TLS V1.2 Sigalgs Remote Crash (CVE-2015-0291)

OpenSSL 1.0.2a fix several security issues, one of them let crash TLSv1.2 based services remotelly from internet.


Regarding to the TLSv1.2 RFC,  this version of TLS provides a "signature_algorithms" extension for the client_hello. 

Data Structures

If a bad signature is sent after the renegotiation, the structure will be corrupted, becouse structure pointer:
s->c->shared_sigalgs will be NULL, and the number of algorithms:
s->c->shared_sigalgslen will not be zeroed.
Which will be interpreted as one algorithm to process, but the pointer points to 0x00 address. 

Then tls1_process_sigalgs() will try to process one signature algorithm (becouse of shared_sigalgslen=1) then sigptr will be pointer to c->shared_sigalgs (NULL) and then will try to derreference sigptr->rhash. 

This mean a Segmentation Fault in  tls1_process_sigalgs() function, and called by tls1_set_server_sigalgs() with is called from ssl3_client_hello() as the stack trace shows.

StackTrace

The following code, points sigptr to null and try to read sigptr->rsign, which is assembled as movzbl eax,  byte ptr [0x0+R12] note in register window that R12 is 0x00

Debugger in the crash point.

radare2 static decompiled

The patch fix the vulnerability zeroing the sigalgslen.
Get  David A. Ramos' proof of concept exploit here

Related articles

1. Hacker Tools List
2. Hacker Tools List
3. Android Hack Tools Github
4. Pentest Box Tools Download
5. Kik Hack Tools
6. Hacking Tools And Software
7. World No 1 Hacker Software
8. Hack Tool Apk No Root
9. Pentest Tools Online
10. Hacker Tools For Pc
11. Hacking Tools Windows 10
12. Tools 4 Hack
13. Hacking Tools For Beginners
14. Hacker Tools For Windows
15. How To Hack
16. Hacker Security Tools
17. Pentest Tools Linux
18. Growth Hacker Tools
19. Hacker Techniques Tools And Incident Handling
20. Nsa Hack Tools Download
21. Pentest Tools For Mac
22. Hacking Tools For Kali Linux
23. Hacker Tools For Mac
24. What Are Hacking Tools
25. Hacking Tools Hardware
26. Hak5 Tools
27. Top Pentest Tools
28. Hacking Tools And Software
29. Hack Tools For Windows
30. How To Install Pentest Tools In Ubuntu
31. Hacker Tools Apk
32. Pentest Tools Android
33. Hack Tools For Games
34. Hacker Tools
35. Top Pentest Tools
36. Hacking Tools For Windows Free Download
37. Hacker Tools List
38. Wifi Hacker Tools For Windows
39. Hacking Tools Hardware
40. Hack Tools Github
41. Termux Hacking Tools 2019
42. Pentest Tools For Windows
43. Hack Tools Pc
44. Hack Apps
45. Hacker Tools 2020
46. Pentest Tools Kali Linux
47. Hacker Tools Software
48. World No 1 Hacker Software
49. World No 1 Hacker Software
50. Pentest Tools Download
51. Hack Tools For Games
52. Hacker Hardware Tools
53. Pentest Tools Alternative
54. Pentest Tools Website
55. Hack Tools
56. Hack Tool Apk No Root
57. Hack Tools Mac
58. How To Make Hacking Tools
59. Hack Tools For Games
60. Hack Tools
61. Hacking Tools Hardware
62. Pentest Tools Github
63. Pentest Tools Subdomain
64. Tools For Hacker
65. Pentest Recon Tools
66. Hacker Tools Github
67. Hacking Tools For Mac
68. Computer Hacker
69. Hacker Tools Hardware
70. Best Hacking Tools 2019
71. Tools Used For Hacking
72. Hack Tools Online
73. How To Install Pentest Tools In Ubuntu
74. Hacker Techniques Tools And Incident Handling
75. Hacker Tools Apk Download
76. Pentest Tools Online
77. Hacking Tools Free Download
78. Best Hacking Tools 2019
79. Hacking Tools Online
80. Hacking Tools For Kali Linux
81. Free Pentest Tools For Windows
82. Wifi Hacker Tools For Windows
83. Beginner Hacker Tools
84. Pentest Tools Github
85. Pentest Tools Apk
86. Hacking Tools Windows
87. Hack Tool Apk No Root
88. Hacking Apps
89. Pentest Tools Website
90. Hacker Tools List
91. Hacking Tools Windows