TLS V1.2 Sigalgs Remote Crash (CVE-2015-0291)

OpenSSL 1.0.2a fix several security issues, one of them let crash TLSv1.2 based services remotelly from internet.


Regarding to the TLSv1.2 RFC,  this version of TLS provides a "signature_algorithms" extension for the client_hello. 

Data Structures

If a bad signature is sent after the renegotiation, the structure will be corrupted, becouse structure pointer:
s->c->shared_sigalgs will be NULL, and the number of algorithms:
s->c->shared_sigalgslen will not be zeroed.
Which will be interpreted as one algorithm to process, but the pointer points to 0x00 address. 

Then tls1_process_sigalgs() will try to process one signature algorithm (becouse of shared_sigalgslen=1) then sigptr will be pointer to c->shared_sigalgs (NULL) and then will try to derreference sigptr->rhash. 

This mean a Segmentation Fault in  tls1_process_sigalgs() function, and called by tls1_set_server_sigalgs() with is called from ssl3_client_hello() as the stack trace shows.

StackTrace

The following code, points sigptr to null and try to read sigptr->rsign, which is assembled as movzbl eax,  byte ptr [0x0+R12] note in register window that R12 is 0x00

Debugger in the crash point.

radare2 static decompiled

The patch fix the vulnerability zeroing the sigalgslen.
Get  David A. Ramos' proof of concept exploit here





Continue reading

1. Hacking Tools And Software
2. Top Pentest Tools
3. Hacker Tools Mac
4. Nsa Hack Tools
5. What Is Hacking Tools
6. Hack Rom Tools
7. Hacker Tools 2019
8. Hackers Toolbox
9. Pentest Tools Port Scanner
10. Hack Tool Apk No Root
11. Physical Pentest Tools
12. Hack Tools Pc
13. Hack Tools Online
14. Nsa Hack Tools
15. Hack Apps
16. Hacker Tools Software
17. Hack Apps
18. Pentest Tools Bluekeep
19. Blackhat Hacker Tools
20. Pentest Tools For Android
21. Pentest Tools Github
22. New Hack Tools
23. Pentest Tools For Android
24. Termux Hacking Tools 2019
25. New Hack Tools
26. Hacker Tools 2020
27. Hacker
28. Usb Pentest Tools
29. Hacker
30. Wifi Hacker Tools For Windows
31. Hacking Tools Windows
32. Hack Tools For Ubuntu
33. Best Pentesting Tools 2018
34. Pentest Tools Alternative
35. Pentest Tools For Ubuntu
36. Hack Tool Apk No Root
37. Hackrf Tools
38. Hack Tools Online
39. Black Hat Hacker Tools
40. Hacking Tools For Games
41. Hacking Tools Free Download
42. Hacking Tools For Pc
43. Hacker Tools Free
44. Hacking Apps
45. Kik Hack Tools
46. Underground Hacker Sites
47. Hack Tool Apk
48. Hack Tools For Pc
49. Hacker Tools For Ios
50. Free Pentest Tools For Windows
51. Hacker Tools Github
52. Pentest Tools Review
53. Hacking Tools Mac
54. Hack Tools For Ubuntu
55. What Are Hacking Tools
56. Hacker Tool Kit
57. Hacking Tools Mac
58. Game Hacking
59. Hacking Tools For Kali Linux
60. Hackrf Tools
61. Hacker Tools Free
62. Pentest Tools For Ubuntu
63. Pentest Recon Tools
64. Pentest Tools For Android
65. Hack Tools Pc
66. Tools For Hacker
67. Pentest Tools Website Vulnerability
68. Termux Hacking Tools 2019
69. Pentest Tools Apk
70. Tools Used For Hacking
71. Pentest Tools Bluekeep
72. Hack Rom Tools
73. Hack Tools Mac
74. Install Pentest Tools Ubuntu