Remote Yes

Type Denial of service

Description

If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.

AVG-155 lib32-openssl 1:1.0.2.j-1 1:1.0.2.k-1 Medium Fixed

AVG-154 openssl 1.0.2.j-1 1.0.2.k-1 Medium Fixed

28 Jan 2017 ASA-201701-37 AVG-154 openssl Medium multiple issues

27 Jan 2017 ASA-201701-36 AVG-155 lib32-openssl Medium multiple issues

https://www.openssl.org/news/secadv/20170126.txt