Vulnerability Name:

CVE-2015-5291 (CCN-108114)

Assigned:2015-11-02
Published:2015-11-02
Updated:2019-06-19
Summary:Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long hostname to the server name indication (SNI) extension, which is not properly handled when creating a ClientHello message.
Note: this identifier has been SPLIT per ADT3 due to different affected version ranges. See CVE-2015-8036 for the session ticket issue that was introduced in 1.3.0.
CVSS v3 Severity:6.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
5.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
6.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-119
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2015-5291

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2015-e22bb33731

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2015-30

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2015-7f939b3af5

Source: SUSE
Type: Mailing List, Third Party Advisory
openSUSE-SU-2015:2257

Source: SUSE
Type: Mailing List, Third Party Advisory
openSUSE-SU-2015:2371

Source: DEBIAN
Type: Third Party Advisory
DSA-3468

Source: XF
Type: UNKNOWN
polarssl-cve20155291-bo(108114)

Source: MISC
Type: Third Party Advisory
https://guidovranken.files.wordpress.com/2015/10/cve-2015-5291.pdf

Source: MISC
Type: Third Party Advisory
https://guidovranken.wordpress.com/2015/10/07/cve-2015-5291/

Source: GENTOO
Type: Third Party Advisory
GLSA-201706-18

Source: CCN
Type: mbed TLS Security Advisory 2015-01
Remote attack on clients using session tickets or SNI

Source: CONFIRM
Type: Vendor Advisory
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2015-01

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2015-5291

Vulnerable Configuration:Configuration 1:
  • cpe:/a:arm:mbed_tls:*:*:*:*:*:*:*:* (Version >= 1.3.0 and < 1.3.14)
  • OR cpe:/a:arm:mbed_tls:*:*:*:*:*:*:*:* (Version >= 2.0.0 and < 2.1.2)
  • OR cpe:/a:polarssl:polarssl:*:*:*:*:*:*:*:* (Version >= 1.0.0 and < 1.2.17)

    • Configuration 2:
  • cpe:/o:debian:debian_linux:7.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:8.0:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:fedoraproject:fedora:21:*:*:*:*:*:*:*
  • OR cpe:/o:fedoraproject:fedora:22:*:*:*:*:*:*:*
  • OR cpe:/o:fedoraproject:fedora:23:*:*:*:*:*:*:*
  • OR cpe:/o:opensuse:leap:42.1:*:*:*:*:*:*:*
  • OR cpe:/o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:arm:mbed_tls:2.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:arm:mbed_tls:1.3.13:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20155291
    V
    		CVE-2015-5291
    2022-06-30
    oval:org.opensuse.security:def:112687
    P
    		libmbedcrypto0-2.4.0-1.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:106164
    P
    		libmbedcrypto0-2.4.0-1.2 on GA media (Moderate)
    2021-10-01
    oval:com.ubuntu.cosmic:def:201552910000000
    V
    		CVE-2015-5291 on Ubuntu 18.10 (cosmic) - medium.
    2015-11-02
    oval:com.ubuntu.artful:def:20155291000
    V
    		CVE-2015-5291 on Ubuntu 17.10 (artful) - medium.
    2015-11-02
    oval:com.ubuntu.trusty:def:20155291000
    V
    		CVE-2015-5291 on Ubuntu 14.04 LTS (trusty) - medium.
    2015-11-02
    oval:com.ubuntu.bionic:def:201552910000000
    V
    		CVE-2015-5291 on Ubuntu 18.04 LTS (bionic) - medium.
    2015-11-02
    oval:com.ubuntu.bionic:def:20155291000
    V
    		CVE-2015-5291 on Ubuntu 18.04 LTS (bionic) - medium.
    2015-11-02
    oval:com.ubuntu.xenial:def:20155291000
    V
    		CVE-2015-5291 on Ubuntu 16.04 LTS (xenial) - medium.
    2015-11-02
    oval:com.ubuntu.xenial:def:201552910000000
    V
    		CVE-2015-5291 on Ubuntu 16.04 LTS (xenial) - medium.
    2015-11-02
    oval:com.ubuntu.cosmic:def:20155291000
    V
    		CVE-2015-5291 on Ubuntu 18.10 (cosmic) - medium.
    2015-11-02
    oval:com.ubuntu.disco:def:201552910000000
    V
    		CVE-2015-5291 on Ubuntu 19.04 (disco) - medium.
    2015-11-02
    oval:com.ubuntu.precise:def:20155291000
    V
    		CVE-2015-5291 on Ubuntu 12.04 LTS (precise) - medium.
    2015-11-02
    BACK
    arm mbed tls *
    arm mbed tls *
    polarssl polarssl *
    debian debian linux 7.0
    debian debian linux 8.0
    fedoraproject fedora 21
    fedoraproject fedora 22
    fedoraproject fedora 23
    opensuse leap 42.1
    opensuse opensuse 13.2
    arm mbed tls 2.1.1
    arm mbed tls 1.3.13