OpenSSL has fixed six security vulnerabilities and updated both 1.0.0 and 0.9.8 versions of the open-source implementation of the Secure Sockets Layer protocol.
The vulnerabilities fixed in versions 1.0.0.f and 0.9.8s include a plain text recovery attack that is publicly known, policy check failures and problems with buffers not being cleared before being reused, according to a security advisory released Jan. 4 on OpenSSL.org. Four of the flaws affect both versions, according to the advisory.
The most serious flaw, if exploited, could enable an efficient plain text recovery attack against the OpenSSL implementation of Datagram Transport Layer Security (DTLS) protocol, which protects server-client communications from tampering or forgery. The issue was discovered and publicized recently by Nadhem Alfardan and Kenny Paterson, security researchers from the Information Security Group at Royal Holloway at the University of London. The cipher-block chaining-based encryption weakness allows adversaries to exploit timing differences that arise during decryption processing and recover the plain text version of an encrypted message without needing the initial encryption key.
The pair is scheduled to demonstrate their “padding Oracle attack” at the Network and Distributed System Security Symposium in February. This cryptographic issue was present in both versions of OpenSSL and has been fixed.
Developers also fixed the issue in the way OpenSSL padded the SSL 3.0 records in CBC mode. In this mode, the entire plain text block has to be encrypted, and if it’s incomplete, padded to fill up the block before being encrypted. It turned out that the bytes being padded weren’t being initialized, so potentially sensitive data from a previous transaction was left behind and being encrypted with the new data. The uninitialized contents of memory could contain anything, including the plain text of other connections to the server. This issue affected both clients and servers that accept SSL 3.0 handshakes.
“As a result, in each record, up to 15 bytes of uninitialized memory may be sent, encrypted, to the SSL peer. This could include sensitive contents of previously freed memory,” the advisory said.
However, the severity of the issue is limited because most OpenSSL servers use a single memory buffer for a given connection and the initial content is usually public handshake data. And the exposed memory buffer is already filled with non-sensitive data, according to the advisory.
The policy check failure flaw affected only the 0.9.8 branch of OpenSSL. Discovered by the OpenSSL team, the memory allocation bug is triggered only if a specific policy check flag is set and can result in code crashes, which then can also lead to a denial of service (DoS).
Three other vulnerabilities that can lead to a DoS condition were also addressed. One issue, in which an assertion failure can be triggered by malformed RFC 3779 data being included in certificates, is not part of a standard implementation, according to the advisory. In the standard release of OpenSSL, support for RFC 3779 is disabled by default.
Other DoS bugs included problems in handshake restarts for server-gated cryptography and the lack of error-checking to catch invalid parameters for the GOST hash function.