Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against OpenSSL SSL_get_shared_ciphers Function Buffer Overflow Vulnerability

Subscribe

Check Point Reference: CPAI-2008-014
Date Published:
Severity:
Source: FrSIRT/ADV-2007-3325
Industry Reference(s): CVE-2006-3738
CVE-2007-5135
Protection Provided by: VPN-1
  • NGX R65
  • NGX R62
  • NGX R61
  • NGX R60
  • NG with Application Intelligence R55
VSX
  • NGX
InterSpect
  • NGX
Connectra
  • NGX R62
  • NGX R61
Who is Vulnerable?
OpenSSL Project OpenSSL 0.9.7m and prior
OpenSSL Project OpenSSL 0.9.8e and prior
Vulnerability Description
A buffer overflow vulnerability has been reported in the OpenSSL library. OpenSSL is an open-source implementation of the SSL protocol. The OpenSSL core library provides various utility functions. Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code on a target system.
Vulnerability Details
The vulnerability is due to an error in the OpenSSL SSL_get_shared_ciphers function that fails to properly handle specially crafted lists of ciphers. A remote attacker can exploit this issue by specially crafting a list of ciphers and sending it an affected server. Successful exploitation may allow execution of arbitrary code on the target host.

Protection Overview
By enabling this protection, SmartDefense will detect and block any crafted list of ciphers sent to the affected server.

In order for the protection to be activated, update your VPN-1/InterSpect/Connectra product to the latest SmartDefense update. For information on how to update SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.

To configure the defense, select your product from the list below and follow the related protection steps.

VPN-1 NGX R65 & R62

How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > VPN Protocols > OpenSSL > Block Malformed Ciphers List.
2. In the configuration pane, under Settings > Mode, check Active.
3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: OpenSSL Enforcement Violation
Attack Information: Malformed ciphers list detected

VPN-1 NGX R61 & R60

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > VPN Protocols > OpenSSL.
2. Select the following:

Block Malformed Ciphers List

3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: OpenSSL Enforcement Violation
Attack Information: Malformed ciphers list detected

VPN-1 NG with Application Intelligence R55

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > VPN Protocols > OpenSSL.
2. Select the following:

Block Malformed Ciphers List

3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
Rule #99946 will appear on the SmartView Tracker.

VPN-1 VSX NGX

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > VPN Protocols > OpenSSL.
2. Select the following:

Block Malformed Ciphers List

3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
Rule #99946 will appear on the SmartView Tracker.

InterSpect NGX

How Can I Protect My Network?
1. In the left pane, select Profiles > Default Protection and select the SmartDefense page of the profile.
2. In the SmartDefense tree, click Application Intelligence > VPN Protocols > OpenSSL.
3. Select the following protection:

Block Malformed Ciphers List

4. Install security policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: OpenSSL Enforcement Violation
Attack Information: Malformed ciphers list detected

Connectra NGX R62 & R61

How Can I Protect My Network?
1. In the left-hand menu, click Security > SmartDefense > Application Intelligence.
2. In the Dynamic Attacks pane, select the following protection:

Block Malformed Ciphers List

3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
Upon attack, the following entries will be logged:

Attack Name: OpenSSL Enforcement Violation
Attack Information: Malformed ciphers list detected