Executive brief
Crypto++ is a widely used software library that provides cryptographic functions for C++ applications. A flaw in how it processes certain data formats (ASN.1 BER) allows an attacker to send a specially crafted message that causes the library to perform excessive memory operations. This results in a denial-of-service condition, making the affected application slow or unresponsive.
Technical details
A vulnerability exists in the ASN.1 BER decoding routine of Crypto++ 5.6.4. The library allocates memory based on the length field of an ASN.1 object before verifying if sufficient content octets are present. When the decoding fails due to missing content, the library proceeds to zero-fill the entire allocated memory block as a security measure. An attacker can exploit this by providing a maliciously large length field, forcing the library to spend significant CPU time zeroing a large, unused memory block, leading to a denial-of-service (DoS). The issue was identified using the 'honggfuzz' fuzzer and affects several BERDecode functions.
Affected products
- Crypto++ Project Crypto++ 5.6.4
Timeline
- 2016-12-12: disclosed: Public discussion on oss-security mailing list
- 2016-12-26: patched: Debian released security update DSA-3748-1
- 2017-01-30: advisory: NVD publication date