|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2003-0543: openssl ASN1 parsing bugs | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Roman Drahtmueller <draht> |
| Component: | Incidents | Assignee: | Peter Poeml <poeml> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Critical | ||
| Priority: | P3 - Medium | CC: | deckel, fs, heiko.rommel, security-team, wwilde |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | CVSSv2:NVD:CVE-2003-0543:5.0:(AV:N/AC:L/Au:N/C:N/I:N/A:P) | ||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
| Attachments: |
appliable patch for 0.9.6*
appliable patch for 0.9.7b patch for < 0.9.6f |
||
|
Description
Roman Drahtmueller
2003-09-30 21:03:53 UTC
Added Uli Hecht. Uli, is there anything special with the openssl package on sles8-s390(x)? putonftp text: Peter, bugs that don't affect the respective products do not need mentioning in the putonftp. Don't forget to change the two strings for the affected version in the putonftp header line. suggested wording: ALL 7.3-ALL %UPDATE7.3 dxp Security update: This update fixes a number of vulnerabilities in the openssl package, known as ASN.1 parsing vulnerabilities (CAN-2003-0545, CAN-2003-0543, CAN-2003-0544) that allow for a remote denial of service (DoS) or possibly the execution of arbitrary code. You should reboot your system after applying this update. EOT Sicherheitsupdate für das openssl-Paket - Dieses update behebt eine Reihe Fehler, die als ASN.1 parsing Verwundbarkeit (CAN-2003-0545, CAN-2003-0543, CAN-2003-0544) bekannt sind und eine DoS-Angriffsmöglichkeit oder potentiell die Ausführung von beliebigem Code über das Netzwerk erlauben können. Sie sollten Ihr System neu starten, nachdem Sie dieses update eingespielt haben. EOT Uli, I have found /work/SRC/old-versions/8.1/BETA/arch/s390/openssl-z990, is that the recently created package? I can fix that, too Created attachment 14718 [details]
appliable patch for 0.9.6*
Created attachment 14719 [details]
appliable patch for 0.9.7b
Created attachment 14720 [details]
patch for < 0.9.6f
Fixed packages submitted. Will also submit fixed openssl-z990 package. List of submitted packages (with putonftps where appropriate): openssl: /work/SRC/old-versions/7.2/all/openssl -> /work/src/done/7.2 /work/SRC/old-versions/7.3/all/openssl -> /work/src/done/7.3 /work/SRC/old-versions/8.0/all/openssl -> /work/src/done/8.0 /work/SRC/old-versions/8.1/BETA/all/openssl -> /work/src/done/UL1-BETA /work/SRC/old-versions/8.1/UL/all/openssl -> /work/src/done/8.1 /work/SRC/old-versions/8.1/arch/axp/openssl -> /work/src/done/8.1/AXP/ /work/SRC/old-versions/8.2/all/openssl -> /work/src/done/8.2 /work/SRC/old-versions/9.0/all/openssl -> /work/src/done/9.0 openssl-z990: /work/SRC/old-versions/8.1/BETA/arch/s390/openssl-z990 -> /work/src/done/UL1-BETA Can someone confirm that 7.0-server is dead? openssl-z990 is merely a recent version of openssl with support for IBM's new hardware, installed to a different location so it can coexist with the normal openssl package and will not break binary compatibility. QA has approved the patchinfo files. This was fast... advisory released <!-- SBZ_reopen -->Reopened by draht@suse.de at Thu Oct 2 15:46:45 2003 reopened. Peter, do you think you can make an update package for 7.0-server, too? The package would be necessary for Turing (www.suse.de). Roman. JFYI: IT already set up a new turing based on SLES 8. Due to heavy workload I will not be able to configure and activate this machine within the next few days, so I would be very thankful if you could update the old turing (hopefully) for the last time. I'll give it a go, but I am actually trying (since two days) to take a few hours off work. Hang on... 0.9.6 has a lot of fixes for ASN1 handling over 0.9.5a, but the 0.9.6d
patch still applies and builds. However, I can't garuantee that there
are no other places in 0.9.5a where the bug is present.
Anyway, asn1_lib.c is nearly unchanged:
--- openssl-0.9.5a/crypto/asn1/asn1_lib.c 2000-02-17 00:15:56.000000000 +0100
+++ openssl-0.9.6a.orig/crypto/asn1/asn1_lib.c 2001-04-05 22:10:04.000000000 +0200
@@ -181,7 +181,7 @@
int xclass)
{
unsigned char *p= *pp;
- int i;
+ int i, ttag;
i=(constructed)?V_ASN1_CONSTRUCTED:0;
i|=(xclass&V_ASN1_PRIVATE);
@@ -190,12 +190,15 @@
else
{
*(p++)=i|V_ASN1_PRIMITIVE_TAG;
- while (tag > 0x7f)
- {
- *(p++)=(tag&0x7f)|0x80;
- tag>>=7;
+ for(i = 0, ttag = tag; ttag > 0; i++) ttag >>=7;
+ ttag = i;
+ while(i-- > 0)
+ {
+ p[i] = tag & 0x7f;
+ if(i != (ttag - 1)) p[i] |= 0x80;
+ tag >>= 7;
}
- *(p++)=(tag&0x7f);
+ p += ttag;
}
if ((constructed == 2) && (length == 0))
*(p++)=0x80; /* der_put_length would output 0 instead */
x509_vfy.c has no fundamental changes either, so it doesn't look bad.
Please find packages here:
http://aust.suse.de/pub/packages/openssl/7.0-server-i386/MD5SUMS
http://aust.suse.de/pub/packages/openssl/7.0-server-i386/openssl-0.9.5a-69.i386.rpm
http://aust.suse.de/pub/packages/openssl/7.0-server-i386/openssl-0.9.5a-69.src.rpm
http://aust.suse.de/pub/packages/openssl/7.0-server-i386/openssl.changes
http://aust.suse.de/pub/packages/openssl/7.0-server-i386/openssl.spec
http://aust.suse.de/pub/packages/openssl/7.0-server-i386/openssls-0.9.5a-69.i386.rpm
I can submit the sources later (they are in ~poeml/pac/openssl)
... if we want to check it into autobuild, that is. So this is fixed, right? We released the advisory, Peter built 7.0-server packages, and we probably already installed a new turing. If it's fixed, then close it so we don't have critical bugs hanging around. Silence indicates that everybody is happy -> set to FIXED |