News
Vigil@nce: OpenSSL, buffer overflow via bn_wexpand
March 2010 by Vigil@nce
The OpenSSL library does not check the error code of the
bn_wexpand() function, which can generate a denial of service, or
lead to code execution.
– Severity: 2/4
– Consequences: user access/rights, denial of service of service
– Provenance: intranet client
– Means of attack: no proof of concept, no attack
– Ability of attacker: expert (4/4)
– Confidence: confirmed by the editor (5/5)
– Diffusion of the vulnerable configuration: high (3/3)
– Creation date: 08/03/2010
IMPACTED PRODUCTS
– OpenSSL
– Slackware Linux
DESCRIPTION OF THE VULNERABILITY
The BN (BIGNUM) module of the OpenSSL suite implements the
management of big numbers.
The bn_wexpand() function extends the size of a BIGNUM, to ensure
it can contain ’n’ bytes:
bn_wexpand(bignumber, n);
Several functions of OpenSSL use bn_wexpand(), in files
crypto/bn/bn_div.c, crypto/bn/bn_gf2m.c, crypto/ec/ec2_smpl.c, and
engines/e_ubsec.c. However, they do not check if the size
extension failed, before using the BIGNUM. An overflow can thus
occur.
When an application uses the affected functions, this overflow can
create a denial of service, or lead to code execution.
CHARACTERISTICS
– Identifiers: BID-38562, CVE-2009-3245, SSA:2010-060-02,
VIGILANCE-VUL-9503
– Url: http://vigilance.fr/vulnerability/OpenSSL-buffer-overflow-via-bn-wexpand-9503
