[R12] OpenSSL '20160301' Advisory Affects Tenable Products

Nessus is potentially impacted by several vulnerabilities in OpenSSL that were recently disclosed and fixed. Note that due to the time involved in doing a full analysis of each issue, Tenable has opted to upgrade the included version of OpenSSL as a precaution, and to save time. The issues include:

• CVE-2016-0800 Secure Sockets Layer Version 2 (SSLv2) Cross-Protocol TLS Session Decryption (DROWN)
• CVE-2016-0705 OpenSSL DSA Private Key Handling Double-free Memory Corruption
• CVE-2016-0702 OpenSSL Cache-bank Conflict Handling Side-channel RSA Key Disclosure
• CVE-2016-0797 OpenSSL crypto/bn/bn_print.c BN_hex2bn() / BN_dec2bn() Functions NULL Pointer Dereference Heap Corruption
• CVE-2016-0799 OpenSSL crypto/bio/b_print.c doapr_outch() Function Memory Allocation Failure Memory Corruption
• CVE-2016-0799 OpenSSL crypto/bio/b_print.c fmtstr() Function Out-of-bounds Read Issue
• CVE-2016-0798 OpenSSL SRP Server apps/s_server.c SRP_VBASE_get_by_user Method Username Handling Memory Exhaustion Remote DoS
• CVE-2016-0703 OpenSSL s2_srvr.c Non-zero Clear Key Length Handling SSLv2 Master Key Disclosure
• CVE-2016-0704 OpenSSL Simple s2_srvr.c RSA CMS Signature Bleichenbacher Weakness

Notes and caveats:

• CVE-2016-0703 and CVE-2016-0704 were actually fixed in 1.0.2a, but mentioned in the OpenSSL advisory for 1.0.2g.
• At present, SecurityCenter and LCE do not enable SSLv2 and are not impacted by the 'DROWN' vulnerability, or any other based on SSLv2 flaws.
• The Tenable Appliance does not enable SSLv2, and based on internal evaluation, does not appear to be impacted by the remaining issues.
• LCE was not evaluated for the non-SSLv2 issues, as upgrading to the newer OpenSSL was faster.
• Nessus Agents are not affected by these issues, as they do not act as an SSL server.
• Other Tenable products (including PVS 5.0.0), are still being evaluated.
• Please note that Tenable strongly recommends that Tenable products be installed on a subnet that is not Internet addressable.