# MA-599.052016: MyCERT Advisory - OpenSSL Releases Security Advisory

**Date:** 04 May 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-599.052016  
**Advisory ID:** MA-599.052016

---

####
**1.0 Introduction**
OpenSSL is an open source project that provides a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. OpenSSL has released security updates to address vulnerabilities in previous versions. Users and administrators are encouraged to review the OpenSSL Security Advisory page and apply the necessary updates.
**2.0 Impact**
These updates address exploitation of one of these vulnerabilities that may allow a remote attacker to take control of an affected system.
**3.0 Affected Products**
The affected products of OpenSSL :
- Prior version of OpenSSL 1.0.2h
- Prior version of OpenSSL 1.0.1t
**4.0 Recommendation**
MyCERT highly recommends users of these applications to upgrade to the latest version of the affected products. The following updates are available:
> 4.1 Memory corruption in the ASN.1 encoder (CVE-2016-2108)
> This issue affected versions of OpenSSL prior to April 2015.
>
> - OpenSSL 1.0.2 users should upgrade to 1.0.2c
> - OpenSSL 1.0.1 users should upgrade to 1.0.1o
>
> 4.2 Padding oracle in AES-NI CBC MAC check (CVE-2016-2107)
> This issue was introduced as part of the fix for Lucky 13 padding attack (CVE-2013-0169).
>
> - OpenSSL 1.0.2 users should upgrade to 1.0.2h
> - OpenSSL 1.0.1 users should upgrade to 1.0.1t
>
> 4.3 EVP\_EncodeUpdate overflow (CVE-2016-2105)
> An overflow can occur in the EVP\_EncodeUpdate() function which is used for Base64 encoding of binary data.
>
> - OpenSSL 1.0.2 users should upgrade to 1.0.2h
> - OpenSSL 1.0.1 users should upgrade to 1.0.1t
>
> 4.4 EVP\_EncryptUpdate overflow (CVE-2016-2106)
> An overflow can occur in the EVP\_EncryptUpdate() function.
>
> - OpenSSL 1.0.2 users should upgrade to 1.0.2h
> - OpenSSL 1.0.1 users should upgrade to 1.0.1t
>
> 4.5 ASN.1 BIO excessive memory allocation (CVE-2016-2109)
> When ASN.1 data is read from a BIO using functions such as d2i\_CMS\_bio() a short invalid encoding can casuse allocation of large amounts of memory potentially consuming excessive resources or exhausting memory.
>
> - OpenSSL 1.0.2 users should upgrade to 1.0.2h
> - OpenSSL 1.0.1 users should upgrade to 1.0.1t
>
> 4.6 EBCDIC overread (CVE-2016-2176)
> ASN1 Strings that are over 1024 bytes can cause an overread in applications using the X509\_NAME\_oneline() function on EBCDIC systems. This could result in arbitrary stack data being returned in the buffer.
>
> - OpenSSL 1.0.2 users should upgrade to 1.0.2h
> - OpenSSL 1.0.1 users should upgrade to 1.0.1t
>
> 4.7 The OpenSSL updates is available to download at:
> <https://www.openssl.org/source/>
Note :
Support for OpenSSL version 1.0.1 will cease on 31st December 2016. No security updates for that version will be provided after that date. Users of 1.0.1 are advised to upgrade.  Support for versions 0.9.8 and 1.0.0 ended on 31st December 2015. Those versions are no longer receiving security updates
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#c3a0baa1a6b1fafafa83a0baa1a6b1b0a6a0b6b1aab7baedaeba) or [[email protected]](/cdn-cgi/l/email-protection#a0cdd9c3c5d2d4e0cdd9c3c5d2d48ecfd2c78ecdd9) 
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- OpenSSL Releases Security Updates:
<https://www.us-cert.gov/ncas/current-activity/2016/05/03/OpenSSL-Releases-Security-Advisory>
- OpenSSL Security Advisory [3rd May 2016]:
<https://www.openssl.org/news/secadv/20160503.txt>
- OpenSSL – vulnerabilities:
<https://www.openssl.org/news/vulnerabilities.html>