TLS V1.2 Sigalgs Remote Crash (CVE-2015-0291)

OpenSSL 1.0.2a fix several security issues, one of them let crash TLSv1.2 based services remotelly from internet.


Regarding to the TLSv1.2 RFC,  this version of TLS provides a "signature_algorithms" extension for the client_hello. 

Data Structures

If a bad signature is sent after the renegotiation, the structure will be corrupted, becouse structure pointer:
s->c->shared_sigalgs will be NULL, and the number of algorithms:
s->c->shared_sigalgslen will not be zeroed.
Which will be interpreted as one algorithm to process, but the pointer points to 0x00 address. 

Then tls1_process_sigalgs() will try to process one signature algorithm (becouse of shared_sigalgslen=1) then sigptr will be pointer to c->shared_sigalgs (NULL) and then will try to derreference sigptr->rhash. 

This mean a Segmentation Fault in  tls1_process_sigalgs() function, and called by tls1_set_server_sigalgs() with is called from ssl3_client_hello() as the stack trace shows.

StackTrace

The following code, points sigptr to null and try to read sigptr->rsign, which is assembled as movzbl eax,  byte ptr [0x0+R12] note in register window that R12 is 0x00

Debugger in the crash point.

radare2 static decompiled

The patch fix the vulnerability zeroing the sigalgslen.
Get  David A. Ramos' proof of concept exploit here

More information

1. Hack Tools For Games
2. Hack Website Online Tool
3. Pentest Tools Android
4. New Hacker Tools
5. Hacker Security Tools
6. Free Pentest Tools For Windows
7. Hacking Tools Online
8. Hacker Tools Software
9. Hacking Tools Github
10. Hacking Tools For Kali Linux
11. Hack Tools 2019
12. Tools For Hacker
13. Pentest Tools Nmap
14. Hacks And Tools
15. Hacker Tools Apk
16. Pentest Tools Github
17. Ethical Hacker Tools
18. Top Pentest Tools
19. What Are Hacking Tools
20. What Is Hacking Tools
21. Hacker Tools
22. Pentest Tools Github
23. Hacking Tools For Mac
24. Hack Tools
25. Hacker Search Tools
26. Hacker Tools Free
27. Hacker Tools
28. Best Hacking Tools 2019
29. Usb Pentest Tools
30. Pentest Tools Kali Linux
31. Pentest Tools For Ubuntu
32. Hack Tool Apk No Root
33. Hacking Tools For Beginners
34. Pentest Tools Port Scanner
35. Hack Tools Github
36. Hacker Tools Github
37. Hacker Security Tools
38. Github Hacking Tools
39. Hack Tools For Pc
40. Hack Tools For Windows
41. Pentest Tools For Android
42. Hacking Tools 2020
43. Hacking Tools Windows
44. Hacking Tools Download
45. Hack Tool Apk No Root
46. Hacking Tools 2020
47. Hacking Tools 2020
48. Best Hacking Tools 2020
49. Hacking Tools Download
50. Hack Tools Online
51. Hacking Tools Online
52. Pentest Tools Free
53. Hack Tools For Pc
54. Pentest Tools Framework
55. Best Hacking Tools 2020
56. Hack Tools For Windows
57. Hack Tools For Windows
58. Hack Tools
59. Hacking Tools For Beginners
60. Hacking Tools Windows
61. Computer Hacker
62. Nsa Hack Tools
63. Pentest Tools Apk
64. Hacking Tools Mac
65. Pentest Tools
66. Hacker Tools Apk Download
67. Hacker Tools Software
68. Hacking Tools Windows 10
69. Hacking Tools For Kali Linux
70. Hacking Tools For Windows 7
71. Underground Hacker Sites
72. Pentest Tools Windows
73. Hacking Apps
74. Hack Tools For Games
75. Hack Tools Download
76. Pentest Tools For Android
77. Pentest Tools Review
78. What Is Hacking Tools
79. Hacking Tools For Windows 7
80. Nsa Hack Tools
81. Hacking Tools Online
82. Hacker
83. Hacking Tools Pc
84. Best Pentesting Tools 2018
85. Hacking Tools
86. Hak5 Tools
87. Hacker Tools Free
88. Hack Tools Github
89. Hackers Toolbox
90. Hacking Tools For Games
91. Hack Tools For Ubuntu