ID de Prueba:	1.3.6.1.4.1.25623.1.0.170261
Categoría:	Denial of Service
Título:	Synology Router Manager (SRM) 1.2.x OpenSSL Vulnerability (Synology-SA-22:04)
Resumen:	Synology Router Manager (SRM) is prone to a denial of service; (DoS) vulnerability in OpenSSL.
Descripción:	Summary: Synology Router Manager (SRM) is prone to a denial of service (DoS) vulnerability in OpenSSL. Vulnerability Insight: The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. This might result in a denial of service condition. Affected Software/OS: SRM version 1.2.x. Solution: Update to firmware version 1.3.1-9346 or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2022-0778 https://cert-portal.siemens.com/productcert/pdf/ssa-712929.pdf https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=3118eb64934499d93db3230748a452351d1d9a65 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=380085481c64de749a6dd25cdf0bcf4360b30f83 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a466912611aa6cbdf550cd10601390e587451246 https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0002 https://security.netapp.com/advisory/ntap-20220321-0002/ https://security.netapp.com/advisory/ntap-20220429-0005/ https://support.apple.com/kb/HT213255 https://support.apple.com/kb/HT213256 https://support.apple.com/kb/HT213257 https://www.openssl.org/news/secadv/20220315.txt https://www.tenable.com/security/tns-2022-06 https://www.tenable.com/security/tns-2022-07 https://www.tenable.com/security/tns-2022-08 https://www.tenable.com/security/tns-2022-09 Debian Security Information: DSA-5103 (Google Search) https://www.debian.org/security/2022/dsa-5103 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W6K3PR542DXWLEFFMFIDMME4CWMHJRMG/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/323SNN6ZX7PRJJWP2BUAFLPUAE42XWLZ/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GDB3GQVJPXJE7X5C5JN6JAA4XUDWD6E6/ http://seclists.org/fulldisclosure/2022/May/38 http://seclists.org/fulldisclosure/2022/May/35 http://seclists.org/fulldisclosure/2022/May/33 https://security.gentoo.org/glsa/202210-02 http://packetstormsecurity.com/files/167344/OpenSSL-1.0.2-1.1.1-3.0-BN_mod_sqrt-Infinite-Loop.html https://www.oracle.com/security-alerts/cpuapr2022.html https://www.oracle.com/security-alerts/cpujul2022.html https://lists.debian.org/debian-lts-announce/2022/03/msg00023.html https://lists.debian.org/debian-lts-announce/2022/03/msg00024.html
Copyright	Copyright (C) 2022 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.