[arch-security] [ASA-201510-9] mbedtls: arbitrary code execution

[Remi Gacogne]

Arch Linux Security Advisory ASA-201510-9
=========================================

Severity: Critical
Date    : 2015-10-15
CVE-ID  : CVE-2015-5291
Package : mbedtls
Type    : arbitrary code execution
Remote  : Yes
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package mbedtls before version 2.1.2-1 is vulnerable to remote code
execution.

Resolution
==========

Upgrade to 2.1.2-1.

# pacman -Syu "mbedtls>=2.1.2-1"

The problem has been fixed upstream in versions 2.1.2, 1.3.14 and 1.2.17.

Workaround
==========

To be protected against this vulnerability, you need to apply both of
the following work-arounds:

- Do not use ticket-based session resumption. This can be achieved in
two ways: (1) do not attempt to resume a saved session (do not use
mbedtls_get_session() / mbedtls_set_session()), or (2) if you want to
resume sessions, make sure you're not using tickets by calling
ssl_set_session_tickets( SSL_SESSION_TICKETS_DISABLED ) in 1.3.x or
mbedtls_ssl_conf_session_tickets( MBEDTLS_SSL_SESSION_TICKETS_DISABLED )
in 2.x.

- If you accept hostnames from untrusted parties, validate that they are
at most 255 bytes long (limit defined by RFC 1305) before passing them
to ssl_set_hostname().

Description
===========

When the client creates its ClientHello message, due to insufficient
bounds checking it can overflow the heap-based buffer containing the
message while writing some extensions. Two extensions in particular
could be used by a remote attacker to trigger the overflow: the session
ticket extension and the server name indication (SNI) extension.

Starting with PolarSSL 1.3.0 which added support for session tickets,
any server the client connects to can send an overlong session ticket
which will cause a buffer overflow if and when the client attempts to
resume the connection with the server. Clients that disabled session
tickets or never attempt to reconnect to a server using a saved session
are not vulnerable to this attack vector.

Starting with PolarSSL 1.0.0, this overflow could also be triggered by
an attacker convincing a client to use an overlong hostname for the SNI
extension. The hostname needs to be almost as long at
SSL_MAX_CONTENT_LEN, which as 16KB by default, but could be smaller if a
custom configuration is used. Clients that do not accept hostnames from
untrusted parties are not vulnerable to this attack vector.

Impact
======

A malicious server could cause a denial of service or execute arbitrary
code on a vulnerable client by sending an overlong session ticket.
An attacker could cause a denial of service or execute arbitrary code on
a vulnerable client by convincing it to connect to an overlong hostname.

References
==========

https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2015-01
https://access.redhat.com/security/cve/CVE-2015-5291

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20151015/070c1335/attachment.asc>