CVE-2015-3193
published 2015-12-06CVE-2015-3193: The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5.pl in OpenSSL 1.0.2 before 1.0.2e on the x86_64 platform, as used by the BN_mod_exp…
PriorityP352high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
25.14%
97.7th percentile
The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5.pl in OpenSSL 1.0.2 before 1.0.2e on the x86_64 platform, as used by the BN_mod_exp function, mishandles carry propagation and produces incorrect output, which makes it easier for remote attackers to obtain sensitive private-key information via an attack against use of a (1) Diffie-Hellman (DH) or (2) Diffie-Hellman Ephemeral (DHE) ciphersuite.
Affected
61 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | xcode | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| cisco | products | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | openssl | < openssl 1.0.2e-1 (bookworm) | openssl 1.0.2e-1 (bookworm) |
| debian | openssl | < openssl 1.1.0h-1 (bookworm) | openssl 1.1.0h-1 (bookworm) |
| debian | openssl | < openssl 1.1.0d-1 (bookworm) | openssl 1.1.0d-1 (bookworm) |
| nodejs | node.js | 4.0.0 – 4.1.2 | — |
| nodejs | node.js | >= 4.2.0 < 4.8.7 | 4.8.7 |
| nodejs | node.js | >= 4.2.0 < 4.2.3 | 4.2.3 |
| nodejs | node.js | >= 4.2.0 < 4.7.3 | 4.7.3 |
| nodejs | node.js | >= 5.0.0 < 5.1.1 | 5.1.1 |
| nodejs | node.js | 5.0.0 – 5.12.0 | — |
| nodejs | node.js | 6.0.0 – 6.8.1 | — |
| nodejs | node.js | >= 6.9.0 < 6.12.2 | 6.12.2 |
| nodejs | node.js | >= 6.9.0 < 6.9.5 | 6.9.5 |
| nodejs | node.js | >= 7.0.0 < 7.5.0 | 7.5.0 |
| nodejs | node.js | 8.0.0 – 8.8.1 | — |
| nodejs | node.js | >= 8.9.0 < 8.9.3 | 8.9.3 |
| nodejs | node.js | >= 9.0.0 < 9.2.1 | 9.2.1 |
| openssl | openssl | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8m9h-2gxv-h3m7: The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5
ghsa_unreviewed·2022-05-17
CVE-2015-3193 [MEDIUM] CWE-200 GHSA-8m9h-2gxv-h3m7: The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5
The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5.pl in OpenSSL 1.0.2 before 1.0.2e on the x86_64 platform, as used by the BN_mod_exp function, mishandles carry propagation and produces incorrect output, which makes it easier for remote attackers to obtain sensitive private-key information via an attack against use of a (1) Diffie-Hellman (DH) or (2) Diffie-Hellman Ephemeral (DHE) ciphersuite.
GHSA
GHSA-gj3m-w8pf-46c5: There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli
ghsa_unreviewed·2022-05-14·CVSS 7.5
CVE-2017-3738 [HIGH] CWE-200 GHSA-gj3m-w8pf-46c5: There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli
There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th gener
GHSA
GHSA-5hg3-8gvm-5294: There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1
ghsa_unreviewed·2022-05-14·CVSS 7.5
CVE-2017-3732 [HIGH] CWE-200 GHSA-5hg3-8gvm-5294: There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1
There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared
OSV
CVE-2017-3738: There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli
osv·2017-12-07·CVSS 7.5
CVE-2017-3738 [HIGH] CVE-2017-3738: There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli
There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th gener
OSV
CVE-2017-3732: There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1
osv·2017-05-04·CVSS 7.5
CVE-2017-3732 [HIGH] CVE-2017-3732: There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1
There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared
OSV
openssl vulnerabilities
osv·2015-12-07·CVSS 5.0
CVE-2015-1794 [MEDIUM] openssl vulnerabilities
openssl vulnerabilities
Guy Leaver discovered that OpenSSL incorrectly handled a ServerKeyExchange
for an anonymous DH ciphersuite with the value of p set to 0. A remote
attacker could possibly use this issue to cause OpenSSL to crash, resulting
in a denial of service. This issue only applied to Ubuntu 15.10.
(CVE-2015-1794)
Hanno Böck discovered that the OpenSSL Montgomery squaring procedure
algorithm may produce incorrect results when being used on x86_64. A remote
attacker could possibly use this issue to break encryption. This issue only
applied to Ubuntu 15.10. (CVE-2015-3193)
Loïc Jonas Etienne discovered that OpenSSL incorrectly handled ASN.1
signatures with a missing PSS parameter. A remote attacker could possibly
use this issue to cause OpenSSL to crash, resulting in a denial o
OSV
CVE-2015-3193: The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5
osv·2015-12-06·CVSS 7.5
CVE-2015-3193 [HIGH] CVE-2015-3193: The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5
The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5.pl in OpenSSL 1.0.2 before 1.0.2e on the x86_64 platform, as used by the BN_mod_exp function, mishandles carry propagation and produces incorrect output, which makes it easier for remote attackers to obtain sensitive private-key information via an attack against use of a (1) Diffie-Hellman (DH) or (2) Diffie-Hellman Ephemeral (DHE) ciphersuite.
CISA ICS
Siemens SCALANCE X-200RNA Switch Devices
cisa_ics·2022-12-19
Siemens SCALANCE X-200RNA Switch Devices
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SCALANCE X-200RNA Switch Devices
Last RevisedDecember 19, 2022
Alert CodeICSA-22-349-21
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity/public exploits are available
- Vendor: Siemens
- Equipment: SCALANCE X-200RNA switch devices before V3.2.7
- Vulnerabilities: Observable Timing Discrepancy; Race Condition; Improper Restriction of Operations within the Bounds of a Memory Buffer; Improper Input Validation; NULL Pointer Dereference; Use After Free; Cryptographic Issues; Comparison of Incompatible Types; Resource Management
Red Hat
openssl: rsaz_1024_mul_avx2 overflow bug on x86_64
vendor_redhat·2017-12-07·CVSS 7.5
CVE-2017-3738 [HIGH] CWE-190 openssl: rsaz_1024_mul_avx2 overflow bug on x86_64
openssl: rsaz_1024_mul_avx2 overflow bug on x86_64
There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. This only affects processors that support the AVX2
Red Hat
openssl: BN_mod_exp may produce incorrect results on x86_64
vendor_redhat·2017-01-26·CVSS 7.5
CVE-2017-3732 [HIGH] openssl: BN_mod_exp may produce incorrect results on x86_64
openssl: BN_mod_exp may produce incorrect results on x86_64
There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario w
Debian
CVE-2017-3738: openssl - There is an overflow bug in the AVX2 Montgomery multiplication procedure used in...
vendor_debian·2017·CVSS 7.5
CVE-2017-3738 [HIGH] CVE-2017-3738: openssl - There is an overflow bug in the AVX2 Montgomery multiplication procedure used in...
There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th gener
Debian
CVE-2017-3732: openssl - There is a carry propagating bug in the x86_64 Montgomery squaring procedure in ...
vendor_debian·2017·CVSS 7.5
CVE-2017-3732 [HIGH] CVE-2017-3732: openssl - There is a carry propagating bug in the x86_64 Montgomery squaring procedure in ...
There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared
Apple
CVE-2015-3193: Xcode 8.1
vendor_apple·2016-10-27·CVSS 7.5
CVE-2015-3193 [HIGH] CVE-2015-3193: Xcode 8.1
Apple Security Update: About the security content of Xcode 8.1
Product: Xcode
Version: 8.1
CVE: CVE-2015-3193
Component: CVE-2015-3193
Ubuntu
OpenSSL vulnerabilities
vendor_ubuntu·2015-12-07·CVSS 5.0
CVE-2015-1794 [MEDIUM] OpenSSL vulnerabilities
Title: OpenSSL vulnerabilities
Summary: Several security issues were fixed in OpenSSL.
Guy Leaver discovered that OpenSSL incorrectly handled a ServerKeyExchange
for an anonymous DH ciphersuite with the value of p set to 0. A remote
attacker could possibly use this issue to cause OpenSSL to crash, resulting
in a denial of service. This issue only applied to Ubuntu 15.10.
(CVE-2015-1794)
Hanno Böck discovered that the OpenSSL Montgomery squaring procedure
algorithm may produce incorrect results when being used on x86_64. A remote
attacker could possibly use this issue to break encryption. This issue only
applied to Ubuntu 15.10. (CVE-2015-3193)
Loïc Jonas Etienne discovered that OpenSSL incorrectly handled ASN.1
signatures with a missing PSS parameter. A remote attacker could possibly
u
Cisco
Multiple Vulnerabilities in OpenSSL (December 2015) Affecting Cisco Products
vendor_cisco·2015-12-04
CVE-2015-1794 [MEDIUM] CWE-399 Multiple Vulnerabilities in OpenSSL (December 2015) Affecting Cisco Products
Multiple Vulnerabilities in OpenSSL (December 2015) Affecting Cisco Products
On December 3, 2015, the OpenSSL Project released a security advisory detailing five vulnerabilities.
Multiple Cisco products incorporate a version of the OpenSSL package affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.
This advisory will be updated as additional information becomes available.
Cisco will release software updates that address these vulnerabilities.
Workarounds that mitigate these vulnerabilities are not available.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151204-openssl
Red Hat
OpenSSL: BN_mod_exp may produce incorrect results on x86_64
vendor_redhat·2015-12-03·CVSS 7.5
CVE-2015-3193 [HIGH] OpenSSL: BN_mod_exp may produce incorrect results on x86_64
OpenSSL: BN_mod_exp may produce incorrect results on x86_64
The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5.pl in OpenSSL 1.0.2 before 1.0.2e on the x86_64 platform, as used by the BN_mod_exp function, mishandles carry propagation and produces incorrect output, which makes it easier for remote attackers to obtain sensitive private-key information via an attack against use of a (1) Diffie-Hellman (DH) or (2) Diffie-Hellman Ephemeral (DHE) ciphersuite.
Statement: This issue does not affect the version of OpenSSL as shipped with Red Hat Enterprise Linux 5, 6 and 7.
Package: openssl (Red Hat Enterprise Linux 5) - Not affected
Package: openssl097a (Red Hat Enterprise Linux 5) - Not affected
Package: openssl (Red Hat Enterprise Linux 6) - Not affected
Package: openssl
Debian
CVE-2015-3193: openssl - The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5.pl in OpenS...
vendor_debian·2015·CVSS 7.5
CVE-2015-3193 [HIGH] CVE-2015-3193: openssl - The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5.pl in OpenS...
The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5.pl in OpenSSL 1.0.2 before 1.0.2e on the x86_64 platform, as used by the BN_mod_exp function, mishandles carry propagation and produces incorrect output, which makes it easier for remote attackers to obtain sensitive private-key information via an attack against use of a (1) Diffie-Hellman (DH) or (2) Diffie-Hellman Ephemeral (DHE) ciphersuite.
Scope: local
bookworm: resolved (fixed in 1.0.2e-1)
bullseye: resolved (fixed in 1.0.2e-1)
forky: resolved (fixed in 1.0.2e-1)
sid: resolved (fixed in 1.0.2e-1)
trixie: resolved (fixed in 1.0.2e-1)
Cisco
Multiple Vulnerabilities in OpenSSL (December 2015) Affecting Cisco Products
vendor_cisco
CVE-2015-3193 Multiple Vulnerabilities in OpenSSL (December 2015) Affecting Cisco Products
CVE-2015-3193: Multiple Vulnerabilities in OpenSSL (December 2015) Affecting Cisco Products
On December 3, 2015, the OpenSSL Project released a security advisory detailing five vulnerabilities. Multiple Cisco products incorporate a version of the OpenSSL package affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This advisory will be updated as additional information becomes available. Cisco will release software updates that address these vulnerabilities.
CWE: CWE-399, CWE-399
Bug IDs: CSCux41145, CSCux41206, CSCux41294, CSCux41145, CSCux41206
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-3738 openssl: rsaz_1024_mul_avx2 overflow bug on x86_64
bugzilla·2017-12-08·CVSS 7.5
CVE-2017-3738 [HIGH] CVE-2017-3738 openssl: rsaz_1024_mul_avx2 overflow bug on x86_64
CVE-2017-3738 openssl: rsaz_1024_mul_avx2 overflow bug on x86_64
There is an overflow bug in the AVX2 Montgomery multiplication procedure
used in exponentiation with 1024-bit moduli. No EC algorithms are affected.
Analysis suggests that attacks against RSA and DSA as a result of this defect
would be very difficult to perform and are not believed likely. Attacks
against DH1024 are considered just feasible, because most of the work
necessary to deduce information about a private key may be performed offline.
The amount of resources required for such an attack would be significant.
However, for an attack on TLS to be meaningful, the server would have to share
the DH1024 private key among multiple clients, which is no longer an option
since CVE-2016-0701.
This only affects processors that su
Bugzilla
CVE-2017-3736 openssl: bn_sqrx8x_internal carry bug on x86_64
bugzilla·2017-11-03·CVSS 7.5
CVE-2017-3736 [HIGH] CVE-2017-3736 openssl: bn_sqrx8x_internal carry bug on x86_64
CVE-2017-3736 openssl: bn_sqrx8x_internal carry bug on x86_64
There is a carry propagating bug in the x86_64 Montgomery squaring procedure. No
EC algorithms are affected. Analysis suggests that attacks against RSA and DSA
as a result of this defect would be very difficult to perform and are not
believed likely. Attacks against DH are considered just feasible (although very
difficult) because most of the work necessary to deduce information
about a private key may be performed offline. The amount of resources
required for such an attack would be very significant and likely only
accessible to a limited number of attackers. An attacker would
additionally need online access to an unpatched system using the target
private key in a scenario with persistent DH parameters and a private
key that i
Bugzilla
CVE-2017-3732 openssl: BN_mod_exp may produce incorrect results on x86_64
bugzilla·2017-01-26·CVSS 7.5
CVE-2017-3732 [HIGH] CVE-2017-3732 openssl: BN_mod_exp may produce incorrect results on x86_64
CVE-2017-3732 openssl: BN_mod_exp may produce incorrect results on x86_64
There is a carry propagating bug in the x86_64 Montgomery squaring procedure. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a privat
HackerOne
BN_mod_exp may produce incorrect results on x86_64 (CVE-2015-3193)
hackerone·2016-04-12·CVSS 7.5
CVE-2015-3193 [HIGH] BN_mod_exp may produce incorrect results on x86_64 (CVE-2015-3193)
BN_mod_exp may produce incorrect results on x86_64 (CVE-2015-3193)
For certain inputs OpenSSL's BN_mod_exp function (which is used for RSA and Diffie Hellman) can produce wrong results.
The issue has been fixed by OpenSSL and rated moderate severity:
https://openssl.org/news/secadv/20151203.txt
A code example is here:
https://github.com/hannob/bignum-fuzz/blob/master/CVE-2015-3193-openssl-vs-gcrypt-modexp.c
Some more info:
https://blog.fuzzing-project.org/31-Fuzzing-Math-miscalculations-in-OpenSSLs-BN_mod_exp-CVE-2015-3193.html
Severity: Moderate
There is a carry propagating bug in the x86_64 Montgomery squaring procedure. No
EC algorithms are affected. Analysis suggests that attacks against RSA and DSA
as a result of this defect would be very difficult to perform and are not
believed
Bugzilla
CVE-2015-8618 golang: Carry propagation in Int.Exp Montgomery code in math/big library
bugzilla·2015-12-21·CVSS 7.5
CVE-2015-8618 [HIGH] CVE-2015-8618 golang: Carry propagation in Int.Exp Montgomery code in math/big library
CVE-2015-8618 golang: Carry propagation in Int.Exp Montgomery code in math/big library
Carry propagation in Int.Exp Montgomery function was found in golang's math/big library, similar to CVE-2015-3193. This issue was introduced in the 1.5 release and remains present in 1.5.1 and 1.5.2.
Upstream patch:
https://go-review.googlesource.com/#/c/17672/
CVE request:
http://seclists.org/oss-sec/2015/q4/550
Discussion:
Created golang tracking bugs for this issue:
Affects: epel-6 [bug 1293449]
Affects: fedora-all [bug 1293451]
---
golang-1.5.3-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
---
golang-1.5.3-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note
Bugzilla
CVE-2015-3193 OpenSSL: BN_mod_exp may produce incorrect results on x86_64
bugzilla·2015-12-04·CVSS 7.5
CVE-2015-3193 [HIGH] CVE-2015-3193 OpenSSL: BN_mod_exp may produce incorrect results on x86_64
CVE-2015-3193 OpenSSL: BN_mod_exp may produce incorrect results on x86_64
The following was reported by OpenSSL upstream:
There is a carry propagating bug in the x86_64 Montgomery squaring procedure. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a s
http://fortiguard.com/advisory/openssl-advisory-december-2015http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761http://openssl.org/news/secadv/20151203.txthttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151204-opensslhttp://www.fortiguard.com/advisory/openssl-advisory-december-2015http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlhttp://www.securityfocus.com/bid/78705http://www.securityfocus.com/bid/91787http://www.securitytracker.com/id/1034294http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.539966http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.754583http://www.ubuntu.com/usn/USN-2830-1https://blog.fuzzing-project.org/31-Fuzzing-Math-miscalculations-in-OpenSSLs-BN_mod_exp-CVE-2015-3193.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1288317https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfhttps://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=d73cc256c8e256c32ed959456101b73ba9842f72https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05398322https://kb.isc.org/article/AA-01438https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40100http://fortiguard.com/advisory/openssl-advisory-december-2015http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761http://openssl.org/news/secadv/20151203.txthttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151204-opensslhttp://www.fortiguard.com/advisory/openssl-advisory-december-2015http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlhttp://www.securityfocus.com/bid/78705http://www.securityfocus.com/bid/91787http://www.securitytracker.com/id/1034294http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.539966http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.754583http://www.ubuntu.com/usn/USN-2830-1https://blog.fuzzing-project.org/31-Fuzzing-Math-miscalculations-in-OpenSSLs-BN_mod_exp-CVE-2015-3193.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1288317https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfhttps://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=d73cc256c8e256c32ed959456101b73ba9842f72https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05398322https://kb.isc.org/article/AA-01438https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40100
2015-12-06
Published