rpms/openssl097a/devel openssl-0.9.7a-cve-2006-2937.patch, NONE, 1.1 openssl-0.9.7a-cve-2006-2940.patch, NONE, 1.1 openssl-0.9.8b-cve-2006-3738.patch, NONE, 1.1 openssl-0.9.8b-cve-2006-4343.patch, NONE, 1.1 openssl097a.spec, 1.11, 1.12
fedora-cvs-commits at redhat.com
fedora-cvs-commits at redhat.com
Mon Oct 2 09:07:28 UTC 2006
Author: tmraz
Update of /cvs/dist/rpms/openssl097a/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv23578
Modified Files:
openssl097a.spec
Added Files:
openssl-0.9.7a-cve-2006-2937.patch
openssl-0.9.7a-cve-2006-2940.patch
openssl-0.9.8b-cve-2006-3738.patch
openssl-0.9.8b-cve-2006-4343.patch
Log Message:
* Mon Oct 2 2006 Tomas Mraz <tmraz at redhat.com> 0.9.7a-9
- fix CVE-2006-2937 - mishandled error on ASN.1 parsing (#207276)
- fix CVE-2006-2940 - parasitic public keys DoS (#207274)
- fix CVE-2006-3738 - buffer overflow in SSL_get_shared_ciphers (#206940)
- fix CVE-2006-4343 - sslv2 client DoS (#206940)
openssl-0.9.7a-cve-2006-2937.patch:
tasn_dec.c | 1 +
1 files changed, 1 insertion(+)
--- NEW FILE openssl-0.9.7a-cve-2006-2937.patch ---
Dr S N Henson of the OpenSSL core team and Open Network Security
recently developed an ASN1 test suite for NISCC (www.niscc.gov.uk). When
the test suite was run against OpenSSL two denial of service
vulnerabilities were discovered.
During the parsing of certain invalid ASN1 structures an error
condition is mishandled. This can result in an infinite loop which
consumes system memory. CVE-2006-2938
Any code which uses OpenSSL to parse ASN1 data from untrusted sources is
affected. This includes SSL servers which enable client authentication
and S/MIME applications.
This issue affects 0.9.7 and 0.9.8 but not 0.9.6 and earlier
--- openssl-0.9.7a/crypto/asn1/tasn_dec.c.asn1-error 2006-09-25 13:57:45.000000000 +0200
+++ openssl-0.9.7a/crypto/asn1/tasn_dec.c 2006-09-25 13:59:57.000000000 +0200
@@ -628,6 +628,7 @@
ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ERR_R_NESTED_ASN1_ERROR);
return 0;
} else if(ret == -1) return -1;
+ ret = 0;
/* SEQUENCE, SET and "OTHER" are left in encoded form */
if((utype == V_ASN1_SEQUENCE) || (utype == V_ASN1_SET) || (utype == V_ASN1_OTHER)) {
/* Clear context cache for type OTHER because the auto clear when
openssl-0.9.7a-cve-2006-2940.patch:
dh/dh.h | 3 +++
dh/dh_err.c | 1 +
dh/dh_key.c | 6 ++++++
dsa/dsa.h | 4 ++++
dsa/dsa_err.c | 2 ++
dsa/dsa_ossl.c | 12 ++++++++++++
rsa/rsa.h | 6 ++++++
rsa/rsa_eay.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
rsa/rsa_err.c | 1 +
9 files changed, 79 insertions(+)
--- NEW FILE openssl-0.9.7a-cve-2006-2940.patch ---
Dr S N Henson of the OpenSSL core team and Open Network Security
recently developed an ASN1 test suite for NISCC (www.niscc.gov.uk). When
the test suite was run against OpenSSL two denial of service
vulnerabilities were discovered.
Certain types of public key can take disproportionate amounts of time
to process. This could be used by an attacker in a denial of service attack.
CVE-2006-2940
Any code which uses OpenSSL to parse ASN1 data from untrusted sources is
affected. This includes SSL servers which enable client authentication,
and S/MIME applications.
--- openssl-0.9.7a/crypto/dsa/dsa_ossl.c.parasitic 2006-09-25 14:13:50.000000000 +0200
+++ openssl-0.9.7a/crypto/dsa/dsa_ossl.c 2006-09-25 14:13:50.000000000 +0200
@@ -275,6 +275,18 @@
return -1;
}
+ if (BN_num_bits(dsa->q) != 160)
+ {
+ DSAerr(DSA_F_DSA_DO_VERIFY,DSA_R_BAD_Q_VALUE);
+ return -1;
+ }
+
+ if (BN_num_bits(dsa->p) > OPENSSL_DSA_MAX_MODULUS_BITS)
+ {
+ DSAerr(DSA_F_DSA_DO_VERIFY,DSA_R_MODULUS_TOO_LARGE);
+ return -1;
+ }
+
BN_init(&u1);
BN_init(&u2);
BN_init(&t1);
--- openssl-0.9.7a/crypto/dsa/dsa_err.c.parasitic 2002-03-09 19:24:08.000000000 +0100
+++ openssl-0.9.7a/crypto/dsa/dsa_err.c 2006-09-25 14:13:50.000000000 +0200
@@ -85,8 +85,10 @@
static ERR_STRING_DATA DSA_str_reasons[]=
{
+{DSA_R_BAD_Q_VALUE ,"bad q value"},
{DSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE ,"data too large for key size"},
{DSA_R_MISSING_PARAMETERS ,"missing parameters"},
+{DSA_R_MODULUS_TOO_LARGE ,"modulus too large"},
{0,NULL}
};
--- openssl-0.9.7a/crypto/dsa/dsa.h.parasitic 2006-09-25 14:13:50.000000000 +0200
+++ openssl-0.9.7a/crypto/dsa/dsa.h 2006-09-25 14:13:50.000000000 +0200
@@ -79,6 +79,8 @@
# include <openssl/dh.h>
#endif
+#define OPENSSL_DSA_MAX_MODULUS_BITS 10000
+
#define DSA_FLAG_CACHE_MONT_P 0x01
#define DSA_FLAG_NO_EXP_CONSTTIME 0x02 /* new with 0.9.7h; the built-in DSA
* implementation now uses constant time
@@ -248,8 +250,10 @@
#define DSA_F_SIG_CB 114
/* Reason codes. */
+#define DSA_R_BAD_Q_VALUE 102
#define DSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE 100
#define DSA_R_MISSING_PARAMETERS 101
+#define DSA_R_MODULUS_TOO_LARGE 103
#ifdef __cplusplus
}
--- openssl-0.9.7a/crypto/rsa/rsa_eay.c.parasitic 2006-09-25 14:18:00.000000000 +0200
+++ openssl-0.9.7a/crypto/rsa/rsa_eay.c 2006-09-28 11:05:46.000000000 +0200
@@ -160,6 +160,28 @@
unsigned char *buf=NULL;
BN_CTX *ctx=NULL;
+ if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS)
+ {
+ RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_MODULUS_TOO_LARGE);
+ return -1;
+ }
+
+ if (BN_ucmp(rsa->n, rsa->e) <= 0)
+ {
+ RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE);
+ return -1;
+ }
+
+ /* for large moduli, enforce exponent limit */
+ if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS)
+ {
+ if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS)
+ {
+ RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE);
+ return -1;
+ }
+ }
+
BN_init(&f);
BN_init(&ret);
if ((ctx=BN_CTX_new()) == NULL) goto err;
@@ -542,6 +564,28 @@
unsigned char *buf=NULL;
BN_CTX *ctx=NULL;
+ if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS)
+ {
+ RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_MODULUS_TOO_LARGE);
+ return -1;
+ }
+
+ if (BN_ucmp(rsa->n, rsa->e) <= 0)
+ {
+ RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE);
+ return -1;
+ }
+
+ /* for large moduli, enforce exponent limit */
+ if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS)
+ {
+ if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS)
+ {
+ RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE);
+ return -1;
+ }
+ }
+
BN_init(&f);
BN_init(&ret);
ctx=BN_CTX_new();
--- openssl-0.9.7a/crypto/rsa/rsa_err.c.parasitic 2006-09-25 14:13:50.000000000 +0200
+++ openssl-0.9.7a/crypto/rsa/rsa_err.c 2006-09-25 14:13:50.000000000 +0200
@@ -116,6 +116,7 @@
{RSA_R_INVALID_MESSAGE_LENGTH ,"invalid message length"},
{RSA_R_IQMP_NOT_INVERSE_OF_Q ,"iqmp not inverse of q"},
{RSA_R_KEY_SIZE_TOO_SMALL ,"key size too small"},
+{RSA_R_MODULUS_TOO_LARGE ,"modulus too large"},
{RSA_R_NULL_BEFORE_BLOCK_MISSING ,"null before block missing"},
{RSA_R_N_DOES_NOT_EQUAL_P_Q ,"n does not equal p q"},
{RSA_R_OAEP_DECODING_ERROR ,"oaep decoding error"},
--- openssl-0.9.7a/crypto/rsa/rsa.h.parasitic 2006-09-25 14:13:50.000000000 +0200
+++ openssl-0.9.7a/crypto/rsa/rsa.h 2006-09-25 14:13:50.000000000 +0200
@@ -150,6 +150,11 @@
BN_BLINDING *blinding;
};
+#define OPENSSL_RSA_MAX_MODULUS_BITS 16384
+
+#define OPENSSL_RSA_SMALL_MODULUS_BITS 3072
+#define OPENSSL_RSA_MAX_PUBEXP_BITS 64 /* exponent limit enforced for "large" modulus only */
+
#define RSA_3 0x3L
#define RSA_F4 0x10001L
@@ -344,6 +349,7 @@
#define RSA_R_INVALID_MESSAGE_LENGTH 131
#define RSA_R_IQMP_NOT_INVERSE_OF_Q 126
#define RSA_R_KEY_SIZE_TOO_SMALL 120
+#define RSA_R_MODULUS_TOO_LARGE 105
#define RSA_R_NULL_BEFORE_BLOCK_MISSING 113
#define RSA_R_N_DOES_NOT_EQUAL_P_Q 127
#define RSA_R_OAEP_DECODING_ERROR 121
--- openssl-0.9.7a/crypto/dh/dh.h.parasitic 2006-09-25 14:13:50.000000000 +0200
+++ openssl-0.9.7a/crypto/dh/dh.h 2006-09-25 14:13:50.000000000 +0200
@@ -70,6 +70,8 @@
#include <openssl/crypto.h>
#include <openssl/ossl_typ.h>
+#define OPENSSL_DH_MAX_MODULUS_BITS 10000
+
#define DH_FLAG_CACHE_MONT_P 0x01
#define DH_FLAG_NO_EXP_CONSTTIME 0x02 /* new with 0.9.7h; the built-in DH
* implementation now uses constant time
@@ -207,6 +209,7 @@
/* Reason codes. */
#define DH_R_BAD_GENERATOR 101
#define DH_R_NO_PRIVATE_VALUE 100
+#define DH_R_MODULUS_TOO_LARGE 103
#ifdef __cplusplus
}
--- openssl-0.9.7a/crypto/dh/dh_key.c.parasitic 2006-09-25 14:13:50.000000000 +0200
+++ openssl-0.9.7a/crypto/dh/dh_key.c 2006-09-25 14:15:51.000000000 +0200
@@ -178,6 +178,12 @@
BIGNUM *tmp;
int ret= -1;
+ if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS)
+ {
+ DHerr(DH_F_DH_COMPUTE_KEY,DH_R_MODULUS_TOO_LARGE);
+ return -1;
+ }
+
ctx = BN_CTX_new();
if (ctx == NULL) goto err;
BN_CTX_start(ctx);
--- openssl-0.9.7a/crypto/dh/dh_err.c.parasitic 2002-03-20 17:02:45.000000000 +0100
+++ openssl-0.9.7a/crypto/dh/dh_err.c 2006-09-25 14:13:50.000000000 +0200
@@ -79,6 +79,7 @@
{
{DH_R_BAD_GENERATOR ,"bad generator"},
{DH_R_NO_PRIVATE_VALUE ,"no private value"},
+{DH_R_MODULUS_TOO_LARGE ,"modulus too large"},
{0,NULL}
};
openssl-0.9.8b-cve-2006-3738.patch:
s3_srvr.c | 2 +-
ssl_lib.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- NEW FILE openssl-0.9.8b-cve-2006-3738.patch ---
Tavis Ormandy and Will Drewry of the Google Security Team discovered a buffer
overflow in SSL_get_shared_ciphers utility function, used by some
applications such as exim and mysql. An attacker could send a list of
ciphers that would overrun a buffer CVE-2006-3738
--- ssl/ssl_lib.c 2005-10-01 00:38:20.000000000 +0100
+++ ssl/ssl_lib.c 2006-08-28 19:08:37.401404000 +0100
@@ -1219,7 +1219,7 @@ char *SSL_get_shared_ciphers(const SSL *
c=sk_SSL_CIPHER_value(sk,i);
for (cp=c->name; *cp; )
{
- if (len-- == 0)
+ if (len-- <= 0)
{
*p='\0';
return(buf);
--- ssl/s3_srvr.c 2005-10-01 00:38:20.000000000 +0100
+++ ssl/s3_srvr.c 2006-08-28 19:16:39.313556000 +0100
@@ -2017,7 +2017,7 @@ int ssl3_get_client_key_exchange(SSL *s)
if (kssl_ctx->client_princ)
{
- int len = strlen(kssl_ctx->client_princ);
+ size_t len = strlen(kssl_ctx->client_princ);
if ( len < SSL_MAX_KRB5_PRINCIPAL_LENGTH )
{
s->session->krb5_client_princ_len = len;
openssl-0.9.8b-cve-2006-4343.patch:
s2_clnt.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletion(-)
--- NEW FILE openssl-0.9.8b-cve-2006-4343.patch ---
Tavis Ormandy and Will Drewry of the Google Security Team discovered a
possible DoS in the sslv2 client code. Where a client application uses
OpenSSL to make a SSLv2 connection to a malicious server that server
could cause the client to crash. CVE-2006-4343
--- ssl/s2_clnt.c 2005-08-06 00:52:07.000000000 +0100
+++ ssl/s2_clnt.c 2006-08-28 19:14:59.398605000 +0100
@@ -520,7 +520,8 @@ static int get_server_hello(SSL *s)
CRYPTO_add(&s->session->peer->references, 1, CRYPTO_LOCK_X509);
}
- if (s->session->peer != s->session->sess_cert->peer_key->x509)
+ if (s->session->sess_cert == NULL
+ || s->session->peer != s->session->sess_cert->peer_key->x509)
/* can't happen */
{
ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
Index: openssl097a.spec
===================================================================
RCS file: /cvs/dist/rpms/openssl097a/devel/openssl097a.spec,v
retrieving revision 1.11
retrieving revision 1.12
diff -u -r1.11 -r1.12
--- openssl097a.spec 5 Sep 2006 13:08:29 -0000 1.11
+++ openssl097a.spec 2 Oct 2006 09:07:26 -0000 1.12
@@ -21,7 +21,7 @@
Summary: The OpenSSL toolkit
Name: openssl097a
Version: 0.9.7a
-Release: 8
+Release: 9
Source: openssl-%{version}-usa.tar.bz2
Source1: hobble-openssl
Source2: Makefile.certificate
@@ -67,6 +67,11 @@
Patch46: openssl-0.9.7a-dsa-consttime.patch
Patch47: openssl-0.9.7a-can-2005-2969.patch
Patch49: openssl-0.9.7a-cve-2006-4339.patch
+Patch50: openssl-0.9.7a-cve-2006-2937.patch
+Patch51: openssl-0.9.7a-cve-2006-2940.patch
+Patch52: openssl-0.9.8b-cve-2006-3738.patch
+Patch53: openssl-0.9.8b-cve-2006-4343.patch
+
License: BSDish
Group: System Environment/Libraries
URL: http://www.openssl.org/
@@ -169,6 +174,10 @@
%patch46 -p1 -b .dsa-consttime
%patch47 -p0 -b .ssl2-rollback
%patch49 -p1 -b .short-padding
+%patch50 -p1 -b .asn1-error
+%patch51 -p1 -b .parasitic
+%patch52 -p0 -b .shared-ciphers
+%patch53 -p0 -b .client-dos
# Modify the various perl scripts to reference perl in the right location.
perl util/perlpath.pl `dirname %{__perl}`
@@ -399,6 +408,12 @@
%postun -p /sbin/ldconfig
%changelog
+* Mon Oct 2 2006 Tomas Mraz <tmraz at redhat.com> 0.9.7a-9
+- fix CVE-2006-2937 - mishandled error on ASN.1 parsing (#207276)
+- fix CVE-2006-2940 - parasitic public keys DoS (#207274)
+- fix CVE-2006-3738 - buffer overflow in SSL_get_shared_ciphers (#206940)
+- fix CVE-2006-4343 - sslv2 client DoS (#206940)
+
* Tue Sep 9 2006 Tomas Mraz <tmraz at redhat.com> 0.9.7a-8
- fix CVE-2006-4339 - prevent attack on PKCS#1 v1.5 signatures (#205180)
More information about the fedora-cvs-commits
mailing list