[arch-security] [Arch Linux Security Advisory ASA-201410-6] openssl: denial of service / man-in-the-middle / poodle mitigation

[Remi Gacogne]

Arch Linux Security Advisory ASA-201410-6
=========================================

Severity: High
Date    : 2014-10-16
CVE-ID  : CVE-2014-3513, CVE-2014-3566, CVE-2014-3567, CVE-2014-3568
Package : openssl
Type    : Denial of service, Man-in-the-middle
Remote  : Yes
Link    : https://wiki.archlinux.org/index.php/CVE-2014

Summary
=======

The package openssl before version 1.0.1.j-1 is vulnerable to a remote
denial of service via two different memory leaks.
In addition to that, it fails to properly disable the SSLv3 protocol
when building with the no-ssl3 option, thus leaving openssl vulnerable
to the POODLE attack on SSLv3.
This new version adds support for TLS_FALLBACK_SCSV to allow
applications to block the ability for a MITM attacker to force a
protocol downgrade, as exploited on the POODLE attack.

Resolution
==========

Upgrade to 1.0.1.j-1.

# pacman -Syu "openssl>=1.0.1.j-1"

The problem has been fixed upstream in version 1.0.1j.

Workaround
==========

The SRTP memory leak described in CVE-2014-3513 can be mitigated by
building openssl with the OPENSSL_NO_SRTP option enabled.
The POODLE attack can be avoided by disabling the use of SSLv3, or at
least the downgrade of failed TLS connections to SSLv3.
There is no workaround for the other leak or the no-ssl3 compile-time
option.

Description
===========

SRTP Memory Leak (CVE-2014-3513)
--------------------------------

A flaw in the DTLS SRTP extension parsing code allows an attacker, who
sends a carefully crafted handshake message, to cause OpenSSL to fail
to free up to 64k of memory causing a memory leak. This could be
exploited in a Denial Of Service attack. This issue affects OpenSSL
1.0.1 server implementations for both SSL/TLS and DTLS regardless of
whether SRTP is used or configured. Implementations of OpenSSL that
have been compiled with OPENSSL_NO_SRTP defined are not affected.

Session Ticket Memory Leak (CVE-2014-3567)
------------------------------------------

When an OpenSSL SSL/TLS/DTLS server receives a session ticket the
integrity of that ticket is first verified. In the event of a session
ticket integrity check failing, OpenSSL will fail to free memory
causing a memory leak. By sending a large number of invalid session
tickets an attacker could exploit this issue in a Denial Of Service
attack.

Build option no-ssl3 is incomplete (CVE-2014-3568)
--------------------------------------------------

When OpenSSL is configured with "no-ssl3" as a build option, servers
could accept and complete a SSL 3.0 handshake, and clients could be
configured to send them.

SSL 3.0 Fallback protection
---------------------------

OpenSSL has added support for TLS_FALLBACK_SCSV to allow applications
to block the ability for a MITM attacker to force a protocol
downgrade.

Some client applications (such as browsers) will reconnect using a
downgraded protocol to work around interoperability bugs in older
servers. This could be exploited by an active man-in-the-middle to
downgrade connections to SSL 3.0 even if both sides of the connection
support higher protocols. SSL 3.0 contains a number of weaknesses
including POODLE (CVE-2014-3566).

Impact
======

The two memory leaks allow a remote, non-authenticated attacker to cause
a denial of service.
The no-ssl3 option error may prevent administrator from effectively
disable SSLv3.
The POODLE attack may allow an active attacker to decipher the content
of an SSL connection, such as the content of a session cookie.

References
==========

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3513
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3566
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3567
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3568
https://www.openssl.org/news/secadv_20141015.txt
https://www.openssl.org/~bodo/ssl-poodle.pdf
https://www.imperialviolet.org/2014/10/14/poodle.html

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20141016/c5efc64b/attachment.bin>