From 88f2a4cf9ced521e2c2874a1c32af0eeaa027f40 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Bodo=20M=C3=B6ller?= Date: Thu, 3 Feb 2011 10:43:00 +0000 Subject: [PATCH] CVE-2010-4180 fix (from OpenSSL_1_0_0-stable) --- CHANGES | 5 +++++ NEWS | 8 ++++++++ doc/ssl/SSL_CTX_set_options.pod | 13 +------------ ssl/s3_clnt.c | 3 +++ ssl/s3_srvr.c | 5 +++++ 5 files changed, 22 insertions(+), 12 deletions(-) diff --git a/CHANGES b/CHANGES index 7c44f0d989..f063349a84 100644 --- a/CHANGES +++ b/CHANGES @@ -175,6 +175,11 @@ Changes between 1.0.0b and 1.0.0c [2 Dec 2010] + *) Disable code workaround for ancient and obsolete Netscape browsers + and servers: an attacker can use it in a ciphersuite downgrade attack. + Thanks to Martin Rex for discovering this bug. CVE-2010-4180 + [Steve Henson] + *) Fixed J-PAKE implementation error, originally discovered by Sebastien Martini, further info and confirmation from Stefan Arentz and Feng Hao. Note that this fix is a security fix. CVE-2010-4252 diff --git a/NEWS b/NEWS index 23edac2e2b..139c1e02b4 100644 --- a/NEWS +++ b/NEWS @@ -5,6 +5,14 @@ This file gives a brief overview of the major changes between each OpenSSL release. For more details please read the CHANGES file. + Major changes between OpenSSL 1.0.0b and OpenSSL 1.0.0c: + + o Fix for security issue CVE-2010-4180 + o Fix for CVE-2010-4252 + o Fix mishandling of absent EC point format extension. + o Fix various platform compilation issues. + o Corrected fix for security issue CVE-2010-3864. + Major changes between OpenSSL 1.0.0a and OpenSSL 1.0.0b: o Fix for security issue CVE-2010-3864. diff --git a/doc/ssl/SSL_CTX_set_options.pod b/doc/ssl/SSL_CTX_set_options.pod index 310db84b31..cc588f3a78 100644 --- a/doc/ssl/SSL_CTX_set_options.pod +++ b/doc/ssl/SSL_CTX_set_options.pod @@ -78,18 +78,7 @@ this breaks this server so 16 bytes is the way to go. =item SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG -ssl3.netscape.com:443, first a connection is established with RC4-MD5. -If it is then resumed, we end up using DES-CBC3-SHA. It should be -RC4-MD5 according to 7.6.1.3, 'cipher_suite'. - -Netscape-Enterprise/2.01 (https://merchant.netscape.com) has this bug. -It only really shows up when connecting via SSLv2/v3 then reconnecting -via SSLv3. The cipher list changes.... - -NEW INFORMATION. Try connecting with a cipher list of just -DES-CBC-SHA:RC4-MD5. For some weird reason, each new connection uses -RC4-MD5, but a re-connect tries to use DES-CBC-SHA. So netscape, when -doing a re-connect, always takes the first cipher in the cipher list. +As of OpenSSL 0.9.8q and 1.0.0c, this option has no effect. =item SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c index 0c1df8ca47..b7287e5b67 100644 --- a/ssl/s3_clnt.c +++ b/ssl/s3_clnt.c @@ -884,8 +884,11 @@ int ssl3_get_server_hello(SSL *s) s->session->cipher_id = s->session->cipher->id; if (s->hit && (s->session->cipher_id != c->id)) { +/* Workaround is now obsolete */ +#if 0 if (!(s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG)) +#endif { al=SSL_AD_ILLEGAL_PARAMETER; SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED); diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c index 49751a0048..c41eb8bdfa 100644 --- a/ssl/s3_srvr.c +++ b/ssl/s3_srvr.c @@ -1019,6 +1019,10 @@ int ssl3_get_client_hello(SSL *s) break; } } +/* Disabled because it can be used in a ciphersuite downgrade + * attack: CVE-2010-4180. + */ +#if 0 if (j == 0 && (s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1)) { /* Special case as client bug workaround: the previously used cipher may @@ -1033,6 +1037,7 @@ int ssl3_get_client_hello(SSL *s) j = 1; } } +#endif if (j == 0) { /* we need to have the cipher in the cipher -- 2.25.1