CVE-2015-8036

02.11.2015, 19:59

Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long session ticket name to the session ticket extension, which is not properly handled when creating a ClientHello message to resume a session.  NOTE: this identifier was SPLIT from CVE-2015-5291 per ADT3 due to different affected version ranges.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Vector
NIST	NIST	6.8 UNKNOWN	NETWORK	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P
mitre	CNA	---			---
CVE	ADP	---			---

Base Score

CVSS 3.x

EPSS Score

Percentile: 74%

Vendor	Product	Version
arm	mbed_tls	1.3.0 ≤ 𝑥 < 1.3.14
arm	mbed_tls	2.0.0 ≤ 𝑥 < 2.1.2
polarssl	polarssl	𝑥 ≤ 1.2.17
debian	debian_linux	7.0
debian	debian_linux	8.0
opensuse	opensuse	13.2

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

mbedtls

bullseye	2.16.9-0.1 fixed
wheezy	not-affected
squeeze	not-affected
bookworm	2.28.3-1 fixed
trixie	2.28.8-1 fixed
sid	3.6.2-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

mbedtls

disco	not-affected
cosmic	not-affected
bionic	not-affected
artful	not-affected
zesty	not-affected
yakkety	not-affected
xenial	not-affected
wily	dne
trusty	dne
precise	dne

polarssl

disco	dne
cosmic	dne
bionic	dne
artful	dne
zesty	dne
yakkety	dne
xenial	dne
wily	Fixed 1.3.9-2.1+deb8u1 released
vivid	ignored
trusty	dne
precise	ignored

Common Weakness Enumeration

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

References

http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169625.html

http://lists.opensuse.org/opensuse-updates/2016-08/msg00009.html

http://www.debian.org/security/2016/dsa-3468

https://guidovranken.files.wordpress.com/2015/10/cve-2015-5291.pdf

https://guidovranken.wordpress.com/2015/10/07/cve-2015-5291/