Security Audit

Our Web Application Pentest ( WAP) attempts to address the Owasp top 10 & SANS top 20 web application vulnerabilities and other exploitable loopholes of your web application . Along with it our WAP team also test web applications for Business logic flaws that can directly or indirectly effect the functioning of application.

Trainings

We are here to help you solve your biggest query- where and how to start? CDI has brought various courses in Ethical Hacking in Chandigarh where all you technology lovers will be given the much needed push to move forward and create a niche for yourself in the field. From Beginner to Expert level we have many kinds of training patterns.

India Nigeria Partner With Us Latest Events Articles
91-771045-0011
Call Us : +91-771045-0011
91-771045-0011

OpenSSL Fixed "FREAK" plus 11 more Vulnerabilities!

 Posted By: Ljsingh / Mar 26, 2015 /  DoS Attack , Denial of Service Attack , DoS , Opensource , OpenSSL , FREAK , FREAK Vulnerability , Linux

openssl vulnerabilities

OpenSSL project, today, fixed a dozen of High-Severity rated Vulnerabilities including the recently discovered FREAK Vulnerability, allowing users to get down to an encryption which can be cracked easily.

OpenSSL released a security advisory listing 12 Vulnerabilities out of which the top one is the "ClientHello sigalgs DoS (CVE-2015-0291)" Vulnerability. It is basically a Denial-Of-Service attack exploit vulnerability, under which if a user connects to an OpenSSL server and renegotiates with an invalid signature algorithms extension a NULL pointer dereference will occur. This can be exploited in a DoS attack against the server.

Another one is the FREAK Vulnerability (CVE-2015-0204) whose fix is delivered by Stephen Henson of the OpenSSL core team.

One more DoS exploit Vulnerability, although treated as moderately severe, was fixed. "DoS via reachable assert in SSLv2 servers (CVE-2015-0293)" in which a malicious client can trigger an OPENSSL_assert (i.e., an abort) in servers that both support SSLv2 and enable export cipher suites by sending a specially crafted SSLv2 CLIENT-MASTER-KEY message.

Out of all 12 vulnerabilities, 6 are found to be affecting all versions of OpenSSL:

1.0.2, 1.0.1, 1.0.0 and 0.9.8.

OpenSSL 1.0.2 users should upgrade to 1.0.2a OpenSSL 1.0.1 users should upgrade to 1.0.1m. OpenSSL 1.0.0 users should upgrade to 1.0.0r. OpenSSL 0.9.8 users should upgrade to 0.9.8zf.

Out of these 6, 4 are Rated Moderately severe and 2 are Rated Low severe. Interestingly, OpenSSL admitted that previously the "FREAK" Vulnerability was rated as low but now its rating has been changed to High-Severity.

All the vulnerabilities are mentioned below:

openssl vulnerabilities

openssl vulnerabilities

Another interesting thing came into light 3 days ago when a person with twitter handle @ramosbugs claimed on twitter, having a working exploit available for CVE-2015-0219 1.0.2 Server DoS. He also said he have a PoC for it and will share it as soon as the patch will be released by OpenSSL.

openssl vulnerabilities 

Mitigation

OpenSSL Advisory recommended the system admins to update OpenSSL versions to the latest ones as soon as possible to avoid any attack.

See more of Cyber Intelligence by logging in.
Connect with cyber security experts,Discover job opportunities,Online Training, Information Security Advisory and lot more.