Fix null-pointer assignment in do_change_cipher_spec() revealed

by using the Codenomicon TLS Test Tool (CAN-2004-0079)
Fix flaw in SSL/TLS handshaking when using Kerberos ciphersuites
(CAN-2004-0112)
Ready for 0.9.7d build

Submitted by: Steven Henson
Reviewed by: Joe Orton
Approved by: Mark Cox

diff --git a/CHANGES b/CHANGES
index c2ad5a196b802cbad125478bc44bb117dbb6124d..4a0363a1c2dd1dcece251b99ee9b73b7a969a488 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,7 +2,15 @@
  OpenSSL CHANGES
  _______________
 
- Changes between 0.9.7c and 0.9.7d  [xx XXX XXXX]
+ Changes between 0.9.7c and 0.9.7d  [17 Mar 2004]
+
+  *) Fix null-pointer assignment in do_change_cipher_spec() revealed           
+     by using the Codenomicon TLS Test Tool (CAN-2004-0079)                    
+     [Joe Orton, Steve Henson]   
+
+  *) Fix flaw in SSL/TLS handshaking when using Kerberos ciphersuites
+     (CAN-2004-0112)
+     [Joe Orton, Steve Henson]   
 
   *) Make it possible to have multiple active certificates with the same
      subject in the CA index file.  This is done only if the keyword

diff --git a/FAQ b/FAQ
index 01e2ccf18a95e85b63cf99d2d34849fc62717d53..0b40039ef81ea6e5c33a6801f2fb3f4a447da168 100644 (file)
--- a/FAQ
+++ b/FAQ
@@ -68,7 +68,7 @@ OpenSSL  -  Frequently Asked Questions
 * Which is the current version of OpenSSL?
 
 The current version is available from <URL: http://www.openssl.org>.
-OpenSSL 0.9.7c was released on September 30, 2003.
+OpenSSL 0.9.7d was released on March 17, 2004.
 
 In addition to the current stable release, you can also access daily
 snapshots of the OpenSSL development version at <URL:

diff --git a/LICENSE b/LICENSE
index dddb07842bb380171e4b606b4e89dfa1cb081691..40277883a5925e352fc56851651fc86c26f16e63 100644 (file)
--- a/LICENSE
+++ b/LICENSE
@@ -12,7 +12,7 @@
   ---------------
 
 /* ====================================================================
- * Copyright (c) 1998-2003 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2004 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions

diff --git a/NEWS b/NEWS
index f0282ebb87558f8b6f08ca1d6b74c4323f08b0e9..4c1ba0a241f663fc3e841abadf8b6c5b46b10012 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,14 @@
   This file gives a brief overview of the major changes between each OpenSSL
   release. For more details please read the CHANGES file.
 
+  Major changes between OpenSSL 0.9.7c and OpenSSL 0.9.7d:
+
+      o Security: Fix Kerberos ciphersuite SSL/TLS handshaking bug
+      o Security: Fix null-pointer assignment in do_change_cipher_spec()
+      o Allow multiple active certificates with same subject in CA index
+      o Multiple X590 verification fixes
+      o Speed up HMAC and other operations
+
   Major changes between OpenSSL 0.9.7b and OpenSSL 0.9.7c:
 
       o Security: fix various ASN1 parsing bugs.

diff --git a/README b/README
index 65e3a124263b90fdd5698485a6a378d548619cba..f72a21036f9fbc42ab05e279f7035062197e2dcf 100644 (file)
--- a/README
+++ b/README
@@ -1,7 +1,7 @@
 
- OpenSSL 0.9.7c 30 Sep 2003
+ OpenSSL 0.9.7d 17 Mar 2004
 
- Copyright (c) 1998-2003 The OpenSSL Project
+ Copyright (c) 1998-2004 The OpenSSL Project
  Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
  All rights reserved.
 

diff --git a/STATUS b/STATUS
index 2acb2ce52524367be970c9c6489916a0ed797afe..b62dda74beaf629d9fa85629776dc8786f80fae5 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -1,14 +1,17 @@
 
   OpenSSL STATUS                           Last modified at
-  ______________                           $Date: 2003/09/30 12:08:19 $
+  ______________                           $Date: 2004/03/17 12:01:16 $
 
   DEVELOPMENT STATE
 
     o  OpenSSL 0.9.8:  Under development...
+    o  OpenSSL 0.9.7d: Released on March     17th, 2004
     o  OpenSSL 0.9.7c: Released on September 30th, 2003
     o  OpenSSL 0.9.7b: Released on April     10th, 2003
     o  OpenSSL 0.9.7a: Released on February  19th, 2003
     o  OpenSSL 0.9.7:  Released on December  31st, 2002
+    o  OpenSSL 0.9.6m: Released on March     17th, 2004
+    o  OpenSSL 0.9.6l: Released on November   4th, 2003
     o  OpenSSL 0.9.6k: Released on September 30th, 2003
     o  OpenSSL 0.9.6j: Released on April     10th, 2003
     o  OpenSSL 0.9.6i: Released on February  19th, 2003

diff --git a/crypto/opensslv.h b/crypto/opensslv.h
index dce1147a17f6993ddb92377302b9dbd04d32a18e..02f1710fb3f658220a6aef36036c15e578013f3d 100644 (file)
--- a/crypto/opensslv.h
+++ b/crypto/opensslv.h
@@ -25,8 +25,8 @@
  * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
  *  major minor fix final patch/beta)
  */
-#define OPENSSL_VERSION_NUMBER 0x00907040L
-#define OPENSSL_VERSION_TEXT   "OpenSSL 0.9.7d-dev xx XXX XXXX"
+#define OPENSSL_VERSION_NUMBER 0x0090704fL
+#define OPENSSL_VERSION_TEXT   "OpenSSL 0.9.7d 17 Mar 2004"
 #define OPENSSL_VERSION_PTEXT  " part of " OPENSSL_VERSION_TEXT
 
 

diff --git a/openssl.spec b/openssl.spec
index 9ce236e0d21efc9131f36436b9f64a21ffad4c48..6a272f69698ec16b185d611d19368ea269f5371b 100644 (file)
--- a/openssl.spec
+++ b/openssl.spec
@@ -1,7 +1,7 @@
 %define libmaj 0
 %define libmin 9
 %define librel 7
-%define librev c
+%define librev d
 Release: 1
 
 %define openssldir /var/ssl

diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c
index 3f88429e79a66ae5c189894332023b0b06b1c31a..9f3e5139ad976240cbd5ac6676c27bd95ae8cd65 100644 (file)
--- a/ssl/s3_pkt.c
+++ b/ssl/s3_pkt.c
@@ -1085,6 +1085,14 @@ start:
                        goto err;
                        }
 
+               /* Check we have a cipher to change to */
+               if (s->s3->tmp.new_cipher == NULL)
+                       {
+                       i=SSL_AD_UNEXPECTED_MESSAGE;
+                       SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);
+                       goto err;
+                       }
+
                rr->length=0;
 
                if (s->msg_callback)

diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index 57f1d3f52a89fd49391d8b9c8e490b53dd2c2685..deb3cffabeb5ff8d6062133fbdecc872edc64e45 100644 (file)
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -1588,11 +1588,27 @@ static int ssl3_get_client_key_exchange(SSL *s)
 
                n2s(p,i);
                enc_ticket.length = i;
+
+               if (n < enc_ticket.length + 6)
+                       {
+                       SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                               SSL_R_DATA_LENGTH_TOO_LONG);
+                       goto err;
+                       }
+
                enc_ticket.data = (char *)p;
                p+=enc_ticket.length;
 
                n2s(p,i);
                authenticator.length = i;
+
+               if (n < enc_ticket.length + authenticator.length + 6)
+                       {
+                       SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                               SSL_R_DATA_LENGTH_TOO_LONG);
+                       goto err;
+                       }
+
                authenticator.data = (char *)p;
                p+=authenticator.length;