From f4e6ed09e48348f4766eb9f03727326ce6c0b1a3 Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Tue, 13 May 2014 18:48:31 +0100 Subject: [PATCH] Fix for CVE-2014-0195 MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit A buffer overrun attack can be triggered by sending invalid DTLS fragments to an OpenSSL DTLS client or server. This is potentially exploitable to run arbitrary code on a vulnerable client or server. Fixed by adding consistency check for DTLS fragments. Thanks to Jüri Aedla for reporting this issue. --- ssl/d1_both.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/ssl/d1_both.c b/ssl/d1_both.c index ffbff8c733..da8d1b1469 100644 --- a/ssl/d1_both.c +++ b/ssl/d1_both.c @@ -627,7 +627,16 @@ dtls1_reassemble_fragment(SSL *s, struct hm_header_st* msg_hdr, int *ok) frag->msg_header.frag_off = 0; } else + { frag = (hm_fragment*) item->data; + if (frag->msg_header.msg_len != msg_hdr->msg_len) + { + item = NULL; + frag = NULL; + goto err; + } + } + /* If message is already reassembled, this must be a * retransmit and can be dropped. -- 2.25.1