Menu
OpenSSL patches eight new vulnerabilities

OpenSSL patches eight new vulnerabilities

The flaws are of moderate and low severity, but server admins should still update

Server administrators are advised to upgrade OpenSSL again to fix eight new vulnerabilities, two of which can lead to denial-of-service (DoS) attacks.

The flaws are only of moderate and low severity, unlike the Heartbleed vulnerability discovered last year. Heartbleed could have allowed attackers to steal sensitive information including encryption keys from servers.

Nevertheless, "system administrators should plan to upgrade their running OpenSSL server instances in the coming days," said Tod Beardsley, engineering manager at vulnerability intelligence firm Rapid7, via email Friday.

The newly released OpenSSL versions are 1.0.1k, 1.0.0p and 0.9.8zd.

Two denial-of-service vulnerabilities, tracked as CVE-2014-3571 and CVE-2015-0206, only affect OpenSSL's implementation of the DTLS (Datagram Transport Layer Security) protocol, which is not as widely used as the TLS (Transport Layer Security) protocol.

DTLS provides encrypted communications over datagram protocols such as UDP and is used for things like VPN (Virtual Private Networks) and WebRTC (Web Real-Time Communication).

"In order to maintain reliable service, OpenSSL should be upgraded or replaced by SSL libraries not affected by these issues, such as LibreSSL," Beardsley said.

Other flaws do apply to TLS and can lead to unexpected behavior when OpenSSL is built with the no-ssl3 option, a situation where the server accepts DH certificates for client authentication without the certificate verify message and a case where a client accepts an ECDH handshake despite a missing server key exchange message, which removes the forward secrecy property of the ciphersuite.

"We are still looking into the issues disclosed today," Beardsley said. "While these vulnerabilities do not appear to lead to remote code execution or information disclosure, we will let the OpenSSL team know if we find any new, unexpected vectors of attack."

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags patchesonline safetysecurityRapid7encryptionExploits / vulnerabilities

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments