TLS V1.2 Sigalgs Remote Crash (CVE-2015-0291)

OpenSSL 1.0.2a fix several security issues, one of them let crash TLSv1.2 based services remotelly from internet.


Regarding to the TLSv1.2 RFC,  this version of TLS provides a "signature_algorithms" extension for the client_hello. 

Data Structures

If a bad signature is sent after the renegotiation, the structure will be corrupted, becouse structure pointer:
s->c->shared_sigalgs will be NULL, and the number of algorithms:
s->c->shared_sigalgslen will not be zeroed.
Which will be interpreted as one algorithm to process, but the pointer points to 0x00 address. 

Then tls1_process_sigalgs() will try to process one signature algorithm (becouse of shared_sigalgslen=1) then sigptr will be pointer to c->shared_sigalgs (NULL) and then will try to derreference sigptr->rhash. 

This mean a Segmentation Fault in  tls1_process_sigalgs() function, and called by tls1_set_server_sigalgs() with is called from ssl3_client_hello() as the stack trace shows.

StackTrace

The following code, points sigptr to null and try to read sigptr->rsign, which is assembled as movzbl eax,  byte ptr [0x0+R12] note in register window that R12 is 0x00

Debugger in the crash point.

radare2 static decompiled

The patch fix the vulnerability zeroing the sigalgslen.
Get  David A. Ramos' proof of concept exploit here

Related articles

1. Hacker Security Tools
2. Pentest Tools Linux
3. How To Install Pentest Tools In Ubuntu
4. Pentest Tools Free
5. Usb Pentest Tools
6. Hacker Tools 2019
7. Pentest Tools Open Source
8. Pentest Automation Tools
9. Hacker Tools For Pc
10. Hacking Tools For Windows 7
11. Hacker Tools Github
12. Hack Tools Mac
13. Pentest Tools Url Fuzzer
14. Tools 4 Hack
15. Pentest Tools Framework
16. Hack Tool Apk No Root
17. Kik Hack Tools
18. Hacker Tools For Mac
19. Nsa Hack Tools
20. Hacker Search Tools
21. Pentest Reporting Tools
22. Hacking Tools For Windows
23. Hack Tools For Pc
24. Hacking Tools Hardware
25. Pentest Tools Bluekeep
26. Hacker Tools Windows
27. Pentest Tools Online
28. Pentest Tools Online
29. Hacker Tools Apk Download
30. Hacker Security Tools
31. Hacking Tools And Software
32. Computer Hacker
33. Hacker Tools List
34. What Are Hacking Tools
35. Pentest Tools Linux
36. Pentest Tools Nmap
37. Hacking Tools For Windows 7
38. Hacking Tools Download
39. Pentest Box Tools Download
40. Pentest Recon Tools
41. Hackers Toolbox
42. Hacker Tool Kit
43. Hack Tools For Windows
44. Hacker Tools Apk
45. Best Pentesting Tools 2018
46. Hack Tool Apk No Root
47. Hacks And Tools
48. Tools For Hacker
49. Pentest Tools Open Source
50. Underground Hacker Sites
51. Hacking Tools 2019
52. Tools Used For Hacking
53. Hacker Tools 2019
54. Hacker Tools Github
55. Hacking Tools Online
56. Pentest Tools Url Fuzzer
57. Hacking Tools Software
58. Hacker Search Tools
59. Hacking Tools Kit
60. Pentest Tools Find Subdomains
61. Github Hacking Tools
62. Underground Hacker Sites
63. Pentest Recon Tools
64. Blackhat Hacker Tools
65. Pentest Tools Android
66. Tools 4 Hack
67. Install Pentest Tools Ubuntu
68. Pentest Tools Windows
69. Hacking Tools For Windows 7
70. Hacker Tools For Pc
71. Pentest Tools
72. Hak5 Tools
73. Pentest Tools Android
74. Hacker Tools Free Download
75. Hacking Tools Hardware
76. Pentest Tools Website
77. Pentest Automation Tools
78. Kik Hack Tools
79. Hacking Tools Free Download
80. Ethical Hacker Tools