CVE-2015-1787: Input Validation
If client authentication is used, then a server can crash with a segmentation fault in the event of a DHE ciphersuite being selected and a zero length ClientKeyExchange (CKE) message being sent by the client. This could be exploited in a denial of service attack.
This issue affects OpenSSL version 1.0.2, and is fixed in version 1.0.2a.
Acknowledgements:
Red Hat would like to thank the OpenSSL project for reporting this issue. Upstream acknowledges Matt Caswell of the OpenSSL development team as the original reporter.
Other sources
The ssl3getclientkeyexchange function in s3srvr.c in OpenSSL 1.0.2 before 1.0.2a, when client authentication and an ephemeral Diffie-Hellman ciphersuite are enabled, allows remote attackers to cause a denial of service (daemon crash) via a ClientKeyExchange message with a length of zero.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1787?
CVE-2015-1787 has a severity rating that indicates it can lead to a denial of service attack due to server crashes.
How do I fix CVE-2015-1787?
To fix CVE-2015-1787, upgrade OpenSSL to version 1.0.2 or later.
What versions of OpenSSL are affected by CVE-2015-1787?
CVE-2015-1787 affects OpenSSL versions 1.0.2, 1.0.2-beta1, 1.0.2-beta2, and 1.0.2-beta3.
What type of attack can exploit CVE-2015-1787?
CVE-2015-1787 can be exploited in a denial of service attack leading to service interruption.
What causes the crash in CVE-2015-1787?
The crash in CVE-2015-1787 is caused by a segmentation fault triggered when a zero length ClientKeyExchange message is sent by the client.