TLS V1.2 Sigalgs Remote Crash (CVE-2015-0291)

OpenSSL 1.0.2a fix several security issues, one of them let crash TLSv1.2 based services remotelly from internet.


Regarding to the TLSv1.2 RFC,  this version of TLS provides a "signature_algorithms" extension for the client_hello. 

Data Structures

If a bad signature is sent after the renegotiation, the structure will be corrupted, becouse structure pointer:
s->c->shared_sigalgs will be NULL, and the number of algorithms:
s->c->shared_sigalgslen will not be zeroed.
Which will be interpreted as one algorithm to process, but the pointer points to 0x00 address. 

Then tls1_process_sigalgs() will try to process one signature algorithm (becouse of shared_sigalgslen=1) then sigptr will be pointer to c->shared_sigalgs (NULL) and then will try to derreference sigptr->rhash. 

This mean a Segmentation Fault in  tls1_process_sigalgs() function, and called by tls1_set_server_sigalgs() with is called from ssl3_client_hello() as the stack trace shows.

StackTrace

The following code, points sigptr to null and try to read sigptr->rsign, which is assembled as movzbl eax,  byte ptr [0x0+R12] note in register window that R12 is 0x00

Debugger in the crash point.

radare2 static decompiled

The patch fix the vulnerability zeroing the sigalgslen.
Get  David A. Ramos' proof of concept exploit here





Related word

1. Hak5 Tools
2. Underground Hacker Sites
3. Hacker Tools Online
4. Hacker Tools List
5. Hacking Tools For Windows 7
6. Android Hack Tools Github
7. Hacking Tools For Windows 7
8. Hacker Tools Apk Download
9. Hacking Tools 2019
10. Hacker Tools For Windows
11. Pentest Tools For Ubuntu
12. Hacking Tools For Kali Linux
13. Pentest Tools Free
14. Hacking Tools Software
15. Bluetooth Hacking Tools Kali
16. Nsa Hack Tools Download
17. Usb Pentest Tools
18. Hacking Tools Mac
19. Hack Tools Github
20. Pentest Tools Linux
21. Hacking Tools Free Download
22. Hacker Tools Apk
23. New Hack Tools
24. Tools Used For Hacking
25. Hacking Tools Mac
26. Pentest Tools Bluekeep