OpenSSL CMS / PKCS #7 Decryption and NULL Pointer Dereference Vulnerabilities

SA46958

CVE-2012-0884, CVE-2012-1165

12 Mar 2012

13 Mar 2012

Moderately Critical

Vendor Patch

OpenSSL 0.x
OpenSSL 1.x

From remote

DoS (Denial of Service)

This includes vulnerabilities ranging from excessive resource consumption (e.g. causing a system to use a lot of memory) to crashing an application or an entire system.

Security Bypass

This covers vulnerabilities or security issues where malicious users or people can bypass certain security mechanisms of the application.

The actual impact varies significantly depending on the design and purpose of the affected application.

Two vulnerabilities have been reported in OpenSSL, which can be exploited by malicious people to bypass certain security restrictions and cause a DoS (Denial of Service) in an application using the library.

1) An error in the CMS and PKCS #7 decryption code can be exploited via a so-called "Million Message Attack" against CMS, PKCS #7, or S/MIME decryption operations.

Successful exploitation of this vulnerability requires sending on average 2^20 messages, affecting only automated systems in practise.

2) A NULL-pointer dereference error in the "mime_param_cmp()" function (crypto/asn1/asn_mime.c) when parsing certain MIME headers can be exploited to cause a crash.

Update to version 1.0.0h or 0.9.8u.

1) The vendor credits Ivan Nestlerode.
2) Reported by the vendor.

http://www.openssl.org/news/secadv_20120312.txt
http://cvs.openssl.org/chngview?cn=22252