BSA-2017-201

Brocade Fabric OS

2 more products

21539

31 March 2017

31 March 2017

Closed

High

7.5

N/A

CVE-2016-8610

Summary

Security Advisory ID : BSA-2017-201

Component : OpenSSL

Revision : 1.0: Interim

It was found that function "ssl3_read_bytes" in ssl/s3_pkt.c might lead to higher CPU usage due to improper handling of warning packets.  An attacker could repeat the undefined plaintext warning packets of "SSL3_AL_WARNING" during the handshake, which will cause a 100% CPU usage on the server.  It is an implementation problem in OpenSSL that OpenSSL would ignore undefined warning, and continue dealing with the remaining data (if exist).  So the attacker could pack multiple alerts inside a single record and send a large number of these large records.  Then the server will be fallen in a meaningless cycle, and not available to any others.  BTW, Huzaifa Sidhpurwala from the Red Hat Product Security Team was found that the same issue may also affect gnutls servers.

Affected Products
Product Current Assessment
Brocade 5400 vRouter Impacted: Fixed in 6.7R13.
Brocade 5600 vRouter Impacted: Fixed in 17.2.0.
Brocade Services Director Impacted: Fixed in 2.6.
Brocade SLX-OS Impacted: Fixed in SLXOS 17r.1.00.
Products Confirmed Not Vulnerable

Brocade FastIron OS, Brocade NetIron OS, Brocade Network Advisor, Brocade SDN Controller, Brocade ServerIron ADX, Brocade Virtual ADX, and Brocade Virtual Web Application Firewall are confirmed not affected by this vulnerability.

Workaround

There are no workarounds that address this vulnerability.

Revision History

Version Change Date
1.0 Initial Publication March 31, 2017