From: Mark J. Cox Date: Wed, 28 May 2008 07:29:27 +0000 (+0000) Subject: Fix flaw if 'Server Key exchange message' is omitted from a TLS X-Git-Tag: OpenSSL_0_9_8h~1 X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=2c0fa03dc62f052cc64bbed435e974c952ab6363;p=oweals%2Fopenssl.git Fix flaw if 'Server Key exchange message' is omitted from a TLS handshake which could lead to a cilent crash as found using the Codenomicon TLS test suite (CVE-2008-1672) Reviewed by: openssl-security@openssl.org Obtained from: mark@awe.com --- diff --git a/CHANGES b/CHANGES index 9d4d7ee16c..be6883635b 100644 --- a/CHANGES +++ b/CHANGES @@ -4,6 +4,11 @@ Changes between 0.9.8g and 0.9.8h [xx XXX xxxx] + *) Fix flaw if 'Server Key exchange message' is omitted from a TLS + handshake which could lead to a cilent crash as found using the + Codenomicon TLS test suite (CVE-2008-1672) + [Steve Henson, Mark Cox] + *) Fix double free in TLS server name extensions which could lead to a remote crash found by Codenomicon TLS test suite (CVE-2008-0891) [Joe Orton] diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c index 648488b063..f6864cdc50 100644 --- a/ssl/s3_clnt.c +++ b/ssl/s3_clnt.c @@ -2061,6 +2061,13 @@ int ssl3_send_client_key_exchange(SSL *s) { DH *dh_srvr,*dh_clnt; + if (s->session->sess_cert == NULL) + { + ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE); + SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE); + goto err; + } + if (s->session->sess_cert->peer_dh_tmp != NULL) dh_srvr=s->session->sess_cert->peer_dh_tmp; else