# MA-540.122015: MyCERT Advisory - OpenSSL Patches Multiple Vulnerabilities

**Date:** 04 Dec 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-540.122015  
**Advisory ID:** MA-540.122015

---

#### **1.0 Introduction**
OpenSSL has released updates 
**2.0 Impact**
These updates address exploitation of some of these vulnerabilities that could potentially allow an attacker to cause a Denial of Service.
**3.0 Affected Products**
This vulnerability affects OpenSSL versions 1.0.2. , 1.0.1. , 1.0.0 and 0.9.8.
**4.0 Recommendation**
MyCERT highly recommends users of these applications to upgrade to the latest version of the affected products. The following updates are available:
**4.1BN\_mod\_exp may produce incorrect results on x86\_64 (CVE-2015-3193)**
An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. For example this can occur by default in OpenSSL DHE based SSL/TLS ciphersuites.
This issue affects OpenSSL version 1.0.2.
- OpenSSL 1.0.2 users should upgrade to 1.0.2e
**4.2 Certificate verify crash with missing PSS parameter (CVE-2015-3194)**
Any application, which performs certificate verification, is vulnerable including OpenSSL clients and servers that enable client authentication.
This issue affects OpenSSL versions 1.0.2 and 1.0.1.
- OpenSSL 1.0.2 users should upgrade to 1.0.2e
- OpenSSL 1.0.1 users should upgrade to 1.0.1q
**4.3 X509\_ATTRIBUTE memory leak (CVE-2015-3195)**
When presented with a malformed X509\_ATTRIBUTE structure OpenSSL will leak memory. This structure is used by the PKCS#7 and CMS routines so any application, which reads PKCS #7 or CMS data from untrusted sources, is affected. SSL/TLS is not affected.
This issue affects OpenSSL versions 1.0.2 and 1.0.1, 1.0.0 and 0.9.8.
- OpenSSL 1.0.2 users should upgrade to 1.0.2e
- OpenSSL 1.0.1 users should upgrade to 1.0.1q
- OpenSSL 1.0.0 users should upgrade to 1.0.0t
- OpenSSL 0.9.8 users should upgrade to 0.9.8zh
**4.4 Race condition handling PSK identify hint (CVE-2015-3196)**
If a multi-threaded client receives PSK identity hints then the values are wrongly updated in the parent SSL\_CTX structure. This can result in a race condition potentially leading to a double free of the identify hint data.
This issue was fixed in OpenSSL 1.0.2d and 1.0.1p but has not been previously listed in an OpenSSL security advisory. This issue also affects OpenSSL 1.0.0 and has not been previously fixed in an OpenSSL 1.0.0 release.
- OpenSSL 1.0.2 users should upgrade to 1.0.2d
- OpenSSL 1.0.1 users should upgrade to 1.0.1p
- OpenSSL 1.0.0 users should upgrade to 1.0.0t
Note:
Support for OpenSSL versions 1.0.0 and 0.9.8 will cease on 31st December 2015. No security updates for these releases will be provided after that date. Users of these releases are advised to upgrade.
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#781b011a1d0a414141381b011a1d0a0b1d1b0d0a110c01561501) or [[email protected]](/cdn-cgi/l/email-protection#7c11051f190e083c11051f190e0852130e1b521105) 
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- OpenSSL Patches Multiple Vulnerabilities:
<https://www.us-cert.gov/ncas/current-activity/2015/12/03/OpenSSL-Patches-Multiple-Vulnerabilities>
- OpenSSL Security Advisory [3 Dec 2015]:
<https://www.openssl.org/news/secadv/20151203.txt>