Systems Affected

  • Applications and systems that use the OpenSSL SSL/TLS library

Overview

Several vulnerabilities in the OpenSSL SSL/TLS library could allow an unauthenticated, remote attacker to cause a denial of service.

Description

OpenSSL implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols and includes a general purpose cryptographic library. SSL and TLS are commonly used to provide authentication, encryption, integrity, and non-repudiation services to network applications including HTTP, IMAP, POP3, SMTP, and LDAP. OpenSSL is widely deployed across a variety of platforms and systems. In particular, many routers and other types of networking equipment use OpenSSL.

The U.K. National Infrastructure Security Co-ordination Centre (NISCC) and the OpenSSL Project have reported three vulnerabilities in the OpenSSL SSL/TLS library (libssl). Any application or system that uses this library may be affected.

VU#288574 – OpenSSL contains null-pointer assignment in do_change_cipher_spec() function

Versions of OpenSSL from 0.9.6c to 0.9.6k inclusive and 0.9.7a to 0.9.7c inclusive contain a null-pointer assignment in the do_change_cipher_spec() function. By performing a specially crafted SSL/TLS handshake, an attacker could cause OpenSSL to crash, which may result in a denial of service in the target application.
(Other resources: OpenSSL Security Advisory (1.), CAN-2004-0079, NISCC/224012/OpenSSL/1)

VU#484726 – OpenSSL does not adequately validate length of Kerberos tickets during SSL/TLS handshake

Versions 0.9.7a, 0.9.7b, and 0.9.7c of OpenSSL do not adequately validate the length of Kerberos tickets (RFC 2712) during an SSL/TLS handshake. OpenSSL is not configured to use Kerberos by default. By performing a specially crafted SSL/TLS handshake with an OpenSSL system configured to use Kerberos, an attacker could cause OpenSSL to crash, which may result in a denial of service in the target application. OpenSSL 0.9.6 is not affected.
(Other resources: OpenSSL Security Advisory (2.), CAN-2004-0112, NISCC/224012/OpenSSL/2)

VU#465542 – OpenSSL does not properly handle unknown message types

OpenSSL prior to version 0.9.6d does not properly handle unknown SSL/TLS message types. An attacker could cause the application using OpenSSL to enter an infinite loop, which may result in a denial of service in the target application. OpenSSL 0.9.7 is not affected.
(Other resources: CAN-2004-0081, NISCC/224012/OpenSSL/3)

Impact

An unauthenticated, remote attacker could cause a denial of service in any application or system that uses a vulnerable OpenSSL SSL/TLS library.

Solution

Upgrade or Apply a patch from your vendor

Upgrade to OpenSSL 0.9.6m or 0.9.7d. Alternatively, upgrade or apply a patch as specified by your vendor. Note that it is necessary to recompile any applications that are statically linked to the OpenSSL SSL/TLS library.

Appendix A. Vendor Information

Multiple vendors are affected by different combinations of these vulnerabilities. For updated information, please see the Systems Affected sections of VU#288574, VU#484726, and VU#465542.

 

Appendix B. References

  • US-CERT Technical Cyber Security Alert TA04-078A – <http://www.us-cert.gov/cas/techalerts/TA04-078A.html>
  • Vulnerability Note VU#288574 – <http://www.kb.cert.org/vuls/id/288574>
  • Vulnerability Note VU#484726 – <http://www.kb.cert.org/vuls/id/484726>
  • Vulnerability Note VU#465542 – <http://www.kb.cert.org/vuls/id/465542>
  • OpenSSL Security Advisory [17 March 2004] – <http://www.openssl.org/news/secadv_20040317.txt>
  • NISCC Vulnerability Advisory 224012 – <http://www.uniras.gov.uk/vuls/2004/224012/index.htm>
  • CAN-2004-0079 – <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0079>
  • CAN-2004-0112 – <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0112>
  • CAN-2004-0081 – <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0081>
  • RFC 2712 Addition of Kerberos Cipher Suites to Transport Layer Security (TLS) – <http://www.ietf.org/rfc/rfc2712.txt>

 


These vulnerabilities were researched and reported by the OpenSSL Project and the U.K. National Infrastructure Security Co-ordination Centre (NISCC).


Feedback can be directed to the authors: Art Manion and Damon Morda.


Revision History

  • March 18, 2004: Initial release
    March 19, 2004: Added CVE CAN references VU# links
     

    Last updated 



Source link

admin

Share
Published by
admin

Recent Posts

Continuing Threats to Home Users

Systems Affected   Continuing Threats to Home Users View Previous Alerts Alert (SA04-079A) Continuing Threats…

1 day ago

Cross-Domain Vulnerability in Outlook Express MHTML Protocol Handler

Systems Affected   Microsoft Windows systems   Overview   A cross-domain vulnerability in the Outlook…

2 days ago

Summary of Windows Security Updates for April 2004

Systems Affected   Systems running Microsoft Windows   Overview   There are multiple vulnerabilities in…

3 days ago

Multiple Vulnerabilities in Microsoft Products

Systems Affected   Microsoft Windows Operating Systems Microsoft Windows Remote Procedure Call (RPC) and Distributed…

4 days ago

Cisco IOS SNMP Message Handling Vulnerability

Systems Affected Cisco routers and switches running vulnerable versions of IOS. Vulnerable IOS versions known…

5 days ago

Vulnerabilities in TCP

Systems Affected Systems that rely on persistent TCP connections, for example routers supporting BGP Overview…

6 days ago

This website uses cookies.