CVE-2017-3731: Truncated packet could crash via OOB read
If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash.
For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k
External References:
https://www.openssl.org/news/secadv/20170126.txt
Other sources
If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3731?
CVE-2017-3731 has been rated as high severity due to its potential to cause a denial of service through a crash.
How do I fix CVE-2017-3731?
To remediate CVE-2017-3731, upgrade your OpenSSL to a version that is not affected, such as 1.0.2k or later.
Which versions of OpenSSL are affected by CVE-2017-3731?
CVE-2017-3731 affects OpenSSL versions 1.0.2 and 1.1.0 before certain fixes.
What impact does CVE-2017-3731 have on OpenSSL users?
Users of OpenSSL affected by CVE-2017-3731 may experience application crashes under specific conditions when using certain ciphers.
Is CVE-2017-3731 specific to any operating system?
CVE-2017-3731 can affect any system running vulnerable versions of OpenSSL, not limited to a specific operating system.