OpenSSL "zlib" Compression Memory leakage Remote Denial of Service Vulnerability

Release date:
Updated on:

Affected Systems:
MandrakeSoft Linux Mandrake 2008.0-2010.0 x86_64
Slackware Linux-current-13.0 x86_64
Ubuntu Linux 6.06 LTS amd64-9.10
VMWare ESXi Server 4.0
Blue Coat Systems Blue Coat Reporter
Unaffected system:
Blue Coat Systems Blue Coat Reporter 9.2.4.1
Description:
--------------------------------------------------------------------------------
Bugtraq id: 31692
Cve id: CVE-2008-1678, CVE-2009-4355

OpenSSL is an open-source SSL implementation that implements high-strength encryption for network communication. It is widely used in various network applications.

OpenSSL has a remote denial-of-service vulnerability. Remote attackers can exploit this vulnerability to cause application crash using this library by consuming available memory, and deny service to legitimate users.

This vulnerability is caused by serious memory leakage in the httpd php module. When this module is enabled, after apache receives the "graceful" (USR1) signal, each SSLv3 request exposes a large amount of memory (several hundred KB ).

<* Source: Joe Orton
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Void Curl_ossl_cleanup (void)
{
/* Free the SSL error strings */
ERR_free_strings ();

/* EVP_cleanup () removes all ciphers and digests from
Table .*/
EVP_cleanup ();

# Ifdef HAVE_ENGINE_cleanup
ENGINE_cleanup ();
# Endif

# Ifdef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA
/* This function was not present in 0.9.6b, but was added sometimes
Later */
CRYPTO_cleanup_all_ex_data ();
# Endif
}

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

MandrakeSoft
------------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.linux-mandrake.com/en/security/

Ubuntu
------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.ubuntulinux.org/