An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. This can be exploited by a Man-in-the-middle (MITM) attack where the attacker can decrypt and modify traffic from the attacked client and server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2014-0224 to this issue.
By sending an invalid DTLS handshake to an OpenSSL DTLS client the code can be made to recurse eventually crashing in a DoS attack. Only applications using OpenSSL as a DTLS client are affected. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2014-0221 to this issue.
A buffer overrun attack can be triggered by sending invalid DTLS fragments to an OpenSSL DTLS client or server. This is potentially exploitable to run arbitrary code on a vulnerable client or server. Only applications using OpenSSL as a DTLS client are affected. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2014-0195 to this issue.
A flaw in the do_ssl3_write function can allow remote attackers to cause a denial of service via a NULL pointer dereference. This flaw only affects OpenSSL 1.0.0 and 1.0.1 where SSL_MODE_RELEASE_BUFFERS is enabled, which is not the default and not common. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2014-0198 to this issue.
A race condition in the ssl3_read_bytes function can allow remote attackers to inject data across sessions or cause a denial of service. This flaw only affects multithreaded applications using OpenSSL 1.0.0 and 1.0.1, where SSL_MODE_RELEASE_BUFFERS is enabled, which is not the default and not common. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-5298 to this issue.
OpenSSL TLS clients enabling anonymous ECDH ciphersuites are subject to a denial of service attack. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2014-3470 to this issue.
Recovering OpenSSL ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2014-0076 to this issue.
More information about these vulnerabilities can be found in the security advisory issued by:
| Product: | Affected Version(s): | Risk Level: | Actions: |
|---|---|---|---|
| Avaya Session Border Controller for Enterprise | 6.2.x | Medium | Upgrade to 6.3 or later. |
Recommended Actions for System Products:
Avaya strongly
recommends following networking and security best practices by implementing
firewalls, ACLs, physical security or other appropriate access restrictions.
Though Avaya believes such restrictions should always be in place, risk to
Avaya products and the surrounding network from this potential vulnerability
may be mitigated by ensuring these practices are implemented until such time
as an Avaya provided product update or the recommended Avaya action is applied.
Further restrictions as deemed necessary based on the customer's security
policies may be required during this interim period, but the System Product
operating system or application should not be modified unless the change is
approved by Avaya. Making changes that are not approved may void the Avaya
product service contract.
When determining risk, Avaya takes into account many factors as outlined by Avaya's Security Vulnerability Classification Policy. The following table describes factors that mitigate the risk of specific vulnerabilities for affected Avaya products:
| Vulnerability | Mitigating Factors |
|---|---|
|
CVE-2010-5298 CVE-2014-0198 |
There is no risk as SSL_MODE_RELEASE_BUFFERS is not enabled in the ASBCE. |
|
CVE-2014-0195 CVE-2014-0221 |
There is no risk as DTLS is not used in the ASBCE. |
|
CVE-2014-0076 CVE-2014-0224 CVE-2014-3470 |
These are a Medium risk due to the potential exposure of sensitive information or connection termination (Denial of Service). |
Additional information may also be available via the Avaya support website and through your Avaya account representative. Please contact your Avaya product support representative, or dial 1-800-242-2121, with any questions.
ALL INFORMATION IS BELIEVED TO BE CORRECT AT THE TIME OF PUBLICATION AND IS PROVIDED "AS IS". AVAYA INC., ON BEHALF ITSELF AND ITS SUBSIDIARIES AND AFFILIATES (HEREINAFTER COLLECTIVELY REFERRED TO AS "AVAYA"), DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE AND FURTHERMORE, AVAYA MAKES NO REPRESENTATIONS OR WARRANTIES THAT THE STEPS RECOMMENDED WILL ELIMINATE SECURITY OR VIRUS THREATS TO CUSTOMERS' SYSTEMS. IN NO EVENT SHALL AVAYA BE LIABLE FOR ANY DAMAGES WHATSOEVER ARISING OUT OF OR IN CONNECTION WITH THE INFORMATION OR RECOMMENDED ACTIONS PROVIDED HEREIN, INCLUDING DIRECT, INDIRECT, INCIDENTAL, STATUTORY, CONSEQUENTIAL DAMAGES, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF AVAYA HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
THE INFORMATION PROVIDED HERE DOES NOT AFFECT THE SUPPORT AGREEMENTS IN PLACE FOR AVAYA PRODUCTS. SUPPORT FOR AVAYA PRODUCTS CONTINUES TO BE EXECUTED AS PER EXISTING AGREEMENTS WITH AVAYA.
V 1.0 - June 20, 2014 - Initial Statement issued.
V 2.0 - June 8, 2016 - Updated SBCE actions and set advisory status to Final.
Avaya customers or Business Partners should report any security issues found with Avaya products via the standard support process.
Independent security researchers can contact Avaya at
[email protected].
© 2014 Avaya Inc. All Rights Reserved. All trademarks identifying Avaya products by the ® or ™ are registered trademarks or trademarks, respectively, of Avaya Inc. All other trademarks are the property of their respective owners.