The open-source OpenSSL Project this morning issued a series of updates, providing seven security fixes for new flaws. The security updates for OpenSSL are the largest since the project found itself at the center of the Heartbleed security firestorm in April, when the group fixed only one vulnerability.
OpenSSL is a widely used open-source cryptographic library that provides Secure Sockets Layer encryption capabilities for servers and end-user devices.
The Internet Storm Center (ISC SANS) ranks two of the newly patched flaws as critical. One, identified as CVE-2014-0224, is an SSL man-in-the-middle (MITM) vulnerability that could have a widespread, critical impact. In an MITM attack, the attacker is able to intercept encrypted messages sent between secured endpoints and decrypt the message.
"An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS [Secure Sockets Layer/Transfer Layer Security] clients and servers," OpenSSL warns in its advisory. "This can be exploited by a man-in-the-middle attack where the attacker can decrypt and modify traffic from the attacked client and server."
Further reading
The OpenSSL Project cautions that all client versions of OpenSSL are vulnerable to CVE-2014-0224. The OpenSSL advisory notes that CVE-2014-0224 was reported to the OpenSSL Project May 1.
The other OpenSSL update rated as critical is for the flaw identified as CVE-2014-0195 and is a Datagram Transport Layer Security (DTLS) invalid fragment vulnerability that was reported to the project on April 23.
"A buffer overrun attack can be triggered by sending invalid DTLS fragments to an OpenSSL DTLS client or server," the OpenSSL advisory warns. "This is potentially exploitable to run arbitrary code on a vulnerable client or server."
DTLS is also at the core of the CVE-2014-0221 flaw, which is a DTLS recursion flaw that ISC SANS has rated critical.
"By sending an invalid DTLS handshake to an OpenSSL DTLS client, the code can be made to recurse, eventually crashing in a DoS attack," the OpenSSL advisory states.
Two other vulnerabilities, both rated important, involve the SSL_MODE_RELEASE_BUFFERS capability in OpenSSL. CVE-2014-0198 is a Null pointer de-reference flaw in SSL_MODE_RELEASE_BUFFERS that could lead to a denial-of-service condition. The CVE-2010-5298 flaw is a race condition in SSL_MODE_RELEASE_BUFFERS that could lead to a denial of service.
The OpenSSL advisory notes, however, that with both of the issues, the flaws only affect OpenSSL 1.0.0 and 1.0.1 where SSL_MODE_RELEASE_BUFFERS is enabled, which is not the default and not common.
OpenSSL is also patching for the CVE-2014-3470 flaw, which is an Anonymous Elliptic Curve Diffie Hellman (ECDH) DoS issue that was reported to the OpenSSL Project May 28.
Additionally, OpenSSL is providing a patch for the CVE-2014-0076 vulnerability for users of the older OpenSSL 1.0.0m and 0.9.8za releases.
In contrast to the Heartbleed OpenSSL issue, first publicly reported April 7 and only patched by Linux vendors and others a day or more after the advisory came out, the new OpenSSL issues already have multiple public patches available. The Ubuntu Linux project as well as Red Hat have issued public updates for the new OpenSSL issues.
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.
Research Assistant
