How to Fix CVE-2022-3602 and CVE-2022-3786- The Two New Buffer Overflow Vulnerabilities in OpenSSL

On 1st November, OpenSSL published an advisory that talks about two high-severity vulnerabilities in its software library. The vulnerabilities in OpenSSL allow attackers to carry out buffer overflow attacks on the system, which let OpenSSL crash that may eventually create a denial of service-like condition on the victim machine running the vulnerable version of OpenSSL or could allow attackers to carry out remote code execution on the machine on which vulnerable versions of OpenSSL are installed. Both the flaws have been tracking with the CVE IDs CVE-2022-3602 and CVE-2022-3786 are steamed from the ossl_punycode_decode function, a function that provides decoding functionality of Punycode domain names, have gotten the CVSS score of 7.5, which is considered High severity on the CVSSv3 scale. Since these flaws allow attackers to crash the OpenSSL and create a Denial of Service like condition and perform remote code execution on the machines running vulnerable OpenSSL releases, it is highly important to know how to fix CVE-2022-3602 and CVE-2022-3786, the two new buffer overflow vulnerabilities in OpenSSL.

There are a few aspects you should understand before we jump in to know how to fix CVE-2022-3602 and CVE-2022-3786, the two new buffer overflow vulnerabilities in OpenSSL. Let’s see about OpenSSL, Punycode, the role of Punycode decode function in OpenSSL, a summary of the vulnerabilities, few technical details about the version prone to the vulnerabilities in this post.

A short note about OpenSSL

OpenSSL is a software library that provides an open-source implementation of the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. It is a general-purpose cryptography library that provides a wide range of security-related features, including support for SSL/TLS, cryptographic hashing, and digital signatures. It also includes a number of utility programs that can be used to generate keys, create and verify digital signatures, and encrypt and decrypt files.

OpenSSL is available for a wide variety of platforms, including Linux, Windows, and macOS. It can be used with a wide variety of programming languages, including C, C++, Java, and Python. The library is licensed under Apache License 2.0. This means that it is free to use for both commercial and non-commercial purposes. If you are looking for a robust and versatile SSL/TLS library, then OpenSSL is definitely worth considering.

If we talk about its establishment, OpenSSL was originally developed by Eric A. Young and Tim J. Hudson in the early 1990s and managed by a worldwide community of volunteers who contribute their time and expertise to produce the highest quality software possible.

A short note about Punycode

Punycode is a special encoding used to represent Unicode characters in ASCII. It is often used for internationalized domain names (IDNs). It is a very efficient encoding and can represent any Unicode character in just a few ASCII characters. If you need to represent Unicode characters in an ASCII-compatible way, then Punycode is definitely the way to go.

The Role of Punycode Decode Function in OpenSSL

OpenSSL uses ossl_punycode_decode function to convert the Punycode domain to Unicode. When there is a need to validate a client or server is configured to validate an X.509 certificate, OpenSSL invokes ossl_punycode_decode function, which takes a string buffer of a Punycode domain and converts it to Unicode for further processing.

Summary of CVE-2022-3602 and CVE-2022-3786:

Both are new buffer overflow vulnerabilities in OpenSSL which can be triggered during X.509 certificate verification. The flaw persists in the implementation of ossl_punycode_decode function in OpenSSL used to convert Punycode domain to Unicode during the validation of an X.509 certificate. The flaw allows remote attackers to execute arbitrary code on the machine running the vulnerable version of OpenSSL just by using a malicious TSL certificate. The only thing it requires to exploit is a malicious TLS certificate signed by a trusted CA.

The flaws affect both Clients and Servers. However, we could say that the flaws primarily affect Clients then Servers since the certificate verification is typically done on the client side. As we said, these two new buffer overflow vulnerabilities in OpenSSL could also be used to exploit the TLS servers through TLS Client Authentication.

Since certificate verification is typically done on the client side, this vulnerability primarily affects clients not servers. There is a case where servers could be exploited via TLS Client Authentication, which may bypass the CA signing requirements as client certs are usually not required to be signed by a trusted CA. Since client authentication is rare ,and most servers do not have it enabled, server exploitation should be low risk.

– Malwaretech

An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.’ character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.

– Viktor Dukhovni.

These flaws allows attackers to exploit the victim just by directing client to a malicious TLS server which uses a specially crafted certificate.

CVSS Break Up of CVE-2022-3602:

Associated CVE ID	CVE-2022-3602
Description	A Buffer Overflow Vulnerabilities in OpenSSL
Associated ZDI ID	–
CVSS Score	7.5 High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Impact Score	3.6
Exploitability Score	3.9
Attack Vector (AV)	Network
Attack Complexity (AC)	Low
Privilege Required (PR)	None
User Interaction (UI)	None
Scope	Unchanged
Confidentiality (C)	None
Integrity (I)	None
availability (a)	High

CVSS Break Up of CVE-2022-3786:

Associated CVE ID	CVE-2022-3786
Description	A Buffer Overflow Vulnerabilities in OpenSSL
Associated ZDI ID	–
CVSS Score	7.5 High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Impact Score	3.6
Exploitability Score	3.9
Attack Vector (AV)	Network
Attack Complexity (AC)	Low
Privilege Required (PR)	None
User Interaction (UI)	None
Scope	Unchanged
Confidentiality (C)	None
Integrity (I)	None
availability (a)	High

OpenSSL Versions Vulnerable To CVE-2022-3602 and CVE-2022-3786:

Both the vulnerabilities CVE-2022-3602 and CVE-2022-3786 affect only OpenSSL v3.x, that is, version from 3.0.0 to 3.0.6. OpenSSL v1.x are safe. Users of v1.x are not needed to take any actions against these two new buffer overflow vulnerabilities in OpenSSL.

All the standard Linux distributions such as CentOS, Fedora, Kali, Linux Mint, openSUSE Leap, and Ubuntu, docker images, macOS, and Windows operating systems which are running the vulnerable versions of OpenSSL are prone to the vulnerabilities and need to fix CVE-2022-3602 and CVE-2022-3786 vulnerabilities on them.

Affected Versions:

• OpenSSL 3.0.0
• OpenSSL 3.0.1
• OpenSSL 3.0.2
• OpenSSL 3.0.3
• OpenSSL 3.0.4
• OpenSSL 3.0.5
• OpenSSL 3.0.6

Not Affected Versions:

• OpenSSL 1.1.1
• OpenSSL 1.1.0
• OpenSSL 1.0.2
• OpenSSL 1.0.1
• LibreSSL

How to Check OpenSSL Version?

We recommend checking the version of OpenSSL on your servers and fix these two new buffer overflow vulnerabilities in OpenSSL as soon as possible. You can run this simple command to check the OpenSSL version on your machine.

$ openssl versio

If you are working in a large organization where you need to check the OpenSSL version on a large number of servers. MalwareTech has published a Bash and a PowerShell script to scan the OpenSSL version on Linux and Windows operating systems.

Linux scanner (Bash Script): https://github.com/MalwareTech/SpookySSLTools/blob/main/openssl_scan.sh

Windows scanner (PowerShell): https://github.com/MalwareTech/SpookySSLTools/blob/main/openssl_scan.ps1

How To Fix CVE-2022-3602 and CVE-2022-3786- The Two New Buffer Overflow Vulnerabilities in OpenSSL?

OpenSSL addresses both the vulnerabilities in its new releases. OpenSSL has rolled out the patched with the release of v3.0.7. All the users of vulnerable OpenSSL are suggested to find out the current version of OpenSSL on their machines and upgrade to v3.0.7 as suggested by the Vendor.

Patched OpenSSL Version:

• OpenSSL 3.0.7

How To Fix The OpenSSL Error Loading Shared Libraries?

Some people would get an error in loading shared libraries. If you are one among those with such bad luck, if you see this error “openssl: error while loading shared libraries: libssl.so.3: cannot open shared object file: No such file or directory“, then this section is for you.

1. Edit ld.conf file to add a line containing /usr/local/lib64

$ sudo nano /etc/ld.so.conf.d/lib.conf
/usr/local/lib64

OR

2. Sometimes, openssl is installed at /usr/local/ssl. Create a file and add a line containing /usr/local/ssl/lib64

$ sudo nano /etc/ld.so.conf.d/openssl.conf
/usr/local/ssl/lib64

Update the library paths upon adding the path to the file

$ sudo ldconfig

Check the OpenSSL version.

$ openssl version
OpenSSL 3.0.5 5 Jul 2022 (Library: OpenSSL 3.0.5 5 Jul 2022)

We hope this post will help you know how to fix CVE-2022-3602 and CVE-2022-3786, the two new buffer overflow vulnerabilities in OpenSSL. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, & Medium and subscribe to receive updates like this. 

• 12 Best Security Settings in Windows 11
• What Is A Buffer Overflow Attack
• How to Protect Your Private NPM Packages Being Exposed Using NPM API Timing Attack
• How To Create A Certificate Signing Request On A Linux Server?
• How To Set Up A Certificate Authority On Ubuntu Using OpenSSL?