ARM mbed TLS up to 1.3.13/2.1.2 Session Ticket Name memory corruption

Summaryinfo

A vulnerability was found in ARM mbed TLS up to 1.3.13/2.1.2. It has been rated as critical. This issue affects some unknown processing of the component Session Ticket Name Handler. The manipulation leads to memory corruption. This vulnerability is referenced as CVE-2015-8036. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in ARM mbed TLS up to 1.3.13/2.1.2. This issue affects an unknown function of the component Session Ticket Name Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long session ticket name to the session ticket extension, which is not properly handled when creating a ClientHello message to resume a session. NOTE: this identifier was SPLIT from CVE-2015-5291 per ADT3 due to different affected version ranges.

The weakness was published 11/02/2015 (Website). It is possible to read the advisory at tls.mbed.org. The identification of this vulnerability is CVE-2015-8036 since 11/02/2015. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 88602 , which helps to determine the existence of the flaw in a target environment. The commercial vulnerability scanner Qualys is able to test this issue with plugin 175621 (Debian Security Update for polarssl (DSA 3468-1)).

Upgrading to version 1.3.14 or 2.1.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (88602). Similar entry is available at VDB-78990. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• ARM mbed TLS

Version

• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3
• 1.3.4
• 1.3.5
• 1.3.6
• 1.3.7
• 1.3.8
• 1.3.9
• 1.3.10
• 1.3.11
• 1.3.12
• 1.3.13
• 2.1.0
• 2.1.1
• 2.1.2

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion