5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
0.119 Low
EPSS
Percentile
95.3%
OpenSSL may generate unsafe primes for use in the Diffie-Hellman protocol, which may lead to disclosure of enough information for an attacker to recover the private encryption key.
CWE-325: Missing Required Cryptographic Step - CVE-2016-0701
OpenSSL 1.0.2 introduced the ability to generate X9.42 style parameter files as required by RFC 5114. The primes generated in this mode may be ‘unsafe’, enabling generation of groups containing small subgroups, which may allow for cryptographic attacks that may recover the key. OpenSSL prior to 1.0.2f did not properly check for this possibility.
Furthermore, OpenSSL prior to 1.0.2f will by default reuse this number for the life of the process. Such a number, particularly if re-used, severely weakens applications of the Diffie-Hellman protocol such as TLS, allowing an attacker in some scenarios to possibly determine the Diffie-Hellman private exponent and decrypt the underlying traffic.
The researcher states in a blog post however that this attack “requires that the attacker complete multiple handshakes in which the peer (OpenSSL in this case) uses the same private DH exponent.”
CWE-757: Selection of Less-Secure Algorithm During Negotiation (‘Algorithm Downgrade’) - CVE-2015-3197
According to OpenSSL, “A malicious client can negotiate SSLv2 ciphers that have been disabled on the server and complete SSLv2 handshakes even if all SSLv2 ciphers have been disabled, provided that the SSLv2 protocol was not also disabled via SSL_OP_NO_SSLv2.”
For more information, please see OpenSSL’s security advisory.
The CVSS score below is based on CVE-2016-0701.
A malicious remote user may be able to learn sensitive information by obtaining the decryption key. A remote attacker may also be able to negotiate for weak SSLv2 ciphers even if the SSLv2 ciphers have been disabled, allowing for further known attacks.
Apply an update
OpenSSL version 1.0.2f and 1.0.1r have been released to address these issues. Affected users should update as soon as possible.
Users may also consider the following mitigations:
EnableSSL_OP_SINGLE_DH_USE option
OpenSSL prior to version 1.0.2f may enable the SSL_OP_SINGLE_DH_USE option to prevent reuse of primes in the Diffie-Hellman protocol. This may help mitigate attacks against use of weak primes.
257823
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Updated: January 28, 2016
Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Updated: January 28, 2016
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Google maintains BoringSSL, a fork of OpenSSL.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23257823 Feedback>).
Updated: January 28, 2016
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Group | Score | Vector |
---|---|---|
Base | 8.8 | AV:N/AC:M/Au:N/C:C/I:C/A:N |
Temporal | 6.9 | E:POC/RL:OF/RC:C |
Environmental | 6.9 | CDP:ND/TD:H/CR:ND/IR:ND/AR:ND |
OpenSSL credits Antonio Sanso of Adobe for reporting CVE-2016-0701, and Nimrod Aviram and Sebastian Schinzel for reporting CVE-2015-3197.
This document was written by Garret Wassermann.
CVE IDs: | CVE-2016-0701, CVE-2015-3197 |
---|---|
Date Public: | 2016-01-28 Date First Published: |
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
0.119 Low
EPSS
Percentile
95.3%