# MA-490.072015: MyCERT Advisory - OpenSSL Patches Multiple Vulnerabilities

**Date:** 10 Jul 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-490.072015  
**Advisory ID:** MA-490.072015

---

#### **1.0 Introduction**
OpenSSL has released updates to address a vulnerability that could impact the proper certificate verification. A remote attacker could ‘issue’ invalid certificates that pass validation by affected versions. This vulnerability will impact any application that verifies certificates including SSL/TLS/DTLS clients and SSL/TLS/DTLS servers using client authentication
Users and administrators are encouraged to review the OpenSSL Security Advisory and apply the necessary updates.
**2.0 Impact**
These updates address exploitation of some of these vulnerabilities that could potentially allow an attacker to cause certain checks on untrusted certificates to be bypassed, such as the CA flag, enabling them to use a valid leaf certificate to act as a CA and "issue" an invalid certificate.
**3.0 Affected Products**
This vulnerability affects OpenSSL versions 1.0.2c, 1.0.2b, 1.0.1n and 1.0.1o.
**4.0 Recommendation**
MyCERT highly recommended users of these applications to upgrade to the latest version of the affected products. The following updates are available:
4.1 Alternative chains certificate forgery (CVE-2015-1793)
This issue will impact any application that verifies certificates including SSL/TLS/DTLS clients and SSL/TLS/DTLS servers using client authentication.
- OpenSSL 1.0.2b/1.0.2c users should upgrade to 1.0.2d
- OpenSSL 1.0.1n/1.0.1o users should upgrade to 1.0.1p
4.2 The OpenSSL updates are available to download at:
<https://www.openssl.org/source/>
Note :
Support for OpenSSL versions 1.0.0 and 0.9.8 will cease on 31st December 2015. No security updates for these releases will be provided after that date. Users of these releases are advised to upgrade.
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#14776d7671662d2d2d54776d76716667717761667d606d3a796d) or [[email protected]](/cdn-cgi/l/email-protection#412c3822243335012c38222433356f2e33266f2c38) 
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- OpenSSL Released Security Advisory
<https://www.us-cert.gov/ncas/current-activity/2015/07/09/OpenSSL-Releases-Security-Advisory>
- OpenSSL Security Advisory [9 July 2015]
<https://www.openssl.org/news/secadv_20150709.txt>
- OpenSSL Vulnerabilities      
<https://www.openssl.org/news/vulnerabilities.html>