OpenSSL Security Advisory

#1

Post by runesoerensen » Thu, Jul 09, 2015, 12:46 PM UTC

Re: OpenSSL Security Advisory

#2

Post by mykhal » Thu, Jul 09, 2015, 12:47 PM UTC

Changes between 1.0.2c and 1.0.2d [9 Jul 2015]

  *) Alternate chains certificate forgery

     During certificate verfification, OpenSSL will attempt to find an
     alternative certificate chain if the first attempt to build such a chain
     fails. An error in the implementation of this logic can mean that an
     attacker could cause certain checks on untrusted certificates to be
     bypassed, such as the CA flag, enabling them to use a valid leaf
     certificate to act as a CA and "issue" an invalid certificate.

     This issue was reported to OpenSSL by Adam Langley/David Benjamin
     (Google/BoringSSL).
     [Matt Caswell]

Re: OpenSSL Security Advisory

#3

Post by jarofgreen » Thu, Jul 09, 2015, 12:59 PM UTC

In case it's slow:

OpenSSL Security Advisory [9 Jul 2015]

=======================================

Alternative chains certificate forgery (CVE-2015-1793)

======================================================

Severity: High

During certificate verification, OpenSSL (starting from version 1.0.1n and 1.0.2b) will attempt to find an alternative certificate chain if the first attempt to build such a chain fails. An error in the implementation of this logic can mean that an attacker could cause certain checks on untrusted certificates to be bypassed, such as the CA flag, enabling them to use a valid leaf certificate to act as a CA and "issue" an invalid certificate.

This issue will impact any application that verifies certificates including SSL/TLS/DTLS clients and SSL/TLS/DTLS servers using client authentication.

This issue affects OpenSSL versions 1.0.2c, 1.0.2b, 1.0.1n and 1.0.1o.

OpenSSL 1.0.2b/1.0.2c users should upgrade to 1.0.2d OpenSSL 1.0.1n/1.0.1o users should upgrade to 1.0.1p

This issue was reported to OpenSSL on 24th June 2015 by Adam Langley/David Benjamin (Google/BoringSSL). The fix was developed by the BoringSSL project.

Note

====

As per our previous announcements and our Release Strategy (https://www.openssl.org/about/releasestrat.html), support for OpenSSL versions 1.0.0 and 0.9.8 will cease on 31st December 2015. No security updates for these releases will be provided after that date. Users of these releases are advised to upgrade.

References

==========

URL for this Security Advisory: https://www.openssl.org/news/secadv_20150709.txt

Note: the online version of the advisory may be updated with additional details over time.

For details of OpenSSL severity classifications please see: https://www.openssl.org/about/secpolicy.html

Re: OpenSSL Security Advisory

#4

Post by pilif » Thu, Jul 09, 2015, 12:59 PM UTC

> OpenSSL will attempt to find an alternative certificate chain if the first attempt to build such a chain fails

I think the latest big thing I've learned in my career is that trying to fix broken input data silently is always bad. Fixing stuff silently isn't helpful for the callers, it's very difficult to do and it produces additional code which also isn't running in the normal case, so it's much more likely to be broken.

Additionally, your callers will start to depend on your behaviour and suddenly you have what amounts to two separate implementations in your code.

I learned that while blowing up (though don't call exit if you're a library. Please.) is initially annoying for callers, in the end, it will be better for you and your callers because code will be testable, correct and more secure (because there's less of it)

Re: OpenSSL Security Advisory

#5

Post by Mojah » Thu, Jul 09, 2015, 1:03 PM UTC

This appears to be the actual code fix: https://github.com/openssl/openssl/commit/aae41f8c54257d9fa6...

Some more details & patching guide here: https://ma.ttias.be/openssl-cve-2015-1793-man-middle-attack/

Re: OpenSSL Security Advisory

#6

Post by eatonphil » Thu, Jul 09, 2015, 1:06 PM UTC

I've got a few sites using OpenSSL certs; do I need to do anything?

Re: OpenSSL Security Advisory

#7

Post by runesoerensen » Thu, Jul 09, 2015, 1:08 PM UTC

It's worth noting that only releases since June 2015 are affected

Re: OpenSSL Security Advisory

#8

Post by 0x0 » Thu, Jul 09, 2015, 1:11 PM UTC

Debian stable/oldstable is not affected. Only in unstable: https://security-tracker.debian.org/tracker/CVE-2015-1793

Re: OpenSSL Security Advisory

#9

Post by mykhal » Thu, Jul 09, 2015, 1:13 PM UTC

from test/verify_extra_test.c:

    Test for CVE-2015-1793 (Alternate Chains Certificate Forgery)
   
    Chain is as follows:
   
    rootCA (self-signed)
      |
    interCA
      |
    subinterCA       subinterCA (self-signed)
      |                   |
    leaf ------------------
      |
    bad
   
    rootCA, interCA, subinterCA, subinterCA (ss) all have CA=TRUE
    leaf and bad have CA=FALSE
   
    subinterCA and subinterCA (ss) have the same subject name and keys
   
    interCA (but not rootCA) and subinterCA (ss) are in the trusted store
    (roots.pem)
    leaf and subinterCA are in the untrusted list (untrusted.pem)
    bad is the certificate being verified (bad.pem)
   
    Versions vulnerable to CVE-2015-1793 will fail to detect that leaf has
    CA=FALSE, and will therefore incorrectly verify bad

Re: OpenSSL Security Advisory

#10

Post by edwintorok » Thu, Jul 09, 2015, 1:13 PM UTC

Mojah wrote: post #5

This appears to be the actual code fix: https://github.com/openssl/openssl/commit/aae41f8c54257d9fa6... Some more details & patching guide here: https://ma.ttias.be/openssl-cve-2015-1793-man-middle-attack/

This is relevant too: https://github.com/openssl/openssl/commit/2aacec8f4a5ba1b365...