OpenSSL Vulnerabilities in Virtual Appliance on AWS

Products

• CA Identity Suite

Issue/Introduction

The OpenSSL has a vulnerability on vApp running on AWS

Obtained with ssh -v

OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017

MITRE CVE - https://cve.mitre.org:

[CVE-2010-4755] The (1) remote_glob function in sftp-glob.c and the (2) process_put function in sftp.c in OpenSSH 5.8 and earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, OpenBSD 4.7, and other products, allow remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in SSH_FXP_STAT requests to an sftp daemon, a different vulnerability than CVE-2010-2632.

[CVE-1999-0661] A system is running a version of software that was replaced with a Trojan Horse at one of its distribution points, such as (1) TCP Wrappers 7.6, (2) util-linux 2.9g, (3) wuarchive ftpd (wuftpd) 2.2 and 2.1f, (4) IRC client (ircII) ircII 2.2.9, (5) OpenSSH 3.4p1, or (6) Sendmail 8.12.6.

 

 

This vulnerability is not present in Virtual Appliance running on CentOS 8 (VMWare)

Environment

Virtual Appliance 14.4 CP2 on AWS

Cause

The AWS needs to provide a security patch for this vulnerability.

To apply the OS patch you need to use the "updateManager" command

Resolution

For AWS, OS is owned by AWS itself and so we do not provide security updates, only security updates are provided using updateManager. 

Product updates are provided as patches and they can be applied using patch_vapp.