# MA-579.032016: MyCERT Advisory - OpenSSL Releases Security Advisory

**Date:** 02 Mar 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-579.032016  
**Advisory ID:** MA-579.032016

---

####
**1.0 Introduction**
OpenSSL is an open source project that provides a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. OpenSSL has released updates to address vulnerabilities in prior versions. With this update, OpenSSL is disabling the SSLv2 protocol by default, as well as removing SSLv2 EXPORT ciphers. Users and administrators are encouraged to review the OpenSSL Security Advisory and apply the necessary updates.
**2.0 Impact**
These updates address exploitation of some of these vulnerabilities may allow a remote attacker to obtain sensitive information.
**3.0 Affected Products**
The affected products of OpenSSL is as the following:
- OpenSSL version 1.0.1r, 1.0.1q, 1.0.1p, 1.0.1o, 1.0.1n, 1.0.1m, 1.0.1l, 1.0.1k, 1.0.1j, 1.0.1i, 1.0.1h, 1.0.1g, 1.0.1f, 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a, 1.0.
- OpenSSL version 1.0.2f, 1.0.2e, 1.0.2d, 1.0.2c, 1.0.2b, 1.0.2a, 1.0.2
**4.0 Recommendation**
MyCERT highly recommended users of these applications to upgrade to the latest version of the affected products. The following updates are available:
> 4.1 Cross-protocol attack on TLS using SSLv2 (DROWN)(CVE-2016-0800)
> This issue affects all current unpatched OpenSSL servers using versions that predate 1.0.2a, 1.0.1m, 1.0.0r and 0.9.8zf released on 19/Mar/2015.
>
> - OpenSSL 1.0.2 users should upgrade to 1.0.2g
> - OpenSSL 1.0.1 users should upgrade to 1.0.1s
>
> 4.2 Double-free in DSA code (CVE-2016-0705)
> This issue affects OpenSSL versions 1.0.2 and 1.0.1.
>
> - OpenSSL 1.0.2 users should upgrade to 1.0.2g
> - OpenSSL 1.0.1 users should upgrade to 1.0.1s
>
> 4.3 Memory leak in SRP database lookups (CVE-2016-0798)
> This issue affects OpenSSL versions 1.0.2 and 1.0.1.
>
> - OpenSSL 1.0.2 users should upgrade to 1.0.2g
> - OpenSSL 1.0.1 users should upgrade to 1.0.1s
>
> 4.4 BN\_hex2bn/BN\_dec2bn NULL pointer deref/heap corruption (CVE-2016-0797) 
> This issue affects OpenSSL versions 1.0.2 and 1.0.1.
>
> - OpenSSL 1.0.2 users should upgrade to 1.0.2g
> - OpenSSL 1.0.1 users should upgrade to 1.0.1s
>
> 4.5 Fix memory issues in BIO\_\*printf functions (CVE-2016-0799)
> This issue affects OpenSSL versions 1.0.2 and 1.0.1.
>
> - OpenSSL 1.0.2 users should upgrade to 1.0.2g
> - OpenSSL 1.0.1 users should upgrade to 1.0.1s
>
> 4.6 Side channel attack on modular exponentiation (CVE-2016-0702)
> This issue affects OpenSSL versions 1.0.2 and 1.0.1.
>
> - OpenSSL 1.0.2 users should upgrade to 1.0.2g
> - OpenSSL 1.0.1 users should upgrade to 1.0.1s
>
> 4.7 Divide-and-conquer session key recovery in SSLv2 (CVE-2016-0703)   
> This issue affected OpenSSL versions 1.0.2, 1.0.1l, 1.0.0q, 0.9.8ze and all earlier versions.
>
> - Fixed in OpenSSL 1.0.2a, 1.0.1m, 1.0.0r and 0.9.8zf (released March 19th 2015)
>
> 4.8 Bleichenbacher oracle in SSLv2 (CVE-2016-0704)
> This issue affected OpenSSL versions 1.0.2, 1.0.1l, 1.0.0q, 0.9.8ze and all earlier versions.
>
> - Fixed in OpenSSL 1.0.2a, 1.0.1m, 1.0.0r and 0.9.8zf (released March 19th 2015)
>
> 4.9 The OpenSSL updates is available to download at:
> <https://www.openssl.org/source/>
Note :
Support for OpenSSL version 1.0.1 will cease on 31st December 2016. No security updates for that version will be provided after that date. Users of 1.0.1 are advised to upgrade.  Support for versions 0.9.8 and 1.0.0 ended on 31st December 2015. Those versions are no longer receiving security updates
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#42213b2027307b7b7b02213b20273031272137302b363b6c2f3b) or [[email protected]](/cdn-cgi/l/email-protection#9df0e4fef8efe9ddf0e4fef8efe9b3f2effab3f0e4) 
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- OpenSSL Patches Eight Vulnerabilities: <https://www.us-cert.gov/ncas/current-activity/2016/03/01/OpenSSL-Releases-Security-Advisory>
- OpenSSL Security Advisory [1st March 2016]: <https://www.openssl.org/news/secadv/20160301.txt>
- OpenSSL – vulnerabilities: <https://www.openssl.org/news/vulnerabilities.html>