低危 Oracle OSS Support Tools up to 18.3 OpenSSL 拒绝服务漏洞
CVE编号
CVE-2018-0739利用情况
暂无补丁情况
官方补丁披露时间
2018-03-28漏洞描述
带有递归定义的构造的ASN.1类型（例如在PKCS7中可以找到）最终可能由于恶意输入和过度递归而超出了堆栈。这可能会导致拒绝服务攻击。 SSL / TLS中没有来自不可靠来源的此类结构，因此被认为是安全的。已在OpenSSL 1.1.0h中修复（影响1.1.0-1.1.0g）。已在OpenSSL 1.0.2o中修复（影响1.0.2b-1.0.2n）。解决建议
OpenSSL Project已经为此发布了一个安全公告（20180327）以及相应补丁：https://www.openssl.org/news/secadv/20180327.txt受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | * | From (including) 1.0.2b | Up to (including) 1.0.2n | ||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | * | From (including) 1.1.0 | Up to (including) 1.1.0g | ||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.3 | openssl | * | Up to (excluding) 1.0.2o-r0 | |||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.4 | openssl | * | Up to (excluding) 1.0.2o-r0 | |||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.5 | openssl | * | Up to (excluding) 1.0.2o-r0 | |||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.6 | openssl | * | Up to (excluding) 1.0.2o-r0 | |||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.7 | openssl | * | Up to (excluding) 1.0.2o-r0 | |||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.8 | openssl | * | Up to (excluding) 1.0.2o-r0 | |||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_2 | openssl | * | Up to (excluding) 1.0.2k-16.amzn2.0.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_AMI | openssl | * | Up to (excluding) 1.0.2k-12.110.amzn1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | centos_7 | ovmf | * | Up to (excluding) 1.0.2k-16.el7 | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian_10 | libtomcrypt | * | Up to (excluding) 1.1.0h-1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian_11 | libtomcrypt | * | Up to (excluding) 1.1.0h-1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian_12 | libtomcrypt | * | Up to (excluding) 1.1.0h-1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian_7 | openssl | * | Up to (excluding) 1.0.1t-1+deb7u4 | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian_8 | openssl | * | Up to (excluding) 1.0.1t-1+deb8u8 | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian_9 | openssl | * | Up to (excluding) 1.1.0f-3+deb9u2 | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian_sid | libtomcrypt | * | Up to (excluding) 1.1.0h-1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_26 | compat-openssl10-devel | * | Up to (excluding) 1.1.0h-1.fc26 | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_27 | libtomcrypt-debugsource | * | Up to (excluding) 1.1.0h-1.fc27 | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_28 | libtomcrypt | * | Up to (excluding) 1.1.0h-2.fc28 | |||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.0 | ovmf-tools | * | Up to (excluding) 2017+git1510945757.b2662641d5-lp150.4.3.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.3 | compat-openssl098 | * | Up to (excluding) 0.1.9998svn3110-4.3.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_6 | oraclelinux-release | * | Up to (excluding) 1.0.1e-57.0.5.el6 | |||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_7 | oraclelinux-release | * | Up to (excluding) 1.0.2k-16.0.1.el7 | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_7 | openssl | * | Up to (excluding) 1.0.2k-16.el7 | |||||
| 运行在以下环境 | |||||||||
| 系统 | suse_11_SP4 | openssl-doc | * | Up to (excluding) 0.9.8j-0.106.9.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12 | libopenssl-devel | * | Up to (excluding) 1.0.2j-60.24 | |||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP2 | openssl | * | Up to (excluding) 1.0.2j-60.24.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP3 | libopenssl0_9_8-32bit | * | Up to (excluding) 4.9.4 | |||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_14.04 | openssl | * | Up to (excluding) 1.0.1f-1ubuntu2.24 | |||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_14.04.6_lts | openssl | * | Up to (excluding) 1.0.1f-1ubuntu2.24 | |||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_16.04 | openssl | * | Up to (excluding) 1.0.2g-1ubuntu4.11 | |||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_16.04.7_lts | openssl | * | Up to (excluding) 1.0.2g-1ubuntu4.11 | |||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_18.04 | openssl1.0 | * | Up to (excluding) 1.1.0g-2ubuntu3 | |||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_18.04.5_lts | openssl | * | Up to (excluding) 1.1.0g-2ubuntu3 | |||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_18.10 | openssl | * | Up to (excluding) 1.1.0g-2ubuntu3 | |||||
- 攻击路径 远程
- 攻击复杂度 复杂
- 权限要求 无需权限
- 影响范围 有限影响
- EXP成熟度 未验证
- 补丁情况 官方补丁
- 数据保密性 无影响
- 数据完整性 无影响
- 服务器危害 无影响
- 全网数量 100
| CWE-ID | 漏洞类型 |
| CWE-674 | 未经控制的递归 |
Exp相关链接
版权声明
本站原创文章转载请注明文章出处及链接，谢谢合作！
评论