Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
(NetBSD Issues Fix) Re: OpenSSL ASN.1 Parsing Flaws Lets Remote User Crash Applications or Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1007911 |
|
SecurityTracker URL: http://securitytracker.com/id/1007911
|
|
CVE Reference:
CAN-2003-0543, CAN-2003-0544, CAN-2003-0545
(Links to External Site)
|
Date: Oct 9 2003
|
Impact:
Denial of service via network, Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 0.9.7b and prior versions
|
Description:
Several vulnerabilities were reported in the ASN.1 parsing code in OpenSSL. A remote user may be able to cause arbitrary code to be executed on a server application that uses OpenSSL.
It is reported that a remote user can send a specially crafted SSL client certificate containing invalid ASN.1 tag values to trigger a flaw in OpenSSL and cause OpenSSL to crash due to "out of bounds reads" (CVE: CAN-2003-0543 and CAN-2003-0544). These flaws affected 0.9.6 and 0.9.7. The specific impact depends on the application using OpenSSL. The report indicates that the effects against Apache (when using OpenSSL) are "limited" and only cause Apache httpd child processes to crash.
It is also reported that certain ASN.1 encodings detected to be invalid may trigger a double free of the ASN1_TYPE variable, deallocating memory that has already been deallocated (CVE: CAN-2003-0545). This flaw only affects 0.9.7. A remote user may be able to send a specially crafted SSL client certificate to an application that uses OpenSSL to potentially execute arbitrary code. The exact impact depends on how the application uses OpenSSL.
It is also reported that a remote user can specify an invalid public key in a certificate to cause the verify code to crash if the target server is configured to ignore public key decoding errors. The vendor notes that ignoring public key decoding errors is usually only done in debugging situations and not usually in production code. [Editor's note: A CVE number had not yet been assigned to this issue at the time of this entry.]
NISCC is credited with discovering these vulnerabilities.
The vendor reports a fourth related security issue, where an error in the SSL/TLS protocol handling will cause a server to parse a client certificate even when a client certificate is not specifically requested. As a result, any server application that uses OpenSSL can be attacked using the vulnerabilities described above, even if the server application does not enable client authentication.
|
Impact:
A remote user can cause an OpenSSL-based server process to crash.
A remote user can cause arbitrary code to be executed by an OpenSSL-based server process.
In both cases, the specific impact depends on how OpenSSL is used by the server process.
|
Solution:
NetBSD has issued a fix.
For NetBSD-current:
Systems running NetBSD-current dated from before 2003-10-02 should be upgraded to NetBSD-current dated 2003-10-03 or later.
The following directories need to be updated from the netbsd-current CVS branch (aka HEAD):
crypto/dist/openssl
To update from CVS, re-build, and re-install libcrypto and libssl:
# cd src
# cvs update -d -P crypto/dist/openssl
# cd lib/libcrypto
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
# cd ../../lib/libssl
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
For NetBSD 1.6, 1.6.1:
The binary distribution of NetBSD 1.6 and 1.6.1 are vulnerable.
Systems running NetBSD 1.6 sources dated from before 2003-10-02 should be upgraded from NetBSD 1.6 sources dated 2003-10-03 or later.
NetBSD 1.6.2 will include the fix.
The following directories need to be updated from the netbsd-1-6 CVS branch:
crypto/dist/openssl
To update from CVS, re-build, and re-install libcrypto and libssl:
# cd src
# cvs update -d -P -r netbsd-1-6 crypto/dist/openssl
# cd lib/libcrypto
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
# cd ../../lib/libssl
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
For NetBSD 1.5, 1.5.1, 1.5.2, 1.5.3:
The binary distribution of NetBSD 1.5 to 1.5.3 are vulnerable.
Systems running NetBSD 1.5, 1.5.1, 1.5.2, or 1.5.3 sources dated from before 2003-10-03 should be upgraded from NetBSD 1.5.* sources dated 2003-10-04 or later.
The following directories need to be updated from the netbsd-1-5 CVS branch:
crypto/dist/openssl
To update from CVS, re-build, and re-install libcrypto and libssl:
# cd src
# cvs update -d -P -r netbsd-1-5 crypto/dist/openssl
# cd lib/libcrypto
# make cleandir dependall
# make install
# cd ../../lib/libssl
# make cleandir dependall
# make install
|
Vendor URL: www.openssl.org/news/secadv_20030930.txt (Links to External Site)
|
Cause:
Boundary error, Input validation error, State error
|
Underlying OS:
UNIX (NetBSD)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Thu, 9 Oct 2003 15:34:35 -0400
Subject: NetBSD Security Advisory 2003-017: OpenSSL multiple vulnerabilities
|
-----BEGIN PGP SIGNED MESSAGE-----
NetBSD Security Advisory 2003-017
=================================
Topic: OpenSSL multiple vulnerabilities
Version: NetBSD-current: sources prior to October 3, 2003
NetBSD 1.6.1: affected
NetBSD 1.6: affected
NetBSD-1.5.3: affected
NetBSD-1.5.2: affected
NetBSD-1.5.1: affected
NetBSD-1.5: affected
pkgsrc: packages prior to openssl-0.9.6k/0.9.7c
Severity: possible remote code injection
Fixed: NetBSD-current: October 3, 2003
NetBSD-1.6 branch: October 3, 2003 (1.6.2 will include the fix)
NetBSD-1.5 branch: October 4, 2003
pkgsrc: openssl-0.9.6k/0.9.7c corrects the issue
Abstract
========
OpenSSL had multiple vulnerabilities, they were found by tests performed
by NISCC (www.niscc.gov.uk).
- - ASN.1 decoder could overrun its stack if a malicious X.509 certificate
is received
- - malfomed X.509 certificates could cause crashes under certain
circumstances
The vulnerability can be attacked remotely, even if SSL client
authentication is not enabled.
Note that OpenSSH is not affected by this issue, as it does not use the
OpenSSL ASN.1 decoder.
Technical Details
=================
http://www.securityfocus.com/archive/1/339623/2003-09-27/2003-10-03/0
http://www.uniras.gov.uk/vuls/2003/006489/openssl.htm
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0545
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0543
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0544
Solutions and Workarounds
=========================
A rebuild of libcrypto and libssl is necessary. If you have installed
any program that statically links one of those libraries, it must be
rebuilt too.
If you have daemons that use those libraries, any running instances must
be restarted. A reboot after replacing libcrypto/libssl is recommended.
The following instructions describe how to upgrade your libcrypto/libssl
binaries by updating your source tree and rebuilding and
installing a new version of libcrypto/libssl.
* NetBSD-current:
Systems running NetBSD-current dated from before 2003-10-02
should be upgraded to NetBSD-current dated 2003-10-03 or later.
The following directories need to be updated from the
netbsd-current CVS branch (aka HEAD):
crypto/dist/openssl
To update from CVS, re-build, and re-install libcrypto and libssl:
# cd src
# cvs update -d -P crypto/dist/openssl
# cd lib/libcrypto
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
# cd ../../lib/libssl
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
* NetBSD 1.6, 1.6.1:
The binary distribution of NetBSD 1.6 and 1.6.1 are vulnerable.
Systems running NetBSD 1.6 sources dated from before
2003-10-02 should be upgraded from NetBSD 1.6 sources dated
2003-10-03 or later.
NetBSD 1.6.2 will include the fix.
The following directories need to be updated from the
netbsd-1-6 CVS branch:
crypto/dist/openssl
To update from CVS, re-build, and re-install libcrypto and libssl:
# cd src
# cvs update -d -P -r netbsd-1-6 crypto/dist/openssl
# cd lib/libcrypto
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
# cd ../../lib/libssl
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
* NetBSD 1.5, 1.5.1, 1.5.2, 1.5.3:
The binary distribution of NetBSD 1.5 to 1.5.3 are vulnerable.
Systems running NetBSD 1.5, 1.5.1, 1.5.2, or 1.5.3 sources dated
from before 2003-10-03 should be upgraded from NetBSD 1.5.*
sources dated 2003-10-04 or later.
The following directories need to be updated from the
netbsd-1-5 CVS branch:
crypto/dist/openssl
To update from CVS, re-build, and re-install libcrypto and libssl:
# cd src
# cvs update -d -P -r netbsd-1-5 crypto/dist/openssl
# cd lib/libcrypto
# make cleandir dependall
# make install
# cd ../../lib/libssl
# make cleandir dependall
# make install
Thanks To
=========
Matthias Scheler
Revision History
================
2003-10-09 Initial release
More Information
================
Advisories may be updated as new information becomes available.
The most recent version of this advisory (PGP signed) can be found at
ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2003-017.txt.asc
Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.org/ and http://www.NetBSD.org/Security/.
Copyright 2003, The NetBSD Foundation, Inc. All Rights Reserved.
Redistribution permitted only in full, unmodified form.
$NetBSD: NetBSD-SA2003-017.txt,v 1.4 2003/10/09 19:29:53 david Exp $
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (NetBSD)
Comment: For info see http://www.gnupg.org
iQCVAwUBP4W4BD5Ru2/4N2IFAQEahgP/RZlrcFp0r97dBrOFC4z1P+wB+vjMjpyg
pegiadLOcZzrvUmPyR1R+cNsOHHzSnjk92wAkSoN/Ua/WJTRY2eZaf3rGqPuulHL
Yltbo3NRmphG+xq4hrwRuuiO8/fcIG7YPb1KSe3ym6IGI1ZYCTHRKgUKWeZISXQM
HXNygVnafQQ=
=GJ76
-----END PGP SIGNATURE-----
|
|
Go to the Top of This SecurityTracker Archive Page
|
