OpenSSL encryption protection Security Restriction Bypass Vulnerability

OpenSSL encryption protection Security Restriction Bypass Vulnerability

Release date:
Updated on:

Affected Systems:
OpenSSL Project OpenSSL <0.9.8zd
OpenSSL Project OpenSSL 1.0.1-1.0.1k
OpenSSL Project OpenSSL 1.0.0-1.0.0p
Description:
Bugtraq id: 71939
CVE (CAN) ID: CVE-2014-3570

OpenSSL is an open-source SSL implementation that implements high-strength encryption for network communication. It is widely used in various network applications.

In OpenSSL versions earlier than 0.9.8zd and 1.0.0-1.0.0p and 1.0.1-1.0.1k, BN_sqr miscalculates the square of the BIGNUM value. Remote attackers use crypto/bn/asm/mips. pl, crypto/bn/asm/x86_64-gcc.c, crypto/bn/bn_asm.c, exploit this vulnerability to bypass encryption protection mechanisms.

<* Source: Pieter Wuille
*>

Suggestion:
Vendor patch:

OpenSSL Project
---------------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Https://www.openssl.org/news/secadv_20150108.txt

Provides FTP + SSL/TLS authentication through OpenSSL and implements secure data transmission.

Use OpenSSL to sign multi-domain certificates

OpenSSL details: click here
OpenSSL: click here

This article permanently updates the link address: