Attachment 21661 Details for Bug 57153

[patch] pkcs7_vulnerability.patch2

freeswan-x509bug.diff (text/plain), 3.60 KB, created by Ludwig Nussel on 2004-06-25 16:15:40 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ludwig Nussel

Created: 2004-06-25 16:15:40 UTC

Size: 3.60 KB

patch

obsolete

>A day after my quick fix for the security hole discovered by Thomas
>Walpuski I came upon a second related vulnerability which I fixed
>with the following versions:
>
>- strongswan-2.1.3                (security patch only)
>- x509-1.6.1-freeswan-2.04        (includes new 1.6.1 functionality)
>- x509-1.6.1-freeswan-2.05        (includes new 1.6.1 functionality)
>- x509patch-0.9.41-freeswan-1.99  (security patch only)
>
>Visit
>
>    http://wwww.strongsec.com/freeswan/
>
>for differential patches.
>
>The new freeswan-2.x fix also solves the first vulnerability in
>a different way:
>
>diff -urN strongswan-2.1.1/programs/pluto/x509.c strongswan-2.1.3/programs/pluto/x509.c
>--- strongswan-2.1.1/programs/pluto/x509.c	Thu Apr  1 20:44:38 2004
>+++ strongswan-2.1.3/programs/pluto/x509.c	Thu Jun 17 07:14:21 2004
>@@ -1850,9 +1850,11 @@
>  bool
>  verify_x509cert(const x509cert_t *cert, bool strict, time_t *until)
>  {
>+    int pathlen;
>+
>      *until = cert->notAfter;
>
>-    for (;;)
>+    for (pathlen = 0; pathlen < MAX_CA_PATH_LEN; pathlen++)
>      {
>  	x509cert_t *issuer_cert;
>  	u_char buf[BUF_LEN];
>@@ -1909,8 +1911,8 @@
>  	)
>  	unlock_authcert_list("verify_x509cert");
>
>-	/* check if cert is self-signed */
>-	if (same_dn(cert->issuer, cert->subject))
>+	/* check if cert is a self-signed root ca */
>+	if (pathlen > 0 && same_dn(cert->issuer, cert->subject))
>  	{
>  	    DBG(DBG_CONTROL,
>  		DBG_log("reached self-signed root ca")
>@@ -1928,6 +1930,8 @@
>  	/* go up one step in the trust chain */
>  	cert = issuer_cert;
>      }
>+    plog("maximum ca path length of %d levels exceeded", MAX_CA_PATH_LEN);
>+    return FALSE;
>  }
>
>  /*
>
>and the freeswan-1.99 security patch is similar:
>
>diff -urN freeswan-1.99-0.9.39/pluto/x509.c freeswan-1.99-x509/pluto/x509.c
>--- freeswan-1.99-0.9.39/pluto/x509.c	Wed Jun 16 20:16:22 2004
>+++ freeswan-1.99-x509/pluto/x509.c	Sat Jun 19 12:28:31 2004
>@@ -2210,15 +2210,16 @@
>  bool
>  verify_x509cert(const x509cert_t *cert, bool strict, time_t *until)
>  {
>-    u_char buf[BUF_LEN];
>-    x509cert_t *issuer_cert;
>-    x509crl_t  *crl;
>-    bool rootCA;
>+    int pathlen;
>
>      *until = cert->notAfter;
>
>-    do
>+    for (pathlen = 0; pathlen < MAX_CA_PATH_LEN; pathlen++)
>      {
>+	u_char buf[BUF_LEN];
>+	x509cert_t *issuer_cert;
>+	x509crl_t  *crl;
>+
>  	DBG(DBG_PARSING,
>  	    dntoa(buf, BUF_LEN, cert->subject);
>  	    DBG_log("Subject: '%s'",buf);
>@@ -2290,13 +2291,19 @@
>  		log("CRL signature is invalid");
>  	    }
>  	}
>-	/* check if cert is self-signed */
>-	rootCA = same_dn(cert->issuer, cert->subject);
>-        /* otherwise go up one step in the trust chain */
>+
>+	/* check if cert is a self-signed root ca */
>+	if (pathlen > 0 && same_dn(cert->issuer, cert->subject))
>+	{
>+	    DBG(DBG_CONTROL,
>+		DBG_log("reached self-signed root ca")
>+	    )
>+	    return TRUE;
>+	}
>  	cert = issuer_cert;
>      }
>-    while (!rootCA);
>-    return TRUE;
>+    log("maximum ca path length of %d levels exceeded", MAX_CA_PATH_LEN);
>+    return FALSE;
>  }
>
>  /*
>
>Regards
>
>Andreas
>
>Kurt Garloff wrote:
>
>> I have applied this to the SUSE FreeSWAN2 package.
>> Is it the final version of the fix?
>> 
>> As this problem has been posted to the list, I assume it's public, so we
>> can release updated packages?
>> 
>> Any news on the patch for x509-0.9.x (freeswan-1.9x)?
>> 
>> Thanks
>
>=======================================================================
>Andreas Steffen                   e-mail: andreas.steffen@strongsec.com
>strongSec GmbH                    home:   http://www.strongsec.com
>Alter Zürichweg 20                phone:  +41 1 730 80 64
>CH-8952 Schlieren (Switzerland)   fax:    +41 1 730 80 65
>==========================================[strong internet security]===

Actions: View | Diff

Attachments on bug 57153: 21306 | 21661 | 21671 | 21672