Vulnerability Name:

CVE-2017-3737

Assigned:2016-12-16
Published:2017-12-07
Updated:2018-07-13
Summary:OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it does not work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is subsequently called by the application for the same SSL object then it will succeed and the data is passed without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued after having already received a fatal error. OpenSSL version 1.0.2b-1.0.2m are affected. Fixed in OpenSSL 1.0.2n. OpenSSL 1.1.0 is not affected.
CVSS v3 Severity:5.9 Medium (CVSS v3 Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
5.2 Medium (Temporal CVSS v3 Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
5.3 Medium (CCN CVSS v3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
4.6 Medium (CCN Temporal CVSS v3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
5.9 Medium (REDHAT CVSS v3 Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
5.2 Medium (REDHAT Temporal CVSS v3 Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-388
References:Source: CONFIRM
Type: UNKNOWN
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Source: CONFIRM
Type: UNKNOWN
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Source: BID
Type: VENDOR_ADVISORY
102103

Source: SECTRACK
Type: VENDOR_ADVISORY
1039978

Source: REDHAT
Type: UNKNOWN
RHSA-2018:0998

Source: REDHAT
Type: UNKNOWN
RHSA-2018:2185

Source: REDHAT
Type: UNKNOWN
RHSA-2018:2186

Source: REDHAT
Type: UNKNOWN
RHSA-2018:2187

Source: XF
Type: UNKNOWN
openssl-cve20173737-sec-bypass(136077)

Source: CONFIRM
Type: UNKNOWN
https://github.com/openssl/openssl/commit/898fb884b706aaeb283de4812340bb0bde8476dc

Source: FREEBSD
Type: VENDOR_ADVISORY
FreeBSD-SA-17:12

Source: GENTOO
Type: VENDOR_ADVISORY
GLSA-201712-03

Source: CONFIRM
Type: VENDOR_ADVISORY
https://security.netapp.com/advisory/ntap-20171208-0001/

Source: CONFIRM
Type: UNKNOWN
https://security.netapp.com/advisory/ntap-20180117-0002/

Source: CONFIRM
Type: UNKNOWN
https://security.netapp.com/advisory/ntap-20180419-0002/

Source: DEBIAN
Type: VENDOR_ADVISORY
DSA-4065

Source: MISC
Type: VENDOR_ADVISORY
https://www.digitalmunition.me/2017/12/cve-2017-3737-openssl-security-bypass-vulnerability/

Source: CONFIRM
Type: VENDOR_ADVISORY
https://www.openssl.org/news/secadv/20171207.txt

Source: CONFIRM
Type: UNKNOWN
https://www.tenable.com/security/tns-2017-16

Vulnerable Configuration:Configuration 1:
  • cpe:/a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:1.0.2g:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:1.0.2h:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:1.0.2i:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:1.0.2j:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:1.0.2k:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:1.0.2l:*:*:*:*:*:*:*
  • OR cpe:/a:openssl:openssl:1.0.2m:*:*:*:*:*:*:*

  • Configuration 2:
  • cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*

  • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:7:*:*:*:*:*:*:*

  • Configuration CCN 1:
  • cpe:/a:openssl:openssl:1.0.2:*:*:*:*:*:*:*
  • AND
  • cpe:/h:ibm:flex_system_manager_node_7955:-:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:systems_director:5.20:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_protect_for_virtual_environments:7.1::~~~vmware~~:*:*:*:*:*
  • OR cpe:/a:ibm:api_connect:5.0.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:api_connect:5.0.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:api_connect:5.0.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:api_connect:5.0.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:api_connect:5.0.5.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:api_connect:5.0.6.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:api_connect:5.0.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:api_connect:5.0.6.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:api_connect:5.0.7.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:api_connect:5.0.7.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:api_connect:5.0.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:api_connect:5.0.4.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:api_connect:5.0.7.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:api_connect:5.0.6.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:api_connect:5.0.6.4:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:api_connect:5.0.8.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:api_connect:5.0.8.1:*:*:*:*:*:*:*

  • Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20173737
    V
    CVE-2017-3737
    2018-07-14
    oval:com.redhat.rhsa:def:20180998
    P
    RHSA-2018:0998: openssl security and bug fix update (Moderate)
    2018-04-10
    oval:com.ubuntu.xenial:def:20173737000
    V
    CVE-2017-3737 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-12-07
    oval:com.ubuntu.trusty:def:20173737000
    V
    CVE-2017-3737 on Ubuntu 14.04 LTS (trusty) - medium.
    2017-12-07
    oval:com.ubuntu.artful:def:20173737000
    V
    CVE-2017-3737 on Ubuntu 17.10 (artful) - medium.
    2017-12-07
    BACK
    openssl openssl 1.0.2b
    openssl openssl 1.0.2c
    openssl openssl 1.0.2d
    openssl openssl 1.0.2e
    openssl openssl 1.0.2f
    openssl openssl 1.0.2g
    openssl openssl 1.0.2h
    openssl openssl 1.0.2i
    openssl openssl 1.0.2j
    openssl openssl 1.0.2k
    openssl openssl 1.0.2l
    openssl openssl 1.0.2m
    debian debian linux 9.0
    openssl openssl 1.0.2
    ibm flex system manager node 7955 -
    ibm systems director 5.20
    ibm spectrum protect for virtual environments 7.1
    ibm api connect 5.0.1.0
    ibm api connect 5.0.0.0
    ibm api connect 5.0.0.1
    ibm api connect 5.0.2.0
    ibm api connect 5.0.5.0
    ibm api connect 5.0.6.0
    ibm api connect 5.0.6.1
    ibm api connect 5.0.6.2
    ibm api connect 5.0.7.0
    ibm api connect 5.0.7.1
    ibm api connect 5.0.3.0
    ibm api connect 5.0.4.0
    ibm api connect 5.0.7.2
    ibm api connect 5.0.6.3
    ibm api connect 5.0.6.4
    ibm api connect 5.0.8.0
    ibm api connect 5.0.8.1