TLS V1.2 Sigalgs Remote Crash (CVE-2015-0291)
OpenSSL 1.0.2a fix several security issues, one of them let crash TLSv1.2 based services remotelly from internet.
Regarding to the TLSv1.2 RFC, this version of TLS provides a "signature_algorithms" extension for the client_hello.
Regarding to the TLSv1.2 RFC, this version of TLS provides a "signature_algorithms" extension for the client_hello.
Data Structures |
If a bad signature is sent after the renegotiation, the structure will be corrupted, becouse structure pointer:
s->c->shared_sigalgs will be NULL, and the number of algorithms:
s->c->shared_sigalgslen will not be zeroed.
Which will be interpreted as one algorithm to process, but the pointer points to 0x00 address.
s->c->shared_sigalgs will be NULL, and the number of algorithms:
s->c->shared_sigalgslen will not be zeroed.
Which will be interpreted as one algorithm to process, but the pointer points to 0x00 address.
Then tls1_process_sigalgs() will try to process one signature algorithm (becouse of shared_sigalgslen=1) then sigptr will be pointer to c->shared_sigalgs (NULL) and then will try to derreference sigptr->rhash.
This mean a Segmentation Fault in tls1_process_sigalgs() function, and called by tls1_set_server_sigalgs() with is called from ssl3_client_hello() as the stack trace shows.
StackTrace |
The following code, points sigptr to null and try to read sigptr->rsign, which is assembled as movzbl eax, byte ptr [0x0+R12] note in register window that R12 is 0x00
Debugger in the crash point. |
radare2 static decompiled |
Get David A. Ramos' proof of concept exploit here
More articles
- Black Hat Hacker Tools
- Hack Tools
- Hacker Tools Free
- Growth Hacker Tools
- Best Hacking Tools 2019
- Hacking Tools Name
- Underground Hacker Sites
- Hacking Tools Pc
- Best Pentesting Tools 2018
- Tools 4 Hack
- Computer Hacker
- Hacking Tools Kit
- Hack Tools
- Hacker Tools For Ios
- Termux Hacking Tools 2019
- Best Hacking Tools 2020
- Hacker Tools 2019
- Easy Hack Tools
- Hacker Hardware Tools
- Hacking Tools Online
- Pentest Tools Subdomain
- Pentest Tools Bluekeep
- Hacker Tools Free Download
- Pentest Tools Nmap
- Hacker
- Hacking Tools Kit
- World No 1 Hacker Software
- Hacker Tools Free
- Pentest Tools Review
- Hacks And Tools
- Hacking Tools For Kali Linux
- Hacking Tools Windows
- Pentest Tools Review
- Install Pentest Tools Ubuntu
- Hacking Tools For Games
- Hacking Tools For Windows 7
- Pentest Tools Port Scanner
- Tools For Hacker
- Easy Hack Tools
- Hacker Tools Free
- Hacker Tools Windows
- Computer Hacker
- Pentest Tools Windows
- What Is Hacking Tools
- Hacking Tools
- Hack Tools For Windows
- Bluetooth Hacking Tools Kali
- Wifi Hacker Tools For Windows
- Hacks And Tools
- Hacking Tools Github
- Hacking Tools For Pc
- Pentest Tools Website Vulnerability
- Hack Tool Apk No Root
- Pentest Recon Tools
- Tools 4 Hack
- Game Hacking
- Hacking Tools Pc
- Pentest Tools Website
- Hacking Tools Usb
- Hacking Tools Hardware
- Pentest Tools Bluekeep
- Pentest Tools For Mac
- How To Install Pentest Tools In Ubuntu
- Hack Tools For Mac
- Easy Hack Tools
- Black Hat Hacker Tools
- Hacking Tools Name
- Pentest Tools
- Hacker Tools List
- Hacker Hardware Tools
- Hacker Tools Hardware
- Pentest Tools Nmap
- Pentest Tools For Windows
- Hacker Tools Free Download
- Hacking Tools Pc
- Free Pentest Tools For Windows
- Pentest Tools Tcp Port Scanner
- Hack Tools Pc
- Hacking Tools Usb
- Pentest Tools Apk
- Hacking Tools Online
- Pentest Recon Tools
- Hackers Toolbox
- Hacking Tools For Pc
- Hacking Tools Kit
- Nsa Hacker Tools
- Hacking App
- Hacking Tools For Pc
- Hacking Tools Free Download
- What Is Hacking Tools
- Hack Tools For Games
- Pentest Tools Url Fuzzer
- New Hack Tools
- Bluetooth Hacking Tools Kali
- Hack App
- Hack Tools Mac
- Hacking Tools And Software
- World No 1 Hacker Software
- Hacker Tools Windows
- Hack App
- Pentest Tools Tcp Port Scanner
- Hackrf Tools
- Easy Hack Tools
- Hacker Tools 2020
- Hacker Security Tools
- Underground Hacker Sites
- Blackhat Hacker Tools
- Hacking Apps
- Pentest Tools Free
- Pentest Tools List
- Pentest Tools Nmap
- Hacker Security Tools
- Hack Tools
- Github Hacking Tools
- Hack Tools For Mac
- Hackrf Tools
- Hacking Tools Usb
- How To Install Pentest Tools In Ubuntu
- Hacking Tools Windows 10
- Hacker Tools Apk
- Hak5 Tools
- Hacking Tools Online
- Nsa Hack Tools
- Usb Pentest Tools
- Hacker Tools Free Download
- Pentest Tools Nmap
- Nsa Hacker Tools
- What Is Hacking Tools
- Hacking Tools For Windows Free Download
- How To Hack
- Hacking Apps
- Pentest Reporting Tools
- What Are Hacking Tools
- Hack Tools 2019
- Hacking Tools Windows
- Pentest Tools For Mac
- Hackrf Tools
- Hacking Tools Github
- Hack Tools
- Hacking Tools For Kali Linux
- Pentest Tools Windows
- Hacking Tools Hardware
- Nsa Hack Tools Download
- Hack Tools For Ubuntu
- Hack App
- Hak5 Tools
- Hacking Tools 2019
- Pentest Tools Nmap
- Hacking Tools For Mac
- Hack Tools For Pc
- Pentest Tools Bluekeep
- What Are Hacking Tools
- Hacking Apps
- Hacker Tools List
- Pentest Tools
- Hacking Tools Download
- Top Pentest Tools
- Hack Tools Download
- Pentest Tools For Windows
- Pentest Tools Apk
- Hacking Tools For Games
- Hacking Tools Software
- How To Install Pentest Tools In Ubuntu
0 Comments:
コメントを投稿
<< Home