Home page logo
/

bugtraq logo Bugtraq mailing list archives

NetBSD Security Advisory 2003-001: Encryption weakness in OpenSSL code
From: NetBSD Security Officer <security-officer () netbsd org>
Date: Tue, 4 Mar 2003 01:32:50 -0500 (EST)

-----BEGIN PGP SIGNED MESSAGE-----


                 NetBSD Security Advisory 2003-001
                 =================================

Topic:          Encryption weakness in OpenSSL code

Version:        NetBSD-current:  source prior to February 21, 2003
                NetBSD-1.6.1:    not affected
                NetBSD-1.6:      affected
                NetBSD-1.5.3:    affected
                NetBSD-1.5.2:    affected
                NetBSD-1.5.1:    affected
                NetBSD-1.5:      affected
                NetBSD-1.4*:     not affected
                pkgsrc:          prior to openssl-0.9.6gnb1

Severity:       Cryptographic keys can be compromised.

Fixed:          NetBSD-current:         February 21, 2003
                NetBSD-1.6 branch:      February 21, 2003 (1.6.1 includes the fix)
                NetBSD-1.5 branch:      February 27, 2003
                pkgsrc:                 openssl-0.9.6gnb1 (or later)


Abstract
========


Block cipher padding errors and MAC verification errors were handled
differently in the SSL/TLS parts of the OpenSSL library.  This
leaks information in the case of incorrect SSL streams and allows
for an adaptive timing attack.

No services using SSL/TLS are enabled by default in NetBSD, however, by
enabling services built with these libraries, a system could become
vulnerable to the compromise of cryptographic keys.


Technical Details
=================

http://www.openssl.org/news/secadv_20030219.txt


Solutions and Workarounds
=========================

The following instructions describe how to upgrade your libssl
binaries by updating your source tree and rebuilding and installing
a new version of libssl.

Be sure to restart running instances of programs that use the libssl
library after upgrading.

If you have any statically-linked binaries that linked against a
vulnerable libssl, you need to recompile them.


* NetBSD-current:

        Systems running NetBSD-current dated from before 2003-02-21
        should be upgraded to NetBSD-current dated 2003-02-21 or later.

        The following file needs to be updated from the
        netbsd-current CVS branch (aka HEAD):
                crypto/dist/openssl/ssl/s3_pkt.c

        To update from CVS, re-build, and re-install libssl:
                # cd src
                # cvs update -d -P crypto/dist/openssl/ssl/s3_pkt.3 
                # cd lib/libssl
                # make cleandir dependall
                # make install


* NetBSD 1.6:

        Upgrading to the soon-to-be-released 1.6.1 is recommended.

        If a source-based point upgrade is required, sources from the
        NetBSD 1.6 branch dated 2003-02-21 or later should be used.

        The following file needs to be updated from the
        netbsd-1-6 CVS branch:
                crypto/dist/openssl/ssl/s3_pkt.c

        To update from CVS, re-build, and re-install libssl:
                # cd src
                # cvs update -d -P -r netbsd-1-6 \
                        crypto/dist/openssl/ssl/s3_pkt.3 
                # cd lib/libssl
                # make cleandir dependall
                # make install


* NetBSD 1.5, 1.5.1, 1.5.2, 1.5.3:

        Systems running NetBSD-1.5.x dated from before 2003-02-27
        should be upgraded to NetBSD-1.5 branch dated 2003-02-27 or later.

        The following file needs to be updated from the
        netbsd-1-5 CVS branch:
                crypto/dist/openssl/ssl/s3_pkt.c

        To update from CVS, re-build, and re-install libssl:
                # cd src
                # cvs update -d -P -r netbsd-1-6 \
                        crypto/dist/openssl/ssl/s3_pkt.3 
                # cd lib/libssl
                # make cleandir dependall
                # make install


* NetBSD 1.4, 1.4.1, 1.4.2, 1.4.3:

        OpenSSL was not included in the base system in NetBSD-1.4.*
        Follow the directions for pkgsrc if you have installed it from
        pkgsrc.


* pkgsrc:

        openssl (pkgsrc/security/openssl) prior to 0.9.6gnb1 are
        vulnerable.  Upgrade to openssl-0.9.6gnb1 or later; pkgsrc
        currently contains 0.9.6gnb1 at time of this writing.

        Packages which require openssl can be found by running 'pkg_info
        openssl'. Depending on the method you choose to update pkgsrc
        packages, a rebuild of the packages on that list may be
        performed for you by the package system. If you update using the
        experimental 'make replace' target, you will need to manually
        update any packages which build static binaries with libssl.a.

        If you have statically linked binaries in pkgsrc, they have to be
        rebuilt.  Statically linked binaries can be identified by the
        following command (note: be sure to include the directory you install
        pkgsrc binaries to, if you've changed LOCALBASE from the default of
        /usr/pkg)

                file /usr/pkg/{bin,sbin,libexec}/* | grep static


Thanks To
=========

Brice Canvel, Alain Hiltgen, Serge Vaudenay, and Martin Vuagnoux.


Revision History
================

        2003-02-27      Initial release


More Information
================

An up-to-date PGP signed copy of this release will be maintained at
  ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-001.txt.asc

Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/.


Copyright 2003, The NetBSD Foundation, Inc.  All Rights Reserved.

$NetBSD: NetBSD-SA2003-001.txt,v 1.4 2003/02/26 21:53:03 wiz Exp $

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (NetBSD)
Comment: For info see http://www.gnupg.org

iQCVAwUBPmQ55D5Ru2/4N2IFAQG5RAP/YYRAuzTUaWcKVbh3DivKL2cAI+ytNCma
AKNTCluixFh8aEDCJbnHOoOEUPu55l/6XKH6sfH5fxtwPUyB4gHiWSbAI8PnATWD
m7Kq8Mek7SuuZFwdEj4Z4iWRI8BthLE+KQMW36Mwy1utM89tA51ioNl205u8Sk4N
tF98hE/KzZA=
=172D
-----END PGP SIGNATURE-----


  By Date           By Thread  

Current thread:
  • NetBSD Security Advisory 2003-001: Encryption weakness in OpenSSL code NetBSD Security Officer (Mar 04)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault