From b996cecc32f425610d34ff1f6f4a9e94c1b948ec Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Wed, 18 Jan 2012 13:36:04 +0000 Subject: [PATCH] Fix for DTLS DoS issue introduced by fix for CVE-2011-4109. Thanks to Antonio Martin, Enterprise Secure Access Research and Development, Cisco Systems, Inc. for discovering this bug and preparing a fix. (CVE-2012-0050) --- CHANGES | 14 +++++++++++++- ssl/d1_pkt.c | 17 +++++++---------- 2 files changed, 20 insertions(+), 11 deletions(-) diff --git a/CHANGES b/CHANGES index fec64dd41a..fdafdab9c1 100644 --- a/CHANGES +++ b/CHANGES @@ -4,7 +4,11 @@ Changes between 1.0.0f and 1.0.0g [xx XXX xxxx] - *) + *) Fix for DTLS DoS issue introduced by fix for CVE-2011-4109. + Thanks to Antonio Martin, Enterprise Secure Access Research and + Development, Cisco Systems, Inc. for discovering this bug and + preparing a fix. (CVE-2012-0050) + [Antonio Martin] Changes between 1.0.0e and 1.0.0f [4 Jan 2012] @@ -969,6 +973,14 @@ *) Change 'Configure' script to enable Camellia by default. [NTT] + + Changes between 0.9.8s and 0.9.8t [18 Jan 2012] + + *) Fix for DTLS DoS issue introduced by fix for CVE-2011-4109. + Thanks to Antonio Martin, Enterprise Secure Access Research and + Development, Cisco Systems, Inc. for discovering this bug and + preparing a fix. (CVE-2012-0050) + [Antonio Martin] Changes between 0.9.8r and 0.9.8s [4 Jan 2012] diff --git a/ssl/d1_pkt.c b/ssl/d1_pkt.c index e0c0f0cc9a..de30a505a6 100644 --- a/ssl/d1_pkt.c +++ b/ssl/d1_pkt.c @@ -376,6 +376,7 @@ dtls1_process_record(SSL *s) unsigned int mac_size; unsigned char md[EVP_MAX_MD_SIZE]; int decryption_failed_or_bad_record_mac = 0; + unsigned char *mac = NULL; rr= &(s->s3->rrec); @@ -447,19 +448,15 @@ printf("\n"); #endif } /* check the MAC for rr->input (it's in mac_size bytes at the tail) */ - if (rr->length < mac_size) + if (rr->length >= mac_size) { -#if 0 /* OK only for stream ciphers */ - al=SSL_AD_DECODE_ERROR; - SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_LENGTH_TOO_SHORT); - goto f_err; -#else - decryption_failed_or_bad_record_mac = 1; -#endif + rr->length -= mac_size; + mac = &rr->data[rr->length]; } - rr->length-=mac_size; + else + rr->length = 0; i=s->method->ssl3_enc->mac(s,md,0); - if (i < 0 || memcmp(md,&(rr->data[rr->length]),mac_size) != 0) + if (i < 0 || mac == NULL || memcmp(md, mac, mac_size) != 0) { decryption_failed_or_bad_record_mac = 1; } -- 2.25.1