Hi.
There is a security bug in package 'openssl'.

This bug is public.

There is no coordinated release date (CRD) set.

More information can be found here:
	http://seb.dbzteam.org/crypto/jpake-session-key-retrieval.pdf

CVE number: CVE-2010-4180
CVE description: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4180
CVSS v2 Base Score: 4.3 (moderate) (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVE number: CVE-2010-4252
CVE description: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4252
CVSS v2 Base Score: 7.5 (important) (AV:N/AC:L/Au:N/C:P/I:P/A:P)


Original posting:



----------  Weitergeleitete Nachricht  ----------

Betreff: OpenSSL security advisory
Datum: Donnerstag 02 Dezember 2010
Von: OpenSSL <openssl@master.openssl.org>
An: openssl-announce@master.openssl.org, openssl-dev@master.openssl.org, 
openssl-users@master.openssl.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

OpenSSL Security Advisory [2 December 2010]

OpenSSL Ciphersuite Downgrade Attack
=====================================

A flaw has been found in the OpenSSL SSL/TLS server code where an old bug
workaround allows malicous clients to modify the stored session cache
ciphersuite. In some cases the ciphersuite can be downgraded to a weaker one
on subsequent connections.

The OpenSSL security team would like to thank Martin Rex for reporting this
issue.

This vulnerability is tracked as CVE-2010-4180

OpenSSL JPAKE validation error
===============================

Sebastian Martini found an error in OpenSSL's J-PAKE implementation
which could lead to successful validation by someone with no knowledge
of the shared secret. This error is fixed in 1.0.0c. Details of the
problem can be found here:

http://seb.dbzteam.org/crypto/jpake-session-key-retrieval.pdf

Note that the OpenSSL Team still consider our implementation of J-PAKE
to be experimental and is not compiled by default.

This issue is tracked as CVE-2010-4252 

Who is affected?
=================

All versions of OpenSSL contain the ciphersuite downgrade vulnerability.

Any OpenSSL based SSL/TLS server is vulnerable if it uses
OpenSSL's internal caching mechanisms and the
SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG flag (many applications enable this
by using the SSL_OP_ALL option).

Users of OpenSSL 0.9.8j or later who do not enable weak ciphersuites are
still vulnerable but the bug has no security implications as the attacker can
only change from one strong ciphersuite to another.

All users of OpenSSL's experimental J-PAKE implementation are vulnerable
to the J-PAKE validation error.

Recommendations for users of OpenSSL
=====================================

Users of all OpenSSL 0.9.8 releases including 0.9.8p should update
to the OpenSSL 0.9.8q release which contains a patch to correct this issue.

Alternatively do not set the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
and/or SSL_OP_ALL flags.

Users of OpenSSL 1.0.0 releases should update to the OpenSSL 1.0.0c release
which contains a patch to correct this issue and also contains a corrected
version of the CVE-YYYY-NNN vulnerability fix.

If upgrading is not immediately possible, the relevant source code patch
provided in this advisory should be applied.

Any user of OpenSSL's J-PAKE implementaion (which is not compiled in by 
default) should upgrade to OpenSSL 1.0.0c.

Patch
=====

Index: ssl/s3_clnt.c
===================================================================
RCS file: /v/openssl/cvs/openssl/ssl/s3_clnt.c,v
retrieving revision 1.129.2.16
diff -u -r1.129.2.16 s3_clnt.c
- --- ssl/s3_clnt.c	10 Oct 2010 12:33:10 -0000	1.129.2.16
+++ ssl/s3_clnt.c	24 Nov 2010 14:32:37 -0000
@@ -866,8 +866,11 @@
 		s->session->cipher_id = s->session->cipher->id;
 	if (s->hit && (s->session->cipher_id != c->id))
 		{
+/* Workaround is now obsolete */
+#if 0
 		if (!(s->options &
 			SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG))
+#endif
 			{
 			al=SSL_AD_ILLEGAL_PARAMETER;
 			
SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED);
Index: ssl/s3_srvr.c
===================================================================
RCS file: /v/openssl/cvs/openssl/ssl/s3_srvr.c,v
retrieving revision 1.171.2.22
diff -u -r1.171.2.22 s3_srvr.c
- --- ssl/s3_srvr.c	14 Nov 2010 13:50:29 -0000	1.171.2.22
+++ ssl/s3_srvr.c	24 Nov 2010 14:34:28 -0000
@@ -985,6 +985,10 @@
 				break;
 				}
 			}
+/* Disabled because it can be used in a ciphersuite downgrade
+ * attack: CVE-2010-4180.
+ */
+#if 0
 		if (j == 0 && (s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && 
(sk_SSL_CIPHER_num(ciphers) == 1))
 			{
 			/* Special case as client bug workaround: the previously used cipher 
may
@@ -999,6 +1003,7 @@
 				j = 1;
 				}
 			}
+#endif
 		if (j == 0)
 			{
 			/* we need to have the cipher in the cipher



References
===========

URL for this Security Advisory:
http://www.openssl.org/news/secadv_20101202.txt

URL for updated CVS-2010-3864 Security Advisory:
http://www.openssl.org/news/secadv_20101116-2.txt


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQEVAwUBTPfvZ6LSm3vylcdZAQI9Lwf+JT3pzOySPkeMKS+OY19d/teHObhwxeI/
z/gS303F+CUmhQhmi0ueYno6gYfmpzYG/xNA+7dLwVinOjKpwTHNqZVHtLhFgwQm
wZS+vqiPBjzakjTGz0YXrA1uPQG/1ASbVV3C0a9s7nKCsDzYiWJkzFrZiVTzkVat
Y39Z5hTBCwUxssCyJU4VSRGNF4kcHzvbuDeNJDnK0shdz+hgNx2mNb8EFgYDRqbx
ahIMGAKEtpVIn3WgeHL0r6VjG2RFaV1QLPyehAPvU/YjBnbph++PyXqnsTmEbtgn
ma3aqbxbSLI0+WobVXabDlB4PD6H57Uwt2R57vZs2yNCSX8sSkMBqg==
=vUwE
-----END PGP SIGNATURE-----
______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
Development Mailing List                       openssl-dev@openssl.org
Automated List Manager                           majordomo@openssl.org

-------------------------------------------------------------