OpenSSL CVE-2017-3736 Information Disclosure Vulnerability

Bugtraq ID:	101666
Class:	Design Error
CVE:	CVE-2017-3736
Remote:	Yes
Local:	No
Published:	Nov 02 2017 12:00AM
Updated:	Jul 17 2019 09:00AM
Credit:	OSS-Fuzz
Vulnerable:	Redhat JBoss EWS 2 Redhat Jboss EAP 6 Redhat JBoss Core Services 1 Redhat Enterprise Linux 7 Oracle VM VirtualBox 5.2.4 Oracle VM VirtualBox 5.2.2 Oracle VM VirtualBox 5.2 Oracle VM VirtualBox 5.1.32 Oracle VM VirtualBox 5.1.20 Oracle VM VirtualBox 5.1.16 Oracle VM VirtualBox 5.1.14 Oracle VM VirtualBox 5.1.10 Oracle VM VirtualBox 5.1.8 Oracle VM VirtualBox 5.1.30 Oracle VM VirtualBox 5.1.24 Oracle Secure Global Desktop 5.3 Oracle MySQL Enterprise Monitor 3.2.1182 Oracle MySQL Enterprise Monitor 3.0.22 Oracle MySQL Enterprise Monitor 3.0.20 Oracle MySQL Enterprise Monitor 3.0.18 Oracle MySQL Enterprise Monitor 3.0.10 Oracle MySQL Enterprise Monitor 3.0.9 Oracle MySQL Enterprise Monitor 3.0.8 Oracle MySQL Enterprise Monitor 3.0 Oracle MySQL Enterprise Monitor 4.0.0.5135 Oracle MySQL Enterprise Monitor 3.4.4.4226 Oracle MySQL Enterprise Monitor 3.4.2.4181 Oracle MySQL Enterprise Monitor 3.4.1 Oracle MySQL Enterprise Monitor 3.4.0 Oracle MySQL Enterprise Monitor 3.3.6.3293 Oracle MySQL Enterprise Monitor 3.3.4.3247 Oracle MySQL Enterprise Monitor 3.3.3.1199 Oracle MySQL Enterprise Monitor 3.3.2.1162 Oracle MySQL Enterprise Monitor 3.3.0.1098 Oracle MySQL Enterprise Monitor 3.2.8.2223 Oracle MySQL Enterprise Monitor 3.2.7.1204 Oracle MySQL Enterprise Monitor 3.2.5.1141 Oracle MySQL Enterprise Monitor 3.2.4.1102 Oracle MySQL Enterprise Monitor 3.2.1.1049 Oracle MySQL Enterprise Monitor 3.1.6.8003 Oracle MySQL Enterprise Monitor 3.1.5.7958 Oracle MySQL Enterprise Monitor 3.1.4.7895 Oracle MySQL Enterprise Monitor 3.1.3.7856 Oracle MySQL Enterprise Monitor 3.1.2 Oracle MySQL Enterprise Monitor 3.0.4 Oracle MySQL Enterprise Monitor 3.0.25 Oracle MySQL Enterprise Monitor 3.0 Oracle MySQL Connectors 5.3.9 Oracle MySQL Connectors 5.3.7 Oracle MySQL Connectors 5.1.41 Oracle MySQL Connectors 5.1.34 Oracle MySQL Connectors 5.1.33 Oracle MySQL Connectors 5.1.30 Oracle MySQL Connectors 5.1.40 Oracle Linux 7.0 Oracle JD Edwards World Security A9.4 Oracle JD Edwards World Security A9.3.1 Oracle JD Edwards World Security A9.3 Oracle E-Business Suite 12.1.3 Oracle Communications EAGLE 46.7 Oracle Communications EAGLE 46.6 Oracle Communications EAGLE 46.5 OpenSSL Project OpenSSL 1.1 OpenSSL Project OpenSSL 1.0.2 OpenSSL Project OpenSSL 1.1.0f OpenSSL Project OpenSSL 1.1.0e OpenSSL Project OpenSSL 1.1.0d OpenSSL Project OpenSSL 1.1.0c OpenSSL Project OpenSSL 1.1.0b OpenSSL Project OpenSSL 1.1.0a OpenSSL Project OpenSSL 1.0.2l OpenSSL Project OpenSSL 1.0.2k OpenSSL Project OpenSSL 1.0.2j OpenSSL Project OpenSSL 1.0.2i OpenSSL Project OpenSSL 1.0.2h OpenSSL Project OpenSSL 1.0.2g OpenSSL Project OpenSSL 1.0.2f OpenSSL Project OpenSSL 1.0.2e OpenSSL Project OpenSSL 1.0.2d OpenSSL Project OpenSSL 1.0.2c OpenSSL Project OpenSSL 1.0.2b OpenSSL Project OpenSSL 1.0.2a McAfee Web Gateway 7.7 McAfee Web Gateway 7.8.0.1 McAfee Web Gateway 7.8 McAfee Web Gateway 7.7.2.6 McAfee Web Gateway 7.7.2.3 McAfee Web Gateway 7.7.2.2 McAfee Web Gateway 7.6.2.4 McAfee Web Gateway 7.6.2.3 McAfee Web Gateway 7.6.2.2 McAfee Web Gateway 7.6.2.17 McAfee Web Gateway 7.6.2.15 McAfee Web Gateway 7.6.2.14 McAfee Web Gateway 7.6.2.1 McAfee Web Gateway 7.6.2.0 IBM DB2 9.8 IBM DB2 9.7 IBM DB2 11.1 IBM DB2 10.5 IBM DB2 10.1 Bluecoat Unified Agent 4.9 Bluecoat Unified Agent 4.8 Bluecoat Unified Agent 4.7 Bluecoat Unified Agent 4.6 Bluecoat Security Analytics 7.3 Bluecoat Security Analytics 7.2 Bluecoat Reporter 9.5 Bluecoat Proxysg 6.7 Bluecoat Proxysg 6.6 Bluecoat Proxysg 6.5 Bluecoat Proxyav 3.5 Bluecoat IntelligenceCenter Data Collector 3.3 Bluecoat IntelligenceCenter 3.3 Bluecoat Director 6.1 Bluecoat BCAAA 6.1 Bluecoat Android Mobile Agent 1.3 Bluecoat Advanced Secure Gateway 6.7 Bluecoat Advanced Secure Gateway 6.6
Not Vulnerable:	OpenSSL Project OpenSSL 1.1.0g OpenSSL Project OpenSSL 1.0.2m McAfee Web Gateway 7.8.0.2 McAfee Web Gateway 7.7.2.7

OpenSSL CVE-2017-3736 Information Disclosure Vulnerability

OpenSSL is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks.

Versions prior to OpenSSL 1.1.0g and 1.0.2m are vulnerable.

OpenSSL CVE-2017-3736 Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

OpenSSL CVE-2017-3736 Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

OpenSSL CVE-2017-3736 Information Disclosure Vulnerability

References:

• bn/asm/x86_64-mont5.pl: fix carry bug in bn_sqrx8x_internal. (OpenSSL)
  
• Bug 1509169 - (CVE-2017-3736) CVE-2017-3736 openssl: bn_sqrx8x_internal carry bu (Red Hat Bugzilla)
  
• CVE-2017-3736 (Red Hat)
  
• OpenSSL Homepage (OpenSSL)
  
• McAfee Security Bulletin - Web Gateway updates fix several vulnerabilities (CVE- (McAfee)
  
• OpenSSL Security Advisory [02 Nov 2017] (OpenSSL)
  
• Oracle Critical Patch Update Advisory - January 2018 (Oracle)
  
• Oracle Critical Patch Update Advisory - July 2018 (Oracle)
  
• Oracle Critical Patch Update Advisory - July 2019 (Oracle)
  
• Oracle Linux Bulletin - April 2018 (Oracle)
  
• Published Security Vulnerabilities for DB2 for Linux, UNIX, and Windows includin (IBM)
  
• SA157: OpenSSL Vulnerabilities 28-Aug-2017 and 2-Nov-2017 (Symantec)
  
• Vulnerabilities in GSKit affect IBM Spectrum Scale (CVE-2018-1431, CVE-2017-3736 (IBM)