======================================================================== Summary ======================================================================== In order to achieve remote code execution against the vulnerabilities that we recently discovered in OpenSMTPD (CVE-2015-7687), a memory leak is needed. Because we could not find one in OpenSMTPD itself, we started to review the malloc()s and free()s of its libraries, and eventually found a memory leak in LibreSSL's OBJ_obj2txt() function; we then realized that this function also contains a buffer overflow (an off-by-one, usually stack-based). The vulnerable function OBJ_obj2txt() is reachable through X509_NAME_oneline() and d2i_X509(), which is called automatically to decode the X.509 certificates exchanged during an SSL handshake (both client-side, unless an anonymous mode is used, and server-side, if client authentication is requested). These vulnerabilities affect all LibreSSL versions, including LibreSSL 2.0.0 (the first public release) and LibreSSL 2.3.0 (the latest release at the time of writing). OpenSSL is not affected. [...] This off-by-one buffer overflow allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code. However, when triggered through X509_NAME_oneline() (and therefore d2i_X509()), this buffer overflow is stack-based and probably not exploitable on OpenBSD x86, where it appears to always smash the stack canary.
To answer ago's questions from the ${URL} followup: All released versions up to 2.3.0 are affected. The commits which fix the memory leak and buffer overflow are presumably: https://github.com/libressl-portable/openbsd/commit/ea13bdff130f93ab673b45fc299e56a4c5a821e4 https://github.com/libressl-portable/openbsd/commit/f292734cabfd94223388c7a59ed940e850b26649 Plus some more which appear to be related, but not directly fix any security vulnerability in that CVE.
(In reply to Chí-Thanh Christopher Nguyễn from comment #1) > To answer ago's questions from the ${URL} followup: > All released versions up to 2.3.0 are affected. > That's not entirely correct, because it is fixed in 2.2.4, which is the stable branch. http://ftp.openbsd.org/pub/OpenBSD/patches/5.8/common/007_obj2txt.patch.sig https://github.com/libressl-portable/portable/blob/v2.2.4/ChangeLog#L35
https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0171d63fb6075caf0db45f1d26ff18556afb5ab5 https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=01b218d46346e441cd768f2f8e985abb14bbb6ab
Package never stabilized.
