jonathan/openssl
1
0
Fork 0
forked from rpms/openssl
Code Pull Requests Activity

- fix CVE-2006-2937 - mishandled error on ASN.1 parsing (#207276)

Browse Source 
- fix CVE-2006-2940 - parasitic public keys DoS (#207274)
- fix CVE-2006-3738 - buffer overflow in SSL_get_shared_ciphers (#206940)
- fix CVE-2006-4343 - sslv2 client DoS (#206940)
This commit is contained in:
Tomáš Mráz 2006-09-28 19:59:16 +00:00
parent cd294fcd2a
commit 6dc7017559
5 changed files with 285 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
openssl-0.9.8b-cve-2006-2937.patch Normal file
View File

@ -0,0 +1,25 @@
Dr S N Henson of the OpenSSL core team and Open Network Security
recently developed an ASN1 test suite for NISCC (www.niscc.gov.uk). When
the test suite was run against OpenSSL two denial of service
vulnerabilities were discovered.
During the parsing of certain invalid ASN1 structures an error
condition is mishandled. This can result in an infinite loop which
consumes system memory. CVE-2006-2938
Any code which uses OpenSSL to parse ASN1 data from untrusted sources is
affected. This includes SSL servers which enable client authentication
and S/MIME applications.
This issue affects 0.9.7 and 0.9.8 but not 0.9.6 and earlier
--- openssl-0.9.8b/crypto/asn1/tasn_dec.c.asn1-error 2006-02-19 14:45:22.000000000 +0100
+++ openssl-0.9.8b/crypto/asn1/tasn_dec.c 2006-09-25 12:01:14.000000000 +0200
@@ -832,6 +832,7 @@
}
else if (ret == -1)
return -1;
+ ret = 0;
/* SEQUENCE, SET and "OTHER" are left in encoded form */
if ((utype == V_ASN1_SEQUENCE)
|| (utype == V_ASN1_SET) || (utype == V_ASN1_OTHER))

215
openssl-0.9.8b-cve-2006-2940.patch Normal file
View File

@ -0,0 +1,215 @@
Dr S N Henson of the OpenSSL core team and Open Network Security
recently developed an ASN1 test suite for NISCC (www.niscc.gov.uk). When
the test suite was run against OpenSSL two denial of service
vulnerabilities were discovered.
Certain types of public key can take disproportionate amounts of time
to process. This could be used by an attacker in a denial of service attack.
CVE-2006-2940
Any code which uses OpenSSL to parse ASN1 data from untrusted sources is
affected. This includes SSL servers which enable client authentication,
and S/MIME applications.
diff -u -r1.37.2.2 dh.h
--- crypto/dh/dh.h 9 Jan 2006 16:05:22 -0000 1.37.2.2
+++ crypto/dh/dh.h 15 Sep 2006 13:59:47 -0000
@@ -73,6 +73,8 @@
#include <openssl/bn.h>
#endif
+#define OPENSSL_DH_MAX_MODULUS_BITS 10000
+
#define DH_FLAG_CACHE_MONT_P 0x01
#define DH_FLAG_NO_EXP_CONSTTIME 0x02 /* new with 0.9.7h; the built-in DH
* implementation now uses constant time
@@ -221,6 +223,7 @@
/* Reason codes. */
#define DH_R_BAD_GENERATOR 101
#define DH_R_INVALID_PUBKEY 102
+#define DH_R_MODULUS_TOO_LARGE 103
#define DH_R_NO_PRIVATE_VALUE 100
#ifdef __cplusplus
diff -u -r1.11.2.2 dh_err.c
--- crypto/dh/dh_err.c 9 Jan 2006 16:05:22 -0000 1.11.2.2
+++ crypto/dh/dh_err.c 15 Sep 2006 13:59:47 -0000
@@ -84,6 +84,7 @@
{
{ERR_REASON(DH_R_BAD_GENERATOR) ,"bad generator"},
{ERR_REASON(DH_R_INVALID_PUBKEY) ,"invalid public key"},
+{ERR_REASON(DH_R_MODULUS_TOO_LARGE) ,"modulus too large"},
{ERR_REASON(DH_R_NO_PRIVATE_VALUE) ,"no private value"},
{0,NULL}
};
diff -u -r1.24.2.3 dh_key.c
--- crypto/dh/dh_key.c 13 Mar 2006 23:12:06 -0000 1.24.2.3
+++ crypto/dh/dh_key.c 15 Sep 2006 13:59:47 -0000
@@ -179,6 +179,12 @@
int ret= -1;
int check_result;
+ if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS)
+ {
+ DHerr(DH_F_COMPUTE_KEY,DH_R_MODULUS_TOO_LARGE);
+ goto err;
+ }
+
ctx = BN_CTX_new();
if (ctx == NULL) goto err;
BN_CTX_start(ctx);
diff -u -r1.39 dsa.h
--- crypto/dsa/dsa.h 16 May 2005 01:43:30 -0000 1.39
+++ crypto/dsa/dsa.h 15 Sep 2006 13:59:47 -0000
@@ -84,6 +84,8 @@
#endif
#endif
+#define OPENSSL_DSA_MAX_MODULUS_BITS 10000
+
#define DSA_FLAG_CACHE_MONT_P 0x01
#define DSA_FLAG_NO_EXP_CONSTTIME 0x02 /* new with 0.9.7h; the built-in DSA
* implementation now uses constant time
@@ -270,8 +272,10 @@
#define DSA_F_SIG_CB 114
/* Reason codes. */
+#define DSA_R_BAD_Q_VALUE 102
#define DSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE 100
#define DSA_R_MISSING_PARAMETERS 101
+#define DSA_R_MODULUS_TOO_LARGE 103
#ifdef __cplusplus
}
diff -u -r1.13 dsa_err.c
--- crypto/dsa/dsa_err.c 12 Apr 2005 16:15:12 -0000 1.13
+++ crypto/dsa/dsa_err.c 15 Sep 2006 13:59:47 -0000
@@ -89,8 +89,10 @@
static ERR_STRING_DATA DSA_str_reasons[]=
{
+{ERR_REASON(DSA_R_BAD_Q_VALUE) ,"bad q value"},
{ERR_REASON(DSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE),"data too large for key size"},
{ERR_REASON(DSA_R_MISSING_PARAMETERS) ,"missing parameters"},
+{ERR_REASON(DSA_R_MODULUS_TOO_LARGE) ,"modulus too large"},
{0,NULL}
};
diff -u -r1.24.2.1 dsa_ossl.c
--- crypto/dsa/dsa_ossl.c 26 May 2005 04:40:57 -0000 1.24.2.1
+++ crypto/dsa/dsa_ossl.c 15 Sep 2006 13:59:47 -0000
@@ -304,6 +304,18 @@
return -1;
}
+ if (BN_num_bits(dsa->q) != 160)
+ {
+ DSAerr(DSA_F_DSA_DO_VERIFY,DSA_R_BAD_Q_VALUE);
+ return -1;
+ }
+
+ if (BN_num_bits(dsa->p) > OPENSSL_DSA_MAX_MODULUS_BITS)
+ {
+ DSAerr(DSA_F_DSA_DO_VERIFY,DSA_R_MODULUS_TOO_LARGE);
+ return -1;
+ }
+
BN_init(&u1);
BN_init(&u2);
BN_init(&t1);
diff -u -r1.55.2.6 rsa.h
--- crypto/rsa/rsa.h 6 Sep 2006 06:43:25 -0000 1.55.2.6
+++ crypto/rsa/rsa.h 15 Sep 2006 13:59:48 -0000
@@ -159,6 +159,11 @@
BN_BLINDING *mt_blinding;
};
+#define OPENSSL_RSA_MAX_MODULUS_BITS 16384
+
+#define OPENSSL_RSA_SMALL_MODULUS_BITS 3072
+#define OPENSSL_RSA_MAX_PUBEXP_BITS 64 /* exponent limit enforced for "small" modulus only */
+
#define RSA_3 0x3L
#define RSA_F4 0x10001L
@@ -407,6 +412,7 @@
#define RSA_R_IQMP_NOT_INVERSE_OF_Q 126
#define RSA_R_KEY_SIZE_TOO_SMALL 120
#define RSA_R_LAST_OCTET_INVALID 134
+#define RSA_R_MODULUS_TOO_LARGE 105
#define RSA_R_NO_PUBLIC_EXPONENT 140
#define RSA_R_NULL_BEFORE_BLOCK_MISSING 113
#define RSA_R_N_DOES_NOT_EQUAL_P_Q 127
diff -u -r1.46.2.6 rsa_eay.c
--- crypto/rsa/rsa_eay.c 6 Sep 2006 06:43:25 -0000 1.46.2.6
+++ crypto/rsa/rsa_eay.c 15 Sep 2006 13:59:48 -0000
@@ -168,6 +168,28 @@
unsigned char *buf=NULL;
BN_CTX *ctx=NULL;
+ if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS)
+ {
+ RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_MODULUS_TOO_LARGE);
+ return -1;
+ }
+
+ if (BN_ucmp(rsa->n, rsa->e) <= 0)
+ {
+ RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE);
+ return -1;
+ }
+
+ /* for large moduli, enforce exponent limit */
+ if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS)
+ {
+ if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS)
+ {
+ RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE);
+ return -1;
+ }
+ }
+
if ((ctx=BN_CTX_new()) == NULL) goto err;
BN_CTX_start(ctx);
f = BN_CTX_get(ctx);
@@ -597,6 +619,28 @@
unsigned char *buf=NULL;
BN_CTX *ctx=NULL;
+ if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS)
+ {
+ RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_MODULUS_TOO_LARGE);
+ return -1;
+ }
+
+ if (BN_ucmp(rsa->n, rsa->e) <= 0)
+ {
+ RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE);
+ return -1;
+ }
+
+ /* for large moduli, enforce exponent limit */
+ if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS)
+ {
+ if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS)
+ {
+ RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE);
+ return -1;
+ }
+ }
+
if((ctx = BN_CTX_new()) == NULL) goto err;
BN_CTX_start(ctx);
f = BN_CTX_get(ctx);
diff -u -r1.17.2.5 rsa_err.c
--- crypto/rsa/rsa_err.c 6 Sep 2006 06:43:26 -0000 1.17.2.5
+++ crypto/rsa/rsa_err.c 15 Sep 2006 13:59:48 -0000
@@ -137,6 +137,7 @@
{ERR_REASON(RSA_R_IQMP_NOT_INVERSE_OF_Q) ,"iqmp not inverse of q"},
{ERR_REASON(RSA_R_KEY_SIZE_TOO_SMALL) ,"key size too small"},
{ERR_REASON(RSA_R_LAST_OCTET_INVALID) ,"last octet invalid"},
+{ERR_REASON(RSA_R_MODULUS_TOO_LARGE) ,"modulus too large"},
{ERR_REASON(RSA_R_NO_PUBLIC_EXPONENT) ,"no public exponent"},
{ERR_REASON(RSA_R_NULL_BEFORE_BLOCK_MISSING),"null before block missing"},
{ERR_REASON(RSA_R_N_DOES_NOT_EQUAL_P_Q) ,"n does not equal p q"},

27
openssl-0.9.8b-cve-2006-3738.patch Normal file
View File

@ -0,0 +1,27 @@
Tavis Ormandy and Will Drewry of the Google Security Team discovered a buffer
overflow in SSL_get_shared_ciphers utility function, used by some
applications such as exim and mysql. An attacker could send a list of
ciphers that would overrun a buffer CVE-2006-3738
--- ssl/ssl_lib.c 2005-10-01 00:38:20.000000000 +0100
+++ ssl/ssl_lib.c 2006-08-28 19:08:37.401404000 +0100
@@ -1219,7 +1219,7 @@ char *SSL_get_shared_ciphers(const SSL *
c=sk_SSL_CIPHER_value(sk,i);
for (cp=c->name; *cp; )
{
- if (len-- == 0)
+ if (len-- <= 0)
{
*p='\0';
return(buf);
--- ssl/s3_srvr.c 2005-10-01 00:38:20.000000000 +0100
+++ ssl/s3_srvr.c 2006-08-28 19:16:39.313556000 +0100
@@ -2017,7 +2017,7 @@ int ssl3_get_client_key_exchange(SSL *s)
if (kssl_ctx->client_princ)
{
- int len = strlen(kssl_ctx->client_princ);
+ size_t len = strlen(kssl_ctx->client_princ);
if ( len < SSL_MAX_KRB5_PRINCIPAL_LENGTH )
{
s->session->krb5_client_princ_len = len;

17
openssl-0.9.8b-cve-2006-4343.patch Normal file
View File

@ -0,0 +1,17 @@
Tavis Ormandy and Will Drewry of the Google Security Team discovered a
possible DoS in the sslv2 client code. Where a client application uses
OpenSSL to make a SSLv2 connection to a malicious server that server
could cause the client to crash. CVE-2006-4343
--- ssl/s2_clnt.c 2005-08-06 00:52:07.000000000 +0100
+++ ssl/s2_clnt.c 2006-08-28 19:14:59.398605000 +0100
@@ -520,7 +520,8 @@ static int get_server_hello(SSL *s)
CRYPTO_add(&s->session->peer->references, 1, CRYPTO_LOCK_X509);
}
- if (s->session->peer != s->session->sess_cert->peer_key->x509)
+ if (s->session->sess_cert == NULL
+ || s->session->peer != s->session->sess_cert->peer_key->x509)
/* can't happen */
{
ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);

2
openssl.spec
View File

@ -21,7 +21,7 @@
Summary: The OpenSSL toolkit
Name: openssl
Version: 0.9.8b
Release: 6
Release: 7
Source: openssl-%{version}-usa.tar.bz2
Source1: hobble-openssl
Source2: Makefile.certificate