(NetBSD Issues Fix) OpenSSL Invalid TLS/DTLS Record Processing Lets Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1027136 |
|
SecurityTracker URL: http://securitytracker.com/id/1027136
|
|
CVE Reference:
CVE-2012-2333
(Links to External Site)
|
Date: Jun 8 2012
|
Impact:
Denial of service via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): prior to versions 0.9.8x, 1.0.0j, 1.0.1c
|
Description:
A vulnerability was reported in OpenSSL. A remote user can cause denial of service conditions.
A remote user can send specially crafted TLS/DTLS records to cause denial of service conditions.
The CBC mode ciphersuites in TLS 1.1, 1.2 and DTLS are affected
Both clients and servers are affected.
DTLS is affected in all versions of OpenSSL.
TLS is affected in OpenSSL version 1.0.1 and later.
Codenomicon reported this vulnerability.
|
Impact:
A remote user can cause denial of service conditions.
|
Solution:
NetBSD has issued a fix.
The NetBSD advisory is available at:
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2012-002.txt.asc
|
Vendor URL: www.openssl.org/news/secadv_20120510.txt (Links to External Site)
|
Cause:
Input validation error, State error
|
Underlying OS:
UNIX (NetBSD)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Fri, 08 Jun 2012 06:22:27 +0000
Subject: http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2012-002.txt.asc
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
NetBSD Security Advisory 2012-002
=================================
Topic: OpenSSL Invalid TLS/DTLS record attack
Version: NetBSD-current: source prior to May 12th, 2012
NetBSD 6.0 Beta: affected
NetBSD 5.0.*: affected
NetBSD 5.0: affected
NetBSD 5.1: affected
NetBSD 4.0.*: affected
NetBSD 4.0: affected
Severity: remote DoS
Fixed: NetBSD-current: May 11th, 2012
NetBSD 6.0 Beta: May 22nd, 2012
NetBSD-5-0 branch: May 22nd, 2012
NetBSD-5-1 branch: May 22nd, 2012
NetBSD-5 branch: May 22nd, 2012
NetBSD-4-0 branch: May 22nd, 2012
NetBSD-4 branch: May 22nd, 2012
Please note that NetBSD releases prior to 4.0 are no longer supported.
It is recommended that all users upgrade to a supported release.
Abstract
========
Citing http://www.openssl.org/news/secadv_20120510.txt:
A flaw in the OpenSSL handling of CBC mode ciphersuites in TLS 1.1, 1.2 and
DTLS can be exploited in a denial of service attack on both clients and
servers.
DTLS applications are affected in all versions of OpenSSL. TLS is only
affected in OpenSSL 1.0.1 and later.
TLS is thus affected in NetBSD-6 and -current.
This vulnerability has been assigned CVE-2012-2333
Technical Details
=================
When receiving TLS or DTLS packets, OpenSSL first subtracts the
number of padding bytes from the record size. Next, it subtracts
the size of a data structure used to initialize CBC encryption modes;
in the vulnerable version without checking the remaining size of
the record, allowing to result in negative values that re-map into
rather large record size and consequently buffer over-read and
segfault.
Solutions and Workarounds
=========================
Patch, recompile, and reinstall the library.
src/crypto/external/bsd/openssl/dist/ssl/d1_enc.c
CVS branch Rev.
HEAD 1.2
netbsd-6 1.1.1.3.4.1
src/crypto/dist/openssl/ssl/d1_enc.c
CVS branch Rev.
netbsd-5 1.1.1.3.4.1
netbsd-5-0 1.1.1.3.8.1
netbsd-5-1 1.1.1.3.12.1
netbsd-4 1.1.1.2.4.1
netbsd-4-0 1.1.1.2.14.1
src/crypto/external/bsd/openssl/dist/ssl/t1_enc.c
CVS branch Rev.
HEAD 1.4
netbsd-6 1.3.4.1
Thanks To
=========
Thanks to Codenomicon for discovering and Stephen Henson of the
OpenSSL core team for fixing this issue.
Revision History
================
2012-06-06 Initial release
More Information
================
Advisories may be updated as new information becomes available.
The most recent version of this advisory (PGP signed) can be found at
http://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2012-002.txt.asc
Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.org/ and http://www.NetBSD.org/Security/ .
Copyright 2012, The NetBSD Foundation, Inc. All Rights Reserved.
Redistribution permitted only in full, unmodified form.
$NetBSD: NetBSD-SA2012-002.txt,v 1.2 2012/06/06 19:46:15 tonnerre Exp $
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBAgAGBQJPz7P/AAoJEAZJc6xMSnBuqSoP/22Y7NVE7UUMqExQS3uLL5+g
cpM7TqagKTj2asjTravEHdmW8q6Exli4rYNGBoU3D6tWC1w/Zcoo6LHqI1IXjjTC
qRsMdjxkPsn64MLKlc48j+ofXeM63Wir7RzqhwrBaf0Lqj4LB/PTK40/B+VTGpCo
somraDXR1XvrmJKc2W6GcC92906r1kM9FJ0OOk6btO2PZxk4eOP3moZ3WRvYyOZz
0W4RJOBWN0w93qNY5mRi106RRjNMFFJHd6p7Fq5SsZJ59/VBXn76NQt4umJVlsKK
ArY06lPkNsxCu6Oak+qWM2efHARez772TXaRrR+/SHcnLuETAWRuQpNYGobU5HrJ
bgYqmlzxIEThGOp2fenh1a4GTZmuMBbh6kOFXsJdOsJPST8Rbmq5XYZRSbBwX5E/
Jw7JjM8h45dH1ORWWSqH2KVwEOlztcmwv04XroUX7kr0+upPudCw50k0EF90Bope
n3qzA4LDnAY8DiSS1b8SVynt1A0B03bvf9oZ1d85duijBSuNPUD3MDUsdUdt41lq
ilz6k2V6OqwDCo83KsZX5FX8x2rCxohexPO3UwgexuDm3oUlWKs2Yw9Q+0gFx0F4
vaAkfS9QP+5CDiJYmxWr5lyyFg+cIbCIryhvCFvdNyp0IfqhD7+EjGJHJZm3YfqQ
V2BSsFuRc+b2/T7yQKCI
=8ttV
-----END PGP SIGNATURE-----
|
|
