OpenSSL CVE-2018-0739 Denial of Service Vulnerability

Bugtraq ID:	103518
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2018-0739
Remote:	Yes
Local:	No
Published:	Mar 27 2018 12:00AM
Updated:	Feb 13 2019 01:00PM
Credit:	Matt Caswell
Vulnerable:	SuSE Suse Linux Enterprise Server 11-SECURITY SuSE OpenStack Cloud 6 SuSE Linux Enterprise Server for SAP 12 SP1 SuSE Linux Enterprise Server 12-SP1 SuSE Linux Enterprise Server 12-LTSS Redhat JBoss Web Server (JWS) 3.0 Redhat JBoss EWS 2 Redhat JBoss Core Services 1 Redhat Enterprise Linux 7 Redhat Enterprise Linux 6 Redhat Enterprise Linux 5 Paloaltonetworks PAN-OS 8.1.3 Paloaltonetworks PAN-OS 8.1.2 Paloaltonetworks PAN-OS 8.1.1 Paloaltonetworks PAN-OS 8.1 Paloaltonetworks PAN-OS 8.0.12 Paloaltonetworks PAN-OS 8.0.9 Paloaltonetworks PAN-OS 8.0.8 Paloaltonetworks PAN-OS 8.0.2 Paloaltonetworks PAN-OS 8.0.1 Paloaltonetworks PAN-OS 7.1.19 Paloaltonetworks PAN-OS 7.1.16 Paloaltonetworks PAN-OS 7.1.12 Paloaltonetworks PAN-OS 7.1.11 Paloaltonetworks PAN-OS 7.1.9 Paloaltonetworks PAN-OS 7.1.5 Paloaltonetworks PAN-OS 7.1.4 Paloaltonetworks PAN-OS 7.1.3 Paloaltonetworks PAN-OS 7.1.2 Paloaltonetworks PAN-OS 7.1.1 Paloaltonetworks PAN-OS 7.1 Paloaltonetworks PAN-OS 6.1.18 Paloaltonetworks PAN-OS 6.1.16 Paloaltonetworks PAN-OS 6.1.15 Paloaltonetworks PAN-OS 6.1.14 Paloaltonetworks PAN-OS 6.1.12 Paloaltonetworks PAN-OS 6.1.11 Paloaltonetworks PAN-OS 6.1.10 Paloaltonetworks PAN-OS 6.1.9 Paloaltonetworks PAN-OS 6.1.4 Paloaltonetworks PAN-OS 6.1.3 Paloaltonetworks PAN-OS 8.0.7 Paloaltonetworks PAN-OS 8.0.6 Paloaltonetworks PAN-OS 8.0.5 Paloaltonetworks PAN-OS 8.0.4 Paloaltonetworks PAN-OS 8.0.3 Paloaltonetworks PAN-OS 8.0.11 Paloaltonetworks PAN-OS 8.0.10 Paloaltonetworks PAN-OS 7.1.8 Paloaltonetworks PAN-OS 7.1.7 Paloaltonetworks PAN-OS 7.1.6 Paloaltonetworks PAN-OS 7.1.18 Paloaltonetworks PAN-OS 7.1.17 Paloaltonetworks PAN-OS 7.1.14 Paloaltonetworks PAN-OS 7.1.13 Paloaltonetworks PAN-OS 7.1.10 Paloaltonetworks PAN-OS 6.1.20 Paloaltonetworks PAN-OS 6.1.2 Paloaltonetworks PAN-OS 6.1.19 Paloaltonetworks PAN-OS 6.1.17 Paloaltonetworks PAN-OS 6.1.13 Oracle Solaris 11.4 Oracle PeopleSoft Enterprise PeopleTools 8.57 Oracle PeopleSoft Enterprise PeopleTools 8.56 Oracle PeopleSoft Enterprise PeopleTools 8.55 Oracle OSS Support Tools 18.3 Oracle OSS Support Tools 18.2 Oracle Linux 7 Oracle Linux 6.0 Oracle JD Edwards EnterpriseOne Tools 9.2 Oracle Enterprise Manager Base Platform 13.2.0.0 Oracle Enterprise Manager Base Platform 12.1.0.5 Oracle Endeca Server 7.7.0 Oracle Endeca Server 7.6.1.0.0 OpenSSL Project OpenSSL 1.1 OpenSSL Project OpenSSL 1.0.2 OpenSSL Project OpenSSL 1.1.0g OpenSSL Project OpenSSL 1.1.0f OpenSSL Project OpenSSL 1.1.0e OpenSSL Project OpenSSL 1.1.0d OpenSSL Project OpenSSL 1.1.0c OpenSSL Project OpenSSL 1.1.0b OpenSSL Project OpenSSL 1.1.0a OpenSSL Project OpenSSL 1.0.2n OpenSSL Project OpenSSL 1.0.2m OpenSSL Project OpenSSL 1.0.2l OpenSSL Project OpenSSL 1.0.2k OpenSSL Project OpenSSL 1.0.2j OpenSSL Project OpenSSL 1.0.2i OpenSSL Project OpenSSL 1.0.2h OpenSSL Project OpenSSL 1.0.2g OpenSSL Project OpenSSL 1.0.2f OpenSSL Project OpenSSL 1.0.2e OpenSSL Project OpenSSL 1.0.2d OpenSSL Project OpenSSL 1.0.2c OpenSSL Project OpenSSL 1.0.2b OpenSSL Project OpenSSL 1.0.2a IBM Vios 2.2 IBM BigFix Platform 9.5.9 IBM BigFix Platform 9.5.8 IBM BigFix Platform 9.5.7 IBM BigFix Platform 9.5.6 IBM BigFix Platform 9.5.5 IBM BigFix Platform 9.5.4 IBM BigFix Platform 9.5.2 IBM BigFix Platform 9.2.14 IBM BigFix Platform 9.2.12 IBM BigFix Platform 9.2.10 IBM BigFix Platform 9.2.9 IBM BigFix Platform 9.2.8 IBM BigFix Platform 9.2.6 IBM BigFix Platform 9.5 IBM BigFix Platform 9.2 IBM Aix 7.2 IBM AIX 7.1 IBM AIX 6.1 IBM AIX 5.3 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 ia-30 Debian Linux 6.0 arm Debian Linux 6.0 amd64 Debian Linux 6
Not Vulnerable:	Paloaltonetworks PAN-OS 8.1.4 Paloaltonetworks PAN-OS 8.0.14 Paloaltonetworks PAN-OS 7.1.21 Oracle OSS Support Tools 18.4 OpenSSL Project OpenSSL 1.1.0h OpenSSL Project OpenSSL 1.0.2o IBM BigFix Platform 9.5.10 IBM BigFix Platform 9.2.15

OpenSSL CVE-2018-0739 Denial of Service Vulnerability

OpenSSL is prone to denial-of-service vulnerability.

An attacker can exploit this issue to cause a denial-of-service condition.

OpenSSL CVE-2018-0739 Denial of Service Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

OpenSSL CVE-2018-0739 Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

OpenSSL CVE-2018-0739 Denial of Service Vulnerability

References:

• OpenSSL Homepage (OpenSSL)
  
• BigFix Platform 9.5.x / 9.2.x affected by multiple vulnerabilities (IBM)
  
• OpenSSL Security Advisory [27 Mar 2018] (OpenSSL )
  
• OpenSSL Vulnerabilities in PAN-OS (PAN-SA-2018-0015) (Palo Alto Networks)
  
• Oracle Critical Patch Update Advisory - October 2018 (Oracle)
  
• Oracle Linux Bulletin - October 2018 (Oracle)
  
• Oracle Solaris Third Party Bulletin - January 2019 (Oracle)
  
• Security Bulletin: Vulnerability in OpenSSL affects AIX (CVE-2018-0739) (IBM)