CVE-2015-3195: Infoleak
A memory leak vulnerability was found in the way OpenSSL parsed PKCS#7 and CMS data. A remote attacker could use this flaw to cause an application that parses PKCS#7 or CMS data from untrusted sources to use an excessive amount of memory and possibly crash.
Other sources
The ASN1TFLGCOMBINE implementation in crypto/asn1/tasndec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.
The following was reported by OpenSSL upstream:
When presented with a malformed X509ATTRIBUTE structure OpenSSL will leak memory. This structure is used by the PKCS#7 and CMS routines so any application which reads PKCS#7 or CMS data from untrusted sources is affected. SSL/TLS is not affected.
This issue affects OpenSSL versions 1.0.2 and 1.0.1, 1.0.0 and 0.9.8.
OpenSSL 1.0.2 users should upgrade to 1.0.2e OpenSSL 1.0.1 users should upgrade to 1.0.1q OpenSSL 1.0.0 users should upgrade to 1.0.0t OpenSSL 0.9.8 users should upgrade to 0.9.8zh
This issue was reported to OpenSSL on November 9 2015 by Adam Langley (Google/BoringSSL) using libFuzzer. The fix was developed by Dr. Stephen Henson of the OpenSSL development team.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2015-3195?
CVE-2015-3195 has been classified as a high-severity vulnerability due to its potential to cause excessive memory usage and crashes.
How do I fix CVE-2015-3195?
To remediate CVE-2015-3195, upgrade OpenSSL to version 0.9.8zh, 1.0.0t or later, or apply the appropriate vendor-specific patches if using affected versions.
Which versions of OpenSSL are affected by CVE-2015-3195?
CVE-2015-3195 affects OpenSSL versions up to and including 1.0.2 and 1.0.0, as well as 0.9.8.
Can CVE-2015-3195 be exploited remotely?
Yes, a remote attacker could exploit CVE-2015-3195 by sending specially crafted PKCS#7 or CMS data.
What type of applications are vulnerable to CVE-2015-3195?
Applications that parse PKCS#7 or CMS data from untrusted sources are vulnerable to CVE-2015-3195.