets with valid and invalid padding information, allowing the attacker to guess certain plaintext information.
OpenSSL has confirmed this issue and released additional software updates. Previous updates introduced a regression error documented in IntelliShield Alert 24974.
The issue could allow plaintext recovery of information encoded in an arbitrary block of ciphertext, leading to disclosure of sensitive information. If successful, the attacker could launch further attacks.
Safeguards
Administrators are advised to apply the appropriate updates.
Administrators are advised to monitor affected systems.
Alert History
Version 15, October 15, 2012, 7:11 AM: MontaVista Software has re-released a security alert and updated software to address the OpenSSL Datagram Transport Layer Security plaintext recovery issue.
Version 14, September 25, 2012, 4:29 PM: Red Hat has released additional security advisories and updated software to address the OpenSSL Datagram Transport Layer Security plaintext recovery issue.
Version 13, September 5, 2012, 2:53 PM: VMware has released a security advisory and updated software to address the OpenSSL Datagram Transport Layer Security plaintext recovery issue.
Version 12, August 28, 2012, 1:37 PM: MontaVista Software has released a security alert and updated software to address the OpenSSL Datagram Transport Layer Security plaintext recovery issue.
Version 11, June 29, 2012, 9:00 AM: HP has released an additional security bulletin and updated software to address the OpenSSL Datagram Transport Layer Security plaintext recovery issue.
Version 10, June 25, 2012, 5:11 PM: HP has released an additional security bulletin and updated software to address the OpenSSL Datagram Transport Layer Security plaintext recovery issue.
Version 9, April 5, 2012, 11:03 AM: Oracle has released a security advisory and updated software to address the OpenSSL Datagram Transport Layer Security plaintext recovery issue.
Version 8, March 23, 2012, 3:48 PM: IBM has released a security advisory and fixes to address the OpenSSL Datagram Transport Layer Security plaintext recovery issue.
Version 7, January 31, 2012, 9:59 AM: CentOS has released updated packages to address the OpenSSL Datagram Transport Layer Security plaintext recovery issue.
Version 6, January 25, 2012, 12:13 PM: Red Hat has released security advisories and updated packages to address the OpenSSL Datagram Transport Layer Security plaintext recovery issue. CentOS has also released updated packages to address this issue.
Version 5, January 20, 2012, 4:27 PM: OpenSSL has released a security bulletin and updated software to address the regression error introduced as a result of a fix to the OpenSSL Datagram Transport Layer Security plaintext recovery issue.
Version 4, January 20, 2012, 1:27 PM: HP has released a security bulletin and updated software to address the OpenSSL Datagram Transport Layer Security plaintext recovery issue.
Version 3, January 17, 2012, 6:17 PM: FreeBSD has released a VuXML document and updated ports collection to address the OpenSSL Datagram Transport Layer Security plaintext recovery issue.
Version 2, January 11, 2012, 6:21 PM: Cisco has discovered a potential issue in the patch for the OpenSSL Datagram Transport Layer Security plaintext recovery issue.
Version 1, January 6, 2012, 9:37 AM: OpenSSL contains an issue that could allow an unauthenticated, remote attacker to obtain sensitive information from a targeted system. Updates are available.
The security vulnerability applies to the following combinations of products.
Primary Products:
OpenSSL
openssl
0.9.8 Base | 0.9.8a Base | 0.9.8b Base | 0.9.8c Base | 0.9.8d Base | 0.9.8e Base | 0.9.8f Base | 0.9.8g Base | 0.9.8h Base | 0.9.8i Base | 0.9.8j Base | 0.9.8k Base | 0.9.8l Base | 0.9.8m Base | 0.9.8n Base | 0.9.8o Base | 0.9.8p Base | 0.9.8q Base | 0.9.8r Base | 0.9.8s Base | 1.0.0 Base | 1.0.0a Base | 1.0.0b Base | 1.0.0c Base | 1.0.0d Base | 1.0.0e Base
3.5 Base, Update 1, Update 2, Update 3, Update 4 | 4.0 Base | 4.1 Base | 5.0 Base
VMware, Inc.
VMware ESX Server
3.5 Base, Update 1, Update 2, Update 3, Update 4 | 4.0 Base | 4.1 Base
Alerts and bulletins on the Cisco Security Intelligence Operations Portal are highlighted by analysts in the
Cisco Threat Operations Center and represent a subset of the comprehensive content that is available through Cisco Security IntelliShield Alert Manager Service.
This customizable threat and vulnerability alert service provides security staff with access to timely, accurate, and credible information about threats and vulnerabilities that may affect their environment. Cisco is pleased to offer a free trial of the service.
To register for full access, please visit the IntelliShield trial registration page.
LEGAL DISCLAIMER The urgency and severity ratings of this alert are not tailored to individual users; users may value alerts differently based upon their network configurations and circumstances. THE ALERT, AND INFORMATION CONTAINED THEREIN, ARE PROVIDED ON AN "AS IS" BASIS AND DO NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE ALERT, AND INFORMATION CONTAINED THEREIN, OR MATERIALS LINKED FROM THE ALERT, IS AT YOUR OWN RISK. INFORMATION IN THIS ALERT AND ANY RELATED COMMUNICATIONS IS BASED ON OUR KNOWLEDGE AT THE TIME OF PUBLICATION AND IS SUBJECT TO CHANGE WITHOUT NOTICE. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME.
