# MA-483.062015: MyCERT Advisory - OpenSSL Patches Multiple Vulnerabilities

**Date:** 15 Jun 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-483.062015  
**Advisory ID:** MA-483.062015

---

#### **1.0 Introduction**
OpenSSL has released updates addressing multiple vulnerabilities, one of which allows a remote attacker to downgrade vulnerable TLS connections to 512-bit export-grade cryptography—an attack known as Logjam (CVE-2015-4000). Users and administrators are encouraged to review the OpenSSL Security Advisory and apply the necessary updates.
**2.0 Impact**
These updates address exploitation of some of these vulnerabilities that could potentially allow an attacker to read and modify data passed over the connection.
**3.0 Affected Products**
The following OpenSSL updates are available:
- OpenSSL 1.0.2b for 1.0.2 users
- OpenSSL 1.0.1n for 1.0.1 users
- OpenSSL 1.0.0s for 1.0.0d (and below) users
- OpenSSL 0.9.8zg for 0.9.8r (and below) users
**4.0 Recommendation**
MyCERT highly recommended users of these applications to upgrade to the latest version of the affected products. The following updates are available:
4.1 DHE man-in-the-middle protection Logjam (CVE-2015-4000)
OpenSSL has added protection for TLS clients by rejecting handshakes with DH parameters shorter than 768 bits. This limit will be increased to 1024 bits in a future release.
- OpenSSL 1.0.2 users should upgrade to 1.0.2b
- OpenSSL 1.0.1 users should upgrade to 1.0.1n
4.2 Malformed ECParameters causes infinite loop (CVE-2015-1788)
This issue affects OpenSSL versions: 1.0.2 and 1.0.1. Recent 1.0.0 and 0.9.8 versions are not affected. 1.0.0d and 0.9.8r and below are affected.
- OpenSSL 1.0.2 users should upgrade to 1.0.2b
- OpenSSL 1.0.1 users should upgrade to 1.0.1n
- OpenSSL 1.0.0d (and below) users should upgrade to 1.0.0s
- OpenSSL 0.9.8r (and below) users should upgrade to 0.9.8zg
4.3 Exploitable out-of-bounds read in X509\_cmp\_time (CVE-2015-1789)
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.
- OpenSSL 1.0.2 users should upgrade to 1.0.2b
- OpenSSL 1.0.1 users should upgrade to 1.0.1n
- OpenSSL 1.0.0 users should upgrade to 1.0.0s
- OpenSSL 0.9.8 users should upgrade to 0.9.8zg
4.4 PKCS7 crash with missing EnvelopedContent (CVE-2015-1790)
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.
- OpenSSL 1.0.2 users should upgrade to 1.0.2b
- OpenSSL 1.0.1 users should upgrade to 1.0.1n
- OpenSSL 1.0.0 users should upgrade to 1.0.0s
- OpenSSL 0.9.8 users should upgrade to 0.9.8zg
4.5 CMS verify infinite loop with unknown hash function (CVE-2015-1792)
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.
- OpenSSL 1.0.2 users should upgrade to 1.0.2b
- OpenSSL 1.0.1 users should upgrade to 1.0.1n
- OpenSSL 1.0.0 users should upgrade to 1.0.0s
- OpenSSL 0.9.8 users should upgrade to 0.9.8zg.
4.6 Race condition handling NewSessionTicket (CVE-2015-1791)
This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.
- OpenSSL 1.0.2 users should upgrade to 1.0.2b
- OpenSSL 1.0.1 users should upgrade to 1.0.1n
- OpenSSL 1.0.0 users should upgrade to 1.0.0s
- OpenSSL 0.9.8 users should upgrade to 0.9.8zg
4.7 Invalid free in DTLS (CVE-2014-8176)
This issue affected older OpenSSL versions 1.0.1, 1.0.0 and 0.9.8.
- OpenSSL 0.9.8 DTLS users should upgrade to 0.9.8za
- OpenSSL 1.0.0 DTLS users should upgrade to 1.0.0m.
- OpenSSL 1.0.1 DTLS users should upgrade to 1.0.1h.
4.8 The OpenSSL updates are available to download at:
<https://www.openssl.org/source/>
Note :
Support for OpenSSL versions 1.0.0 and 0.9.8 will cease on 31st December 2015. No security updates for these releases will be provided after that date. Users of these releases are advised to upgrade.
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#395a405b5c4b000000795a405b5c4b4a5c5a4c4b504d40175440) or [[email protected]](/cdn-cgi/l/email-protection#7b1602181e090f3b1602181e090f5514091c551602) 
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0References**
- OpenSSL Patches Multiple Vulnerabilities : <https://www.us-cert.gov/ncas/current-activity/2015/06/12/OpenSSL-Patches-Multiple-Vulnerabilities>
- OpenSSL Security Advisory [11 June 2015] :  <https://www.openssl.org/news/secadv_20150611.txt>
- National Vulnerability Database : <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4000>
- Welcome to the OpenSSL Project : <https://www.openssl.org/>