CVE-2017-3731
Truncated packet could crash via OOB read
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.
Si un servidor o cliente SSL/TLS se ejecuta en un host de 32 bits y se utiliza un cifrador específico, un paquete truncado puede dar lugar a que el servidor o el cliente realicen una lectura fuera de límites que, normalmente, provoca un cierre inesperado En OpenSSL 1.1.0, el cierre inesperado se puede desencadenar cuando se usa CHACHA20/POLY1305
An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite.
*Credits:
Robert Święcki of Google
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2016-12-16 CVE Reserved
- 2017-01-26 CVE Published
- 2023-08-08 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-125: Out-of-bounds Read
CAPEC
References (22)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/95813 | Third Party Advisory | |
| http://www.securitytracker.com/id/1037717 | Third Party Advisory | |
| https://github.com/openssl/openssl/commit/00d965474b22b54e4275232bc71ee0c699c5cd21 | Third Party Advisory | |
| https://security.netapp.com/advisory/ntap-20171019-0002 | Third Party Advisory |
|
| https://security.paloaltonetworks.com/CVE-2017-3731 | Third Party Advisory | |
| https://source.android.com/security/bulletin/pixel/2017-11-01 | Third Party Advisory | |
| https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03838en_us | Third Party Advisory | |
| https://www.tenable.com/security/tns-2017-04 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://rhn.redhat.com/errata/RHSA-2017-0286.html | 2022-08-16 | |
| http://www.debian.org/security/2017/dsa-3773 | 2022-08-16 | |
| https://access.redhat.com/errata/RHSA-2018:2185 | 2022-08-16 | |
| https://access.redhat.com/errata/RHSA-2018:2186 | 2022-08-16 | |
| https://access.redhat.com/errata/RHSA-2018:2187 | 2022-08-16 | |
| https://security.FreeBSD.org/advisories/FreeBSD-SA-17:02.openssl.asc | 2022-08-16 | |
| https://security.gentoo.org/glsa/201702-07 | 2022-08-16 | |
| https://www.openssl.org/news/secadv/20170126.txt | 2022-08-16 | |
| https://access.redhat.com/security/cve/CVE-2017-3731 | 2018-07-12 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1416852 | 2018-07-12 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.1.0a Search vendor "Openssl" for product "Openssl" and version "1.1.0a" | - |
Affected
| ||||||
| Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.1.0b Search vendor "Openssl" for product "Openssl" and version "1.1.0b" | - |
Affected
| ||||||
| Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.1.0c Search vendor "Openssl" for product "Openssl" and version "1.1.0c" | - |
Affected
| ||||||
| Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.2 Search vendor "Openssl" for product "Openssl" and version "1.0.2" | - |
Affected
| ||||||
| Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.2 Search vendor "Openssl" for product "Openssl" and version "1.0.2" | beta1 |
Affected
| ||||||
| Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.2 Search vendor "Openssl" for product "Openssl" and version "1.0.2" | beta2 |
Affected
| ||||||
| Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.2 Search vendor "Openssl" for product "Openssl" and version "1.0.2" | beta3 |
Affected
| ||||||
| Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.2a Search vendor "Openssl" for product "Openssl" and version "1.0.2a" | - |
Affected
| ||||||
| Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.2b Search vendor "Openssl" for product "Openssl" and version "1.0.2b" | - |
Affected
| ||||||
| Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.2c Search vendor "Openssl" for product "Openssl" and version "1.0.2c" | - |
Affected
| ||||||
| Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.2d Search vendor "Openssl" for product "Openssl" and version "1.0.2d" | - |
Affected
| ||||||
| Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.2e Search vendor "Openssl" for product "Openssl" and version "1.0.2e" | - |
Affected
| ||||||
| Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.2f Search vendor "Openssl" for product "Openssl" and version "1.0.2f" | - |
Affected
| ||||||
| Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.2h Search vendor "Openssl" for product "Openssl" and version "1.0.2h" | - |
Affected
| ||||||
| Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.2i Search vendor "Openssl" for product "Openssl" and version "1.0.2i" | - |
Affected
| ||||||
| Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.2j Search vendor "Openssl" for product "Openssl" and version "1.0.2j" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | >= 4.0.0 <= 4.1.2 Search vendor "Nodejs" for product "Node.js" and version " >= 4.0.0 <= 4.1.2" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | >= 4.2.0 < 4.7.3 Search vendor "Nodejs" for product "Node.js" and version " >= 4.2.0 < 4.7.3" | lts |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | >= 5.0.0 <= 5.12.0 Search vendor "Nodejs" for product "Node.js" and version " >= 5.0.0 <= 5.12.0" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | >= 6.0.0 <= 6.8.1 Search vendor "Nodejs" for product "Node.js" and version " >= 6.0.0 <= 6.8.1" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | >= 6.9.0 < 6.9.5 Search vendor "Nodejs" for product "Node.js" and version " >= 6.9.0 < 6.9.5" | lts |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | >= 7.0.0 < 7.5.0 Search vendor "Nodejs" for product "Node.js" and version " >= 7.0.0 < 7.5.0" | - |
Affected
| ||||||