CVE-2015-0289: Null Pointer Dereference
The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7doit.c and crypto/pkcs7/pk7lib.c.
Other sources
The PKCS#7 parsing code does not handle missing outer ContentInfo correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with missing content and trigger a NULL pointer dereference on parsing.
Applications that verify PKCS#7 signatures, decrypt PKCS#7 data or otherwise parse PKCS#7 structures from untrusted sources are affected. OpenSSL clients and servers are not affected.
This issue affects OpenSSL versions: 1.0.2, 1.0.1, 1.0.0, and 0.9.8. This issue is fixed in versions: 1.0.2a, 1.0.1m, 1.0.0r, and 0.9.8zf.
Acknowledgements:
Red Hat would like to thank the OpenSSL project for reporting this issue. Upstream acknowledges Michal Zalewski of Google as the original reporter.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0289?
CVE-2015-0289 is classified as a denial of service vulnerability.
How do I fix CVE-2015-0289?
To resolve CVE-2015-0289, update OpenSSL to version 1.0.2 or later, 1.0.1 or later, or 0.9.8ze or later.
Which versions of OpenSSL are affected by CVE-2015-0289?
CVE-2015-0289 affects OpenSSL versions before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a.
What kind of exploit can occur due to CVE-2015-0289?
Exploitation of CVE-2015-0289 can lead to a NULL pointer dereference causing an application crash.
Is there a workaround for CVE-2015-0289?
There is no known workaround for CVE-2015-0289; the recommended solution is to upgrade OpenSSL.