Security operations · 2 MIN READ · AARON WALTON AND JAMES MASKELONY · NOV 3, 2022 · TAGS: MDR
CVE-2022-3602 & CVE-2022-3786: software that uses OpenSSL 3.0.0-3.0.6 should still be upgraded to 3.0.7 as soon as it is reasonable to do so.
What happened?
On November 1, 2022, the OpenSSL Project released version 3.0.7 to address two vulnerabilities affecting OpenSSL version 3.0 and later that they classify as high-severity.
- CVE-2022-3602: “X.509 Email Address 4-byte Buffer Overflow”
- CVE-2022-3786: “X.509 Email Address Variable Length Buffer Overflow”
OpenSSL originally categorized these vulnerabilities as “critical” severity before disclosing them, but they have now downgraded them after determining they’re less dangerous than initially thought.
Why does it matter?
OpenSSL is a widely used open-source encryption library. Its widespread adoption contributed to increased initial concern, as any critical exploit could potentially affect a large number of systems (think Heartbleed level of disruption). However, later information revealed that the affected versions (3.0.0-3.0.6) are relatively new and not as widely adopted as first thought. (When considering severity, it’s important to note that the definitions of “critical” and “high” used by OpenSSL are their own and don’t follow standard categorizations such as the Common Vulnerability Scoring System [CVSS]. These factors are important when calculating the possible impact.)
While CVE-2022-3602 could potentially lead to Remote Code Execution (RCE), the good news is there are several mitigating factors that make successful code execution fairly unlikely on affected systems. According to the OpenSSL notification, exploitation requires either that the attacker have a certificate signed by a trusted Certificate Authority (CA), or that the application would need to ignore certificate verification failures. While this isn’t impossible for attackers, it means the attack takes a lot more work than we first anticipated. On top of that, most systems have a variety of existing security protections against memory attacks. These protections add a layer of complexity to achieving code execution via buffer overflow. The added constraint of only four attacker-controlled bytes further complicates any attack path. Abusing this vulnerability for RCE would require significant development and creation of a complex exploit chain.
The second vulnerability, CVE-2022-3786, also abuses a basic buffer overflow and could be used to cause a denial of service (DoS) and prevent use of the software. Some attackers use DoS in attacks, but such attacks typically don’t earn cash and aren’t as interesting and desirable. That doesn’t mean attackers couldn’t use it, but financially motivated attackers are less likely to rush to do so.
What you should do
While no longer critical, the OpenSSL team still considers these issues to be serious, and software that uses OpenSSL 3.0.0-3.0.6 should still be updated to 3.0.7 as soon as is reasonable.
If you have further questions about this vulnerability or any other threat to your cybersecurity environment, please contact us.
