LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Advisory Watch: November 21st, 2014
Linux Security Week: November 17th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
NetBSD: openssl cryptographic weakness Print E-mail
User Rating:      How can I rate this item?
Posted by LinuxSecurity.com Team   
NetBSD Attacker can perform crypto operations using server's private keys.

		 NetBSD Security Advisory 2003-007
		 =================================

Topic:		(Another) Encryption weakness in OpenSSL code

Version:	NetBSD-current:	 source prior to March 21, 2003
		NetBSD-1.6.1:	 not affected
		NetBSD-1.6:	 affected
		NetBSD-1.5.3:	 affected
		NetBSD-1.5.2:	 affected
		NetBSD-1.5.1:	 affected
		NetBSD-1.5:	 affected
		NetBSD-1.4*:	 not affected
		pkgsrc:		 prior to openssl-0.9.6gnb2

Severity:	Attacker can perform crypto operations using server's private
		keys.

Fixed:		NetBSD-current:		March 21, 2003
		NetBSD-1.6 branch:	March 21, 2003
		NetBSD-1.5 branch:	March 21, 2003
		pkgsrc:			openssl-0.9.6gnb2


Abstract
========

Quote from bugtraq posting:

    Czech cryptologists Vlastimil Klima, Ondrej Pokorny, and Tomas Rosa
    have come up with an extension of the "Bleichenbacher attack" on RSA
    with PKCS #1 v1.5 padding as used in SSL 3.0 and TLS 1.0.  Their
    attack requires the attacker to open millions of SSL/TLS connections
    to the server under attack; the server's behaviour when faced with
    specially made-up RSA ciphertexts can reveal information that in
    effect allows the attacker to perform a single RSA private key
    operation on a ciphertext of its choice using the server's RSA key.
    Note that the server's RSA key is not compromised in this attack.

No services using SSL/TLS are enabled by default in NetBSD, however, by
enabling services built with these libraries, a system could become
vulnerable to the compromise.

NOTE: Two OpenSSL advisories have appeared within 2 days of each other.
	while the patches affect libssl in this SA, and libcrypto in
	2003-005, please be aware that there are two separate issues
	with separate sets of patches.


Technical Details
=================
 
http://marc.theaimsgroup.com/?l=bugtraq&m=104811162730834&w=2


Solutions and Workarounds
=========================

The following instructions describe how to upgrade your libssl
binaries by updating your source tree and rebuilding and installing
a new version of libssl.

Be sure to restart running instances of programs that use the libssl
library after upgrading.

If you have any statically-linked binaries that linked against a
vulnerable libssl, you need to recompile them.


* NetBSD-current:

	Systems running NetBSD-current dated from before 2003-02-21
	should be upgraded to NetBSD-current dated 2003-02-21 or later.

	The following file needs to be updated from the
	netbsd-current CVS branch (aka HEAD):
		crypto/dist/openssl/ssl/s3_srvr.c

	To update from CVS, re-build, and re-install libssl:
		# cd src
		# cvs update -d -P crypto/dist/openssl/ssl/s3_srvr.c
		# cd lib/libssl
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install


* NetBSD 1.6:

	The binary distribution of NetBSD 1.6 is vulnerable.

	If a source-based point upgrade is required, sources from the
	NetBSD 1.6 branch dated 2003-03-21 or later should be used.

	The following file needs to be updated from the
	netbsd-1-6 CVS branch:
		crypto/dist/openssl/ssl/s3_srvr.c

	To update from CVS, re-build, and re-install libssl:
		# cd src
		# cvs update -d -P -r netbsd-1-6 \
			crypto/dist/openssl/ssl/s3_srvr.c
		# cd lib/libssl
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install


* NetBSD 1.5, 1.5.1, 1.5.2, 1.5.3:

	The binary distribution of NetBSD 1.5.3 is vulnerable.

	Systems running NetBSD-1.5.x dated from before 2003-03-20
	should be upgraded to NetBSD-1.5 branch dated 2003-03-21 or later.

	The following file needs to be updated from the
	netbsd-1-5 CVS branch:
		crypto/dist/openssl/ssl/s3_srvr.c

	To update from CVS, re-build, and re-install libssl:
		# cd src
		# cvs update -d -P -r netbsd-1-5 \
			crypto/dist/openssl/ssl/s3_srvr.c
		# cd lib/libssl
		# make cleandir dependall
		# make install


* NetBSD 1.4, 1.4.1, 1.4.2, 1.4.3:

	OpenSSL was not included in the base system in NetBSD-1.4.*
	Follow the directions for pkgsrc if you have installed it from
	pkgsrc.


* pkgsrc:

	openssl (pkgsrc/security/openssl) prior to openssl-0.9.6gnb2 are
	vulnerable.  Upgrade to openssl-0.9.6gnb2 or later.

	Packages which require openssl can be found by running 'pkg_info
	openssl'. Depending on the method you choose to update pkgsrc
	packages, a rebuild of the packages on that list may be
	performed for you by the package system. If you update using the
	experimental 'make replace' target, you will need to manually
	update any packages which build static binaries with libssl.a.

        If you have statically linked binaries in pkgsrc, they have to be
        rebuilt.  Statically linked binaries can be identified by the
        following command (note: be sure to include the directory you install
        pkgsrc binaries to, if you've changed LOCALBASE from the default of
        /usr/pkg)

                file /usr/pkg/{bin,sbin,libexec}/* | grep static


Thanks To
=========

Bugtraq and the OpenSSL team.


Revision History
================

	2003-03-26	Initial release

More Information
================

An up-to-date PGP signed copy of this release will be maintained at
   ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-007.txt.asc

Information about NetBSD and NetBSD security can be found at 
http://www.NetBSD.ORG/ and  http://www.NetBSD.ORG/Security/.


Copyright 2003, The NetBSD Foundation, Inc.  All Rights Reserved.

$NetBSD: NetBSD-SA2003-007.txt,v 1.5 2003/03/26 05:51:26 david Exp $



 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Google Removes SSLv3 Fallback Support From Chrome
Hacker Lexicon: What Is End-to-End Encryption?
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.