SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   OpenSSL Vendors:   OpenSSL.org
(OpenBSD Adds Fix for OpenBSD 3.4) Re: OpenSSL ASN.1 Parsing Flaws Lets Remote User Crash Applications or Execute Arbitrary Code
SecurityTracker Alert ID:  1008054
SecurityTracker URL:  http://securitytracker.com/id/1008054
CVE Reference:   CVE-2003-0543, CVE-2003-0544, CVE-2003-0545   (Links to External Site)
Date:  Oct 31 2003
Impact:   Denial of service via network, Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 0.9.7b and prior versions
Description:   Several vulnerabilities were reported in the ASN.1 parsing code in OpenSSL. A remote user may be able to cause arbitrary code to be executed on a server application that uses OpenSSL. OpenBSD's ssl(3) is reportedly affected.

It is reported that a remote user can send a specially crafted SSL client certificate containing invalid ASN.1 tag values to trigger a flaw in OpenSSL and cause OpenSSL to crash due to "out of bounds reads" (CVE: CVE-2003-0543 and CVE-2003-0544). These flaws affected 0.9.6 and 0.9.7. The specific impact depends on the application using OpenSSL. The report indicates that the effects against Apache (when using OpenSSL) are "limited" and only cause Apache httpd child processes to crash.

It is also reported that certain ASN.1 encodings detected to be invalid may trigger a double free of the ASN1_TYPE variable, deallocating memory that has already been deallocated (CVE: CVE-2003-0545). This flaw only affects 0.9.7. A remote user may be able to send a specially crafted SSL client certificate to an application that uses OpenSSL to potentially execute arbitrary code. The exact impact depends on how the application uses OpenSSL.

It is also reported that a remote user can specify an invalid public key in a certificate to cause the verify code to crash if the target server is configured to ignore public key decoding errors. The vendor notes that ignoring public key decoding errors is usually only done in debugging situations and not usually in production code. [Editor's note: A CVE number had not yet been assigned to this issue at the time of this entry.]

NISCC is credited with discovering these vulnerabilities.

The vendor reports a fourth related security issue, where an error in the SSL/TLS protocol handling will cause a server to parse a client certificate even when a client certificate is not specifically requested. As a result, any server application that uses OpenSSL can be attacked using the vulnerabilities described above, even if the server application does not enable client authentication.

Impact:   A remote user can cause an OpenSSL-based server process to crash.

A remote user can cause arbitrary code to be executed by an OpenSSL-based server process.

In both cases, the specific impact depends on how OpenSSL is used by the server process.

Solution:   OpenBSD has issued a fix for OpenBSD 3.4:

ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/002_asn1.patch

The following fixes were previously issued for 3.3 and 3.2:

ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.2/common/020_asn1.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/007_asn1.patch

Vendor URL:  www.openssl.org/news/secadv_20030930.txt (Links to External Site)
Cause:   Boundary error, Input validation error, State error
Underlying OS:  UNIX (OpenBSD)
Underlying OS Comments:  OpenBSD 3.2, 3.3, 3.4

Message History:   This archive entry is a follow-up to the message listed below.
Sep 30 2003 OpenSSL ASN.1 Parsing Flaws Lets Remote User Crash Applications or Execute Arbitrary Code



 Source Message Contents

Subject:  OpenBSD ssl(3)


 > SECURITY FIX: OctoberNovember 1, 2003
 > The use of certain ASN.1 encodings or malformed public keys may allow an attacker
 > to mount a denial of service attack against applications linked with ssl(3). This
 > does not affect OpenSSH.
 >
 > A source code patch exists which remedies the problem.

ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.2/common/020_asn1.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/007_asn1.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/002_asn1.patch


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC