2018-04 Security Bulletin: OpenSSL Security Advisory [07 Dec 2017]

Product Affected

This issue affects many products and platforms, including Junos OS, NorthStar, NSM, CTPView, and CTPOS

Severity

Medium

Severity Assessment (CVSS) Score

6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Problem

The OpenSSL project has published a security advisory for vulnerabilities resolved in the OpenSSL library on December 7, 2017. The following is a summary of these vulnerabilities and their status with respect to Juniper products:

CVE	CVSS	Summary
CVE-2017-3735	5.3 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N )	While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.
CVE-2017-3736	6.5 ( CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N )	There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen.
CVE-2017-3737	5.9 ( CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N )	OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it does not work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is subsequently called by the application for the same SSL object then it will succeed and the data is passed without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued after having already received a fatal error. OpenSSL version 1.0.2b-1.0.2m are affected. Fixed in OpenSSL 1.0.2n. OpenSSL 1.1.0 is not affected.
CVE-2017-3738	5.9 ( CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N )	There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation). Note: The impact from this issue is similar to CVE-2017-3736, CVE-2017-3732 and CVE-2015-3193. OpenSSL version 1.0.2-1.0.2m and 1.1.0-1.1.0g are affected. Fixed in OpenSSL 1.0.2n. Due to the low severity of this issue we are not issuing a new release of OpenSSL 1.1.0 at this time. The fix will be included in OpenSSL 1.1.0h when it becomes available. The fix is also available in commit e502cc86d in the OpenSSL git repository.

Solution

Junos:

The following software releases have been updated to resolve this specific issue: 12.3X48-D70, 14.1R9, 14.1X53-D130, 14.1X53-D47, 15.1R6-S6, 15.1R7, 15.1X49-D130, 15.1X53-D233, 15.1X53-D471, 15.1X53-D59, 15.1X53-D67, 16.1R3-S8, 16.1R5-S4, 16.1R6-S3, 16.2R1-S6, 16.2R2-S5, 17.1R2-S6, 17.2R2-S3, 17.3R3*, 17.4R2*, 18.1R1, and all subsequent releases.

*Late availability

NorthStar:

The following software releases have been updated to resolve this specific issue: NorthStar 3.0.2, 3.1.1, 3.2.1, and all subsequent releases.

NSM:

The following software releases have been updated to resolve this specific issue: 2012.2R14, and all subsequent releases.

CTPView:

The following software releases have been updated to resolve this specific issue: 7.3R4, 7.4R2, and all subsequent releases.

CTPOS:

The following software releases have been updated to resolve this specific issue: 7.3R4, 7.4R1, and all subsequent releases.

This advisory will be updated as additional products are analyzed and fixes become available.

These issues are being tracked as PR 1328891, 1328901, 1328898, 1328896, 1328895 and 1250405 which are visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

Software Releases, patches and updates are available at https://www.juniper.net/support/downloads/ .

Workaround

Junos : Since SSL is used for remote network configuration and management applications such as J-Web and SSL Service for JUNOScript (XNM-SSL), viable workarounds for this issue in Junos may include:

Disabling J-Web
Disable SSL service for JUNOScript and only use Netconf, which makes use of SSH, to make configuration changes
Limit access to J-Web and XNM-SSL from only trusted networks

Others : Limit the exploitable attack surface of critical infrastructure networking equipment. Use access lists or firewall filters to limit access to the device via SSL only from trusted, administrative networks or hosts.

Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net] "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Modification History