ID CVE-2019-1563
Summary In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).
References
Vulnerable Configurations
  • OpenSSL Project OpenSSL 1.0.2
    cpe:2.3:a:openssl:openssl:1.0.2
  • OpenSSL Project OpenSSL 1.0.2-beta1
    cpe:2.3:a:openssl:openssl:1.0.2:beta1
  • OpenSSL 1.0.2 Beta 2
    cpe:2.3:a:openssl:openssl:1.0.2:beta2
  • OpenSSL 1.0.2 Beta 3
    cpe:2.3:a:openssl:openssl:1.0.2:beta3
  • OpenSSL OpenSSL 1.0.2a
    cpe:2.3:a:openssl:openssl:1.0.2a
  • OpenSSL Project OpenSSL 1.0.2b
    cpe:2.3:a:openssl:openssl:1.0.2b
  • OpenSSL Project OpenSSL 1.0.2c
    cpe:2.3:a:openssl:openssl:1.0.2c
  • OpenSSL OpenSSL 1.0.2d
    cpe:2.3:a:openssl:openssl:1.0.2d
  • OpenSSL 1.0.2e
    cpe:2.3:a:openssl:openssl:1.0.2e
  • OpenSSL 1.0.2f
    cpe:2.3:a:openssl:openssl:1.0.2f
  • OpenSSL Project 1.0.2g
    cpe:2.3:a:openssl:openssl:1.0.2g
  • OpenSSL 1.0.2h
    cpe:2.3:a:openssl:openssl:1.0.2h
  • OpenSSL Project OpenSSL 1.0.2i
    cpe:2.3:a:openssl:openssl:1.0.2i
  • OpenSSL1.0.2j
    cpe:2.3:a:openssl:openssl:1.0.2j
  • OpenSSL 1.0.2k
    cpe:2.3:a:openssl:openssl:1.0.2k
  • OpenSSL 1.0.2l
    cpe:2.3:a:openssl:openssl:1.0.2l
  • OpenSSL 1.0.2m
    cpe:2.3:a:openssl:openssl:1.0.2m
  • OpenSSL Project OpenSSL 1.0.2n
    cpe:2.3:a:openssl:openssl:1.0.2n
  • OpenSSL Project OpenSSL 1.0.2o
    cpe:2.3:a:openssl:openssl:1.0.2o
  • OpenSSL Project OpenSSL 1.0.2p
    cpe:2.3:a:openssl:openssl:1.0.2p
  • OpenSSL Project OpenSSL 1.0.2q
    cpe:2.3:a:openssl:openssl:1.0.2q
  • OpenSSL Project OpenSSL 1.0.2r
    cpe:2.3:a:openssl:openssl:1.0.2r
  • OpenSSL Project OpenSSL 1.0.2s
    cpe:2.3:a:openssl:openssl:1.0.2s
  • OpenSSL Project OpenSSL 1.1.0
    cpe:2.3:a:openssl:openssl:1.1.0
  • OpenSSL Project OpenSSL 1.1.0
    cpe:2.3:a:openssl:openssl:1.1.0
  • OpenSSL Project OpenSSL 1.1.0 Pre1
    cpe:2.3:a:openssl:openssl:1.1.0:pre1
  • OpenSSL Project OpenSSL 1.1.0 Pre2
    cpe:2.3:a:openssl:openssl:1.1.0:pre2
  • OpenSSL Project OpenSSL 1.1.0 Pre3
    cpe:2.3:a:openssl:openssl:1.1.0:pre3
  • OpenSSL Project OpenSSL 1.1.0 Pre4
    cpe:2.3:a:openssl:openssl:1.1.0:pre4
  • OpenSSL Project OpenSSL 1.1.0 Pre5
    cpe:2.3:a:openssl:openssl:1.1.0:pre5
  • OpenSSL Project OpenSSL 1.1.0 Pre6
    cpe:2.3:a:openssl:openssl:1.1.0:pre6
  • OpenSSL Project OpenSSL 1.1.0a
    cpe:2.3:a:openssl:openssl:1.1.0a
  • OpenSSL Project OpenSSL 1.1.0b
    cpe:2.3:a:openssl:openssl:1.1.0b
  • OpenSSL Project OpenSSL 1.1.0c
    cpe:2.3:a:openssl:openssl:1.1.0c
  • OpenSSL Project OpenSSL 1.1.0d
    cpe:2.3:a:openssl:openssl:1.1.0d
  • OpenSSL Project OpenSSL 1.1.0e
    cpe:2.3:a:openssl:openssl:1.1.0e
  • OpenSSL Project OpenSSL 1.1.0f
    cpe:2.3:a:openssl:openssl:1.1.0f
  • OpenSSL 1.1.0g
    cpe:2.3:a:openssl:openssl:1.1.0g
  • OpenSSL Project OpenSSL 1.1.0h
    cpe:2.3:a:openssl:openssl:1.1.0h
  • OpenSSL Project OpenSSL 1.1.0i
    cpe:2.3:a:openssl:openssl:1.1.0i
  • OpenSSL Project OpenSSL 1.1.0j
    cpe:2.3:a:openssl:openssl:1.1.0j
  • OpenSSL Project OpenSSL 1.1.0k
    cpe:2.3:a:openssl:openssl:1.1.0k
  • OpenSSL Project OpenSSL 1.1.1
    cpe:2.3:a:openssl:openssl:1.1.1
  • OpenSSL Project OpenSSL 1.1.1 Pre1
    cpe:2.3:a:openssl:openssl:1.1.1:pre1
  • OpenSSL Project OpenSSL 1.1.1 Pre2
    cpe:2.3:a:openssl:openssl:1.1.1:pre2
  • OpenSSL Project OpenSSL 1.1.1 Pre3
    cpe:2.3:a:openssl:openssl:1.1.1:pre3
  • OpenSSL Project OpenSSL 1.1.1 Pre4
    cpe:2.3:a:openssl:openssl:1.1.1:pre4
  • OpenSSL Project OpenSSL 1.1.1 Pre5
    cpe:2.3:a:openssl:openssl:1.1.1:pre5
  • OpenSSL Project OpenSSL 1.1.1 Pre6
    cpe:2.3:a:openssl:openssl:1.1.1:pre6
  • OpenSSL Project OpenSSL 1.1.1 Pre7
    cpe:2.3:a:openssl:openssl:1.1.1:pre7
  • OpenSSL Project OpenSSL 1.1.1 Pre8
    cpe:2.3:a:openssl:openssl:1.1.1:pre8
  • OpenSSL Project OpenSSL 1.1.1 Pre9
    cpe:2.3:a:openssl:openssl:1.1.1:pre9
  • OpenSSL Project OpenSSL 1.1.1a
    cpe:2.3:a:openssl:openssl:1.1.1a
  • OpenSSL Project OpenSSL 1.1.1b
    cpe:2.3:a:openssl:openssl:1.1.1b
  • OpenSSL Project OpenSSL 1.1.1c
    cpe:2.3:a:openssl:openssl:1.1.1c
CVSS
Base: 4.3
Impact:
Exploitability:
CWE CWE-311
CAPEC
  • Interception
    An attacker monitors data streams to or from a target in order to gather information. This attack may be undertaken to gather information to support a later attack or the data collected may be the end goal of the attack. This attack usually involves sniffing network traffic, but may include observing other types of data streams, such as radio. In most varieties of this attack, the attacker is passive and simply observes regular communication, however in some variants the attacker may attempt to initiate the establishment of a data stream or influence the nature of the data transmitted. However, in all variants of this attack, and distinguishing this attack from other data collection methods, the attacker is not the intended recipient of the data stream. Unlike some other data leakage attacks, the attacker is observing explicit data channels (e.g. network traffic) and reading the content. This differs from attacks that collect more qualitative information, such as communication volume, or other information not explicitly communicated via a data stream.
  • Screen Temporary Files for Sensitive Information
    An attacker exploits the temporary, insecure storage of information by monitoring the content of files used to store temp data during an application's routine execution flow. Many applications use temporary files to accelerate processing or to provide records of state across multiple executions of the application. Sometimes, however, these temporary files may end up storing sensitive information. By screening an application's temporary files, an attacker might be able to discover such sensitive information. For example, web browsers often cache content to accelerate subsequent lookups. If the content contains sensitive information then the attacker could recover this from the web cache.
  • Sniffing Attacks
    An attacker monitors information transmitted between logical or physical nodes of a network. The attacker need not be able to prevent reception or change content but must simply be able to observe and read the traffic. The attacker might precipitate or indirectly influence the content of the observed transaction, but the attacker is never the intended recipient of the information. Any transmission medium can theoretically be sniffed if the attacker can listen to the contents between the sender and recipient.
  • Sniffing Network Traffic
    An attacker monitoring network traffic between nodes of a public or multicast network. The attacker need not be able to prevent reception or change content but must simply be able to observe and read the traffic. The attacker might precipitate or indirectly influence the content of the observed transaction, but the attacker is never the intended recipient of the information. This differs from other sniffing attacks in that it is over a public network rather via some other communications channel, such as radio.
  • Lifting Sensitive Data from the Client
    An attacker examines an available client application for the presence of sensitive information. This information may be stored in configuration files, embedded within the application itself, or stored in other ways. Sensitive information may include long-term keys, passwords, credit card or financial information, and other private material that the client uses in its interactions with the server. While servers are (hopefully) protected with professional security administrators, most users may be less skilled at protecting their clients. As a result, the user client may represent a weak link that an attacker can exploit. If an attacker can gain access to a client installation, they may be able to detect and lift sensitive information that could be used directly (such as financial information), or allow the attacker to subvert future communication between the client and the server. In some cases, it may not even be necessary to gain access to another user's installation - if all instances of the client software are embedded with the same sensitive information (for example, long term keys for communication with the server) then the attacker must simply find a way to gain their own copy of the client in order to perform this attack.
  • Footprinting
    An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
  • Lifting cached, sensitive data embedded in client distributions (thick or thin)
    An attacker examines a target application's cache for sensitive information. Many applications that communicate with remote entities or which perform intensive calculations utilize caches to improve efficiency. However, if the application computes or receives sensitive information and the cache is not appropriately protected, an attacker can browse the cache and retrieve this information. This can result in the disclosure of sensitive information.
  • Passively Sniffing and Capturing Application Code Bound for an Authorized Client During Dynamic Update
    Attackers can capture application code bound for an authorized client during a dynamic update and can use it, as-is or through reverse-engineering, to glean sensitive information or exploit the trust relationship between the client and server.
  • Passively Sniffing and Capturing Application Code Bound for an Authorized Client During Patching
    Attackers can capture application code bound for an authorized client during patching and can use it, as-is or through reverse-engineering, to glean sensitive information or exploit the trust relationship between the client and server.
  • Passively Sniffing and Capturing Application Code Bound for an Authorized Client During Initial Distribution
    Attackers can capture new application installation code bound for an authorized client during initial distribution and can use it, as-is or through reverse-engineering, to glean sensitive information or exploit the trust relationship between the client and server.
  • Accessing/Intercepting/Modifying HTTP Cookies
    This attack relies on the use of HTTP Cookies to store credentials, state information and other critical data on client systems. The first form of this attack involves accessing HTTP Cookies to mine for potentially sensitive data contained therein. The second form of this attack involves intercepting this data as it is transmitted from client to server. This intercepted information is then used by the attacker to impersonate the remote user/session. The third form is when the cookie's content is modified by the attacker before it is sent back to the server. Here the attacker seeks to convince the target server to operate on this falsified information.
  • Lifting Data Embedded in Client Distributions
    An attacker can resort to stealing data embedded in client distributions or client code in order to gain certain information. This information can reveal confidential contents, such as account numbers, or can be used as an intermediate step in a larger attack (such as by stealing keys/credentials).
  • Harvesting Usernames or UserIDs via Application API Event Monitoring
    An attacker hosts an event within an application framework and then monitors the data exchanged during the course of the event for the purpose of harvesting any important data leaked during the transactions. One example could be harvesting lists of usernames or userIDs for the purpose of sending spam messages to those users. One example of this type of attack involves the attacker creating an event within the sub-application. Assume the attacker hosts a "virtual sale" of rare items. As other users enter the event, the attacker records via MITM proxy the user_ids and usernames of everyone who attends. The attacker would then be able to spam those users within the application using an automated script.
  • Application API Message Manipulation via Man-in-the-Middle
    An attacker manipulates either egress or ingress data from a client within an application framework in order to change the content of messages. Performing this attack can allow the attacker to gain unauthorized privileges within the application, or conduct attacks such as phishing, deceptive strategies to spread malware, or traditional web-application attacks. The techniques require use of specialized software that allow the attacker to man-in-the-middle communications between the web browser and the remote system. Despite the use of MITM software, the attack is actually directed at the server, as the client is one node in a series of content brokers that pass information along to the application framework. Additionally, it is not true "Man-in-the-Middle" attack at the network layer, but an application-layer attack the root cause of which is the master applications trust in the integrity of code supplied by the client.
  • Transaction or Event Tampering via Application API Manipulation
    An attacker hosts or joins an event or transaction within an application framework in order to change the content of messages or items that are being exchanged. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that look authentic but may contain deceptive links, substitute one item or another, spoof an existing item and conduct a false exchange, or otherwise change the amounts or identity of what is being exchanged. The techniques require use of specialized software that allow the attacker to man-in-the-middle communications between the web browser and the remote system in order to change the content of various application elements. Often, items exchanged in game can be monetized via sales for coin, virtual dollars, etc. The purpose of the attack is for the attack to scam the victim by trapping the data packets involved the exchange and altering the integrity of the transfer process.
  • Application API Navigation Remapping
    An attacker manipulates either egress or ingress data from a client within an application framework in order to change the destination and/or content of links/buttons displayed to a user within API messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that looks authentic but contains links/buttons that point to an attacker controlled destination. Some applications make navigation remapping more difficult to detect because the actual HREF values of images, profile elements, and links/buttons are masked. One example would be to place an image in a user's photo gallery that when clicked upon redirected the user to an off-site location. Also, traditional web vulnerabilities (such as CSRF) can be constructed with remapped buttons or links. In some cases navigation remapping can be used for Phishing attacks or even means to artificially boost the page view, user site reputation, or click-fraud.
  • Navigation Remapping To Propagate Malicious Content
    An attacker manipulates either egress or ingress data from a client within an application framework in order to change the content of messages and thereby circumvent the expected application logic. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that look authentic but may contain deceptive links, spam-like content, or links to the attackers' code. In general, content-spoofing within an application API can be employed to stage many different types of attacks varied based on the attackers' intent. When the goal is to spread malware, deceptive content is created such as modified links, buttons, or images, that entice users to click on those items, all of which point to a malicious URI. The techniques require use of specialized software that allow the attacker to man-in-the-middle communications between the web browser and the remote system in order to change the destination of various application interface elements.
  • Application API Button Hijacking
    An attacker manipulates either egress or ingress data from a client within an application framework in order to change the destination and/or content of buttons displayed to a user within API messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that looks authentic but contains buttons that point to an attacker controlled destination. For example, an in-game event occurs and the attacker traps the result, which turns out to be a form that will be populated to their primary profile. The attacker, using a MITM proxy, observes the following data: By altering the destination of "Claim_Link" to point to the attackers' server an unwitting victim can be enticed to click the link. Another example would be for the attacker to rewrite the button destinations for an event so that clicking "Yes" or "No" causes the user to load the attackers' code.
  • Content Spoofing Via Application API Manipulation
    An attacker manipulates either egress or ingress data from a client within an application framework in order to change the content of messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that look authentic but may contain deceptive links, spam-like content, or links to the attackers' code. In general, content-spoofing within an application API can be employed to stage many different types of attacks varied based on the attackers' intent. The techniques require use of specialized software that allow the attacker to man-in-the-middle communications between the web browser and the remote system.
  • Signature Spoofing by Mixing Signed and Unsigned Content
    An attacker exploits the underlying complexity of a data structure that allows for both signed and unsigned content, to cause unsigned data to be processed as though it were signed data.
  • Passively Sniff and Capture Application Code Bound for Authorized Client
    Attackers can capture application code bound for the client and can use it, as-is or through reverse-engineering, to glean sensitive information or exploit the trust relationship between the client and server. Such code may belong to a dynamic update to the client, a patch being applied to a client component or any such interaction where the client is authorized to communicate with the server.
Last major update 10-09-2019 - 13:35
Published 10-09-2019 - 13:15
Last modified 12-09-2019 - 07:15
Back to Top