SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (VPN)  >   OpenSSL Vendors:   OpenSSL.org
(IBM Issues Fix) OpenSSL CMS_verify() Error Handling Flaw Lets Users Bypass Security Checks
SecurityTracker Alert ID:  1022200
SecurityTracker URL:  http://securitytracker.com/id/1022200
CVE Reference:   CVE-2009-0591   (Links to External Site)
Date:  May 11 2009
Impact:   Modification of system information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 0.9.8h - 0.9.8j
Description:   A vulnerability was reported in OpenSSL. A remote user can bypass certain security checks.

A remote user with access to a signer's private key can generate a specially crafted signature that is not valid but will be detected as valid. The vulnerability resides in the CMS_verify() function in the handling of an error condition with specially crafted signed attributes.

Only CMS users are affected.

Ivan Nestlerode reported this vulnerability.

Impact:   A remote user can create an invalid signature that will be determined to be a valid signature.
Solution:   IBM has issued a fix for AIX (OpenSSL AIX version 0.9.8.803), available at:

https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=aixbp

The IBM advisory is available at:

http://aix.software.ibm.com/aix/efixes/security/ssl_advisory.asc

Vendor URL:  www.openssl.org/news/secadv_20090325.txt (Links to External Site)
Cause:   Authentication error, State error
Underlying OS:   UNIX (AIX)

Message History:   This archive entry is a follow-up to the message listed below.
Mar 25 2009 OpenSSL CMS_verify() Error Handling Flaw Lets Users Bypass Security Checks



 Source Message Contents

Date:  Mon, 11 May 2009 15:45:58 -0400
Subject:  IBM AIX



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

IBM SECURITY ADVISORY

First Issued: Mon May 11 10:36:12 CDT 2009

The most recent version of this document is available here:

http://aix.software.ibm.com/aix/efixes/security/ssl_advisory.asc
or
ftp://aix.software.ibm.com/aix/efixes/security/ssl_advisory.asc

VULNERABILITY SUMMARY

VULNERABILITY: AIX OpenSSL 0.9.8.803 with Security Patches

PLATFORMS: AIX 5.2, 5.3, 6.1

SOLUTION: Apply the fix as described below.

THREAT: See below

CERT VU Number: n/a
CVE Numbers: CVE-2009-0590 CVE-2009-0591 CVE-2009-0789

DETAILED INFORMATION

I. DESCRIPTION

Three moderate severity security flaws have been fixed in OpenSSL
0.9.8k. The AIX version number is 0.9.8.803.

The function ASN1_STRING_print_ex() when used to print a BMPString
or UniversalString will crash with an invalid memory access if the
encoded length of the string is illegal. (CVE-2009-0590)

The function CMS_verify() does not correctly handle an error
condition involving malformed signed attributes. This will cause
an invalid set of signed attributes to appear valid and content
digests will not be checked. (CVE-2009-0591)

When a malformed ASN1 structure is received it's contents are
freed up and zeroed and an error condition returned. On a small
number of platforms where sizeof(long) < sizeof(void *) (for
example WIN64) this can cause an invalid memory access later
resulting in a crash when some invalid structures are read, for
example RSA public keys (CVE-2009-0789).

For more information about the three flaws, please visit:

http://www.openssl.org//news/secadv_20090325.txt

II. PLATFORM VULNERABILITY ASSESSMENT

To determine if your system is vulnerable, execute the following
command:

lslpp -L openssl.base

The following fileset levels are vulnerable:

AIX 6.1: all versions less than 0.9.8.803
AIX 5.3: all versions less than 0.9.8.803
AIX 5.2: all versions less than 0.9.8.803

III. FIXES

A fix is available, and it can be downloaded from:

https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=aixbp

IV. WORKAROUNDS

There are no workarounds.

V. CONTACT INFORMATION

If you would like to receive AIX Security Advisories via email,
please visit:

http://www.ibm.com/systems/support

and click on the "My notifications" link.

To view previously issued advisories, please visit:

http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd

Comments regarding the content of this announcement can be
directed to:

security-alert@austin.ibm.com

To obtain the PGP public key that can be used to communicate
securely with the AIX Security Team you can either:

A. Download the key from our web page:

http://www.ibm.com/systems/resources/systems_p_os_aix_security_pgpkey.txt

B. Download the key from a PGP Public Key Server. The key ID is:

0xADA6EB4D

Please contact your local IBM AIX support center for any
assistance.

eServer is a trademark of International Business Machines
Corporation. IBM, AIX and pSeries are registered trademarks of
International Business Machines Corporation. All other trademarks
are property of their respective holders.

VI. ACKNOWLEDGEMENTS

For acknowledgements and more information please visit:

http://www.openssl.org//news/secadv_20090325.txt

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (AIX)

iD8DBQFKCFCaP9Qud62m600RAsAGAJ40bn9SUTAC9w1LufJ8BiAG6qnVNQCeOYs3
Cv27/3phuxgiaJN7loNKFuA=
=Qr0P
-----END PGP SIGNATURE-----

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC