Arch Linux Security Advisory ASA-201410-6 ========================================= Severity: High Date : 2014-10-16 CVE-ID : CVE-2014-3513, CVE-2014-3566, CVE-2014-3567, CVE-2014-3568 Package : openssl Type : Denial of service, Man-in-the-middle Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package openssl before version 1.0.1.j-1 is vulnerable to a remote denial of service via two different memory leaks. In addition to that, it fails to properly disable the SSLv3 protocol when building with the no-ssl3 option, thus leaving openssl vulnerable to the POODLE attack on SSLv3. This new version adds support for TLS_FALLBACK_SCSV to allow applications to block the ability for a MITM attacker to force a protocol downgrade, as exploited on the POODLE attack. Resolution ========== Upgrade to 1.0.1.j-1. # pacman -Syu "openssl>=1.0.1.j-1" The problem has been fixed upstream in version 1.0.1j. Workaround ========== The SRTP memory leak described in CVE-2014-3513 can be mitigated by building openssl with the OPENSSL_NO_SRTP option enabled. The POODLE attack can be avoided by disabling the use of SSLv3, or at least the downgrade of failed TLS connections to SSLv3. There is no workaround for the other leak or the no-ssl3 compile-time option. Description =========== SRTP Memory Leak (CVE-2014-3513) -------------------------------- A flaw in the DTLS SRTP extension parsing code allows an attacker, who sends a carefully crafted handshake message, to cause OpenSSL to fail to free up to 64k of memory causing a memory leak. This could be exploited in a Denial Of Service attack. This issue affects OpenSSL 1.0.1 server implementations for both SSL/TLS and DTLS regardless of whether SRTP is used or configured. Implementations of OpenSSL that have been compiled with OPENSSL_NO_SRTP defined are not affected. Session Ticket Memory Leak (CVE-2014-3567) ------------------------------------------ When an OpenSSL SSL/TLS/DTLS server receives a session ticket the integrity of that ticket is first verified. In the event of a session ticket integrity check failing, OpenSSL will fail to free memory causing a memory leak. By sending a large number of invalid session tickets an attacker could exploit this issue in a Denial Of Service attack. Build option no-ssl3 is incomplete (CVE-2014-3568) -------------------------------------------------- When OpenSSL is configured with "no-ssl3" as a build option, servers could accept and complete a SSL 3.0 handshake, and clients could be configured to send them. SSL 3.0 Fallback protection --------------------------- OpenSSL has added support for TLS_FALLBACK_SCSV to allow applications to block the ability for a MITM attacker to force a protocol downgrade. Some client applications (such as browsers) will reconnect using a downgraded protocol to work around interoperability bugs in older servers. This could be exploited by an active man-in-the-middle to downgrade connections to SSL 3.0 even if both sides of the connection support higher protocols. SSL 3.0 contains a number of weaknesses including POODLE (CVE-2014-3566). Impact ====== The two memory leaks allow a remote, non-authenticated attacker to cause a denial of service. The no-ssl3 option error may prevent administrator from effectively disable SSLv3. The POODLE attack may allow an active attacker to decipher the content of an SSL connection, such as the content of a session cookie. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3513 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3566 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3567 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3568 https://www.openssl.org/news/secadv_20141015.txt https://www.openssl.org/~bodo/ssl-poodle.pdf https://www.imperialviolet.org/2014/10/14/poodle.html