CVE-2015-0207: Medium severity openssl vulnerability
The dtls1listen function in d1lib.c in OpenSSL 1.0.2 before 1.0.2a does not properly isolate the state information of independent data streams, which allows remote attackers to cause a denial of service (application crash) via crafted DTLS traffic, as demonstrated by DTLS 1.0 traffic to a DTLS 1.2 server.
Other sources
The DTLSv1listen function is intended to be stateless and processes the initial ClientHello from many peers. It is common for user code to loop over the call to DTLSv1listen until a valid ClientHello is received with an associated cookie. A defect in the implementation of DTLSv1listen means that the state is preserved in the SSL object from one invocation to the next, leading to a segmentation fault. Errors processing the initial ClientHello can trigger this scenario. An example of such an error could be that a DTLS 1.0 only client is attempting to connect to a DTLS 1.2 only server.
This issue affects OpenSSL version 1.0.2, and is fixed in version 1.0.2a.
Acknowledgements:
Red Hat would like to thank the OpenSSL project for reporting this issue. Upstream acknowledges Per Allansson as the original reporters.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0207?
CVE-2015-0207 has a moderate severity rating as it can lead to denial of service through application crashes.
How do I fix CVE-2015-0207?
To fix CVE-2015-0207, upgrade OpenSSL to version 1.0.2a or later.
Which versions of OpenSSL are affected by CVE-2015-0207?
CVE-2015-0207 affects OpenSSL version 1.0.2 and its beta versions up to 1.0.2.
What type of attack does CVE-2015-0207 allow?
CVE-2015-0207 allows attackers to crash applications by sending crafted DTLS traffic.
What is the impact of CVE-2015-0207 on systems using OpenSSL?
The impact of CVE-2015-0207 is primarily a denial of service, causing application instability.