238 lines
10 KiB
Text
238 lines
10 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-16:12.openssl Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: Multiple OpenSSL vulnerabilities
|
|
|
|
Category: contrib
|
|
Module: openssl
|
|
Announced: 2016-03-10
|
|
Credits: OpenSSL Project
|
|
Affects: All supported versions of FreeBSD.
|
|
Corrected: 2016-03-04 00:40:15 UTC (stable/10, 10.2-BETA3)
|
|
2016-03-03 07:30:55 UTC (releng/10.2, 10.2-RELEASE-p13)
|
|
2016-03-03 07:30:55 UTC (releng/10.1, 10.1-RELEASE-p30)
|
|
2016-03-10 03:58:48 UTC (stable/9, 9.3-STABLE)
|
|
2016-03-10 10:03:28 UTC (releng/9.3, 9.3-RELEASE-p38)
|
|
CVE Name: CVE-2016-0702, CVE-2016-0703, CVE-2016-0704, CVE-2016-0705
|
|
CVE-2016-0797, CVE-2016-0798, CVE-2016-0799, CVE-2016-0800
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:https://security.FreeBSD.org/>.
|
|
|
|
I. Background
|
|
|
|
FreeBSD includes software from the OpenSSL Project. The OpenSSL Project is
|
|
a collaborative effort to develop a robust, commercial-grade, full-featured
|
|
Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3)
|
|
and Transport Layer Security (TLS v1) protocols as well as a full-strength
|
|
general purpose cryptography library.
|
|
|
|
II. Problem Description
|
|
|
|
A cross-protocol attack was discovered that could lead to decryption of TLS
|
|
sessions by using a server supporting SSLv2 and EXPORT cipher suites as a
|
|
Bleichenbacher RSA padding oracle. Note that traffic between clients and
|
|
non-vulnerable servers can be decrypted provided another server supporting
|
|
SSLv2 and EXPORT ciphers (even with a different protocol such as SMTP, IMAP
|
|
or POP3) shares the RSA keys of the non-vulnerable server. This vulnerability
|
|
is known as DROWN. [CVE-2016-0800]
|
|
|
|
A double free bug was discovered when OpenSSL parses malformed DSA private
|
|
keys and could lead to a DoS attack or memory corruption for applications that
|
|
receive DSA private keys from untrusted sources. This scenario is considered
|
|
rare. [CVE-2016-0705]
|
|
|
|
The SRP user database lookup method SRP_VBASE_get_by_user had confusing memory
|
|
management semantics; the returned pointer was sometimes newly allocated, and
|
|
sometimes owned by the callee. The calling code has no way of distinguishing
|
|
these two cases. [CVE-2016-0798]
|
|
|
|
In the BN_hex2bn function, the number of hex digits is calculated using an int
|
|
value |i|. Later |bn_expand| is called with a value of |i * 4|. For large
|
|
values of |i| this can result in |bn_expand| not allocating any memory because
|
|
|i * 4| is negative. This can leave the internal BIGNUM data field as NULL
|
|
leading to a subsequent NULL pointer dereference. For very large values of
|
|
|i|, the calculation |i * 4| could be a positive value smaller than |i|. In
|
|
this case memory is allocated to the internal BIGNUM data field, but it is
|
|
insufficiently sized leading to heap corruption. A similar issue exists in
|
|
BN_dec2bn. This could have security consequences if BN_hex2bn/BN_dec2bn is
|
|
ever called by user applications with very large untrusted hex/dec data. This
|
|
is anticipated to be a rare occurrence. [CVE-2016-0797]
|
|
|
|
The internal |fmtstr| function used in processing a "%s" formatted string in
|
|
the BIO_*printf functions could overflow while calculating the length of
|
|
a string and cause an out-of-bounds read when printing very long strings.
|
|
[CVE-2016-0799]
|
|
|
|
A side-channel attack was found which makes use of cache-bank conflicts on the
|
|
Intel Sandy-Bridge microarchitecture which could lead to the recovery of RSA
|
|
keys. [CVE-2016-0702]
|
|
|
|
s2_srvr.c did not enforce that clear-key-length is 0 for non-export ciphers.
|
|
If clear-key bytes are present for these ciphers, they displace encrypted-key
|
|
bytes. [CVE-2016-0703]
|
|
|
|
s2_srvr.c overwrites the wrong bytes in the master key when applying
|
|
Bleichenbacher protection for export cipher suites. [CVE-2016-0704]
|
|
|
|
III. Impact
|
|
|
|
Servers that have SSLv2 protocol enabled are vulnerable to the "DROWN" attack
|
|
which allows a remote attacker to fast attack many recorded TLS connections
|
|
made to the server, even when the client did not make any SSLv2 connections
|
|
themselves.
|
|
|
|
An attacker who can supply malformed DSA private keys to OpenSSL applications
|
|
may be able to cause memory corruption which would lead to a Denial of
|
|
Service condition. [CVE-2016-0705]
|
|
|
|
An attacker connecting with an invalid username can cause memory leak, which
|
|
could eventually lead to a Denial of Service condition. [CVE-2016-0798]
|
|
|
|
An attacker who can inject malformed data into an application may be able
|
|
to cause memory corruption which would lead to a Denial of Service
|
|
condition. [CVE-2016-0797, CVE-2016-0799]
|
|
|
|
A local attacker who has control of code in a thread running on the same
|
|
hyper-threaded core as the victim thread which is performing decryptions
|
|
could recover RSA keys. [CVE-2016-0702]
|
|
|
|
An eavesdropper who can intercept SSLv2 handshake can conduct an efficient
|
|
divide-and-conquer key recovery attack and use the server as an oracle to
|
|
determine the SSLv2 master-key, using only 16 connections to the server
|
|
and negligible computation. [CVE-2016-0703]
|
|
|
|
An attacker can use the Bleichenbacher oracle, which enables more efficient
|
|
variant of the DROWN attack. [CVE-2016-0704]
|
|
|
|
IV. Workaround
|
|
|
|
No workaround is available.
|
|
|
|
V. Solution
|
|
|
|
Perform one of the following:
|
|
|
|
1) Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date.
|
|
|
|
Restart all deamons using the library, or reboot the system.
|
|
|
|
2) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
Restart all deamons using the library, or reboot the system.
|
|
|
|
3) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
[FreeBSD 9.3]
|
|
# fetch https://security.FreeBSD.org/patches/SA-16:12/openssl-9.3.patch.xz
|
|
# fetch https://security.FreeBSD.org/patches/SA-16:12/openssl-9.3.patch.xz.asc
|
|
# gpg --verify openssl-9.3.patch.xz.asc
|
|
|
|
Note that the initial patch version contains a serious regression that
|
|
would lead to crash. The following patch must be applied to address it.
|
|
|
|
# fetch https://security.FreeBSD.org/patches/SA-16:12/openssl-9.3-fix.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-16:12/openssl-9.3-fix.patch.asc
|
|
# gpg --verify openssl-9.3-fix.patch.asc
|
|
|
|
[FreeBSD 10.1]
|
|
# fetch https://security.FreeBSD.org/patches/SA-16:12/openssl-10.1.patch.xz
|
|
# fetch https://security.FreeBSD.org/patches/SA-16:12/openssl-10.1.patch.xz.asc
|
|
# gpg --verify openssl-10.1.patch.xz.asc
|
|
|
|
[FreeBSD 10.2]
|
|
# fetch https://security.FreeBSD.org/patches/SA-16:12/openssl-10.2.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-16:12/openssl-10.2.patch.asc
|
|
# gpg --verify openssl-10.2.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile the operating system using buildworld and installworld as
|
|
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
|
|
|
|
Restart all deamons using the library, or reboot the system.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/9/ r296598
|
|
releng/9.3/ r296611
|
|
stable/10/ r296371
|
|
releng/10.1/ r296341
|
|
releng/10.2/ r296341
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
<URL:https://www.openssl.org/news/secadv/20160301.txt>
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0702>
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0703>
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0704>
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0705>
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0797>
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0798>
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0799>
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0800>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-16:12.openssl.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v2.1.11 (FreeBSD)
|
|
|
|
iQIcBAEBCgAGBQJW4UchAAoJEO1n7NZdz2rnNC8P/2YSnc2DaOH37BZXKBKCt2iv
|
|
rzTlQ6Cdr2n3r0k6Ayp1MonEfndWl9d86us6Z5ssfMrNsmJGWZv3Yj1Y8H12HE8+
|
|
ZhHCJ44ZYbyaDSe/vigG1S+xYILKP6uOxJYPWH5lXD9Yr20dHIJ8s3e9Jsai8aY2
|
|
aXMSVz67t84QJUoxAf5yEDsmY2drA5myppkRCRB1Xcb3qVebgwwQ4XkB+rJjjNjg
|
|
rG0DFbTxLnStr/geEDC+WdeAzLH6D035gFRkHL6uIOfOX8UcYNnf4pVXUgymWJzI
|
|
E/su+Cij/ckhV6UuOyNvKgN8uEs5XCny/10LKHqpPDhcYY6L8Dg47rI+2acOdFUi
|
|
5+79rx7+gUs71zC4D6hFCldUqOVpNYDRBYhX+MNqYkLn5XYEffbckv5zSkg53+aE
|
|
Rf1G90VcC+yHRFu2hgCTOGXsayOAJhvCRTnuqLncKpznFSRD+1a3XUm2zS79gfpN
|
|
f/uYIYmPbE1/uCU4StAlemdiH5vhYoWsP8tkBJsL8s6jMbV1REqukPJUPdDSaJmj
|
|
rHLvige7yr1QTWYBQ1ghRXJml+3xDSst/RZzqn+QelsDoUwa1wJa6kc5Ki74eXmi
|
|
XyuklOME8cbfUc8TPLqv4Lqbvr0nGK71jT0M7zG+eQTJsUls5EFBPhWL/6+SU29I
|
|
Lb+5Q4Wn9Qlmxfj0Nm3U
|
|
=f6Cw
|
|
-----END PGP SIGNATURE-----
|