Juniper Junos OS: Multiple vulnerabilities in OpenSSL (JSA10305)

Description

Several vulnerabilities have been identified in OpenSSL software. The following details are provided by the OpenSSL Project: Certain ASN.1 encodings that are rejected as invalid by the parser can trigger a bug in the deallocation of the corresponding data structure, corrupting the stack. This vulnerability can be exploited to generate a denial-of-service attack. Currently, it is not known whether this can be exploited to run arbitrary code on the router or server. Under certain circumstances, unusual ASN.1 tag values can cause an out of bounds read, resulting in a DoS vulnerability. If the certificate verification code is set to ignore public key decoding errors, a malformed key in a certificate can cause the code to exit abnormally. Public key decoding errors are not normally ignored, except for debugging purposes, so this issue should not affect production code. Exploitation of an affected application would result in a denial of service vulnerability. Because of an error in the SSL/TLS protocol handling, a server will process the contents of a certificate contained in a client's response, even if a certificate was not specifically requested by the server. While this is not, strictly speaking, a vulnerability, it does mean that all SSL/TLS servers that use OpenSSL can be attacked by exploiting the three vulnerabilities listed above even if they don't enable client authentication.