4 ms·

The OpenSSL advisory contains details of the problematic functions, which are considerably smaller than the full set of ASN.1 functions: http://www.openssl.org

• dhx 14y ago
  To get an idea of which packages may be affected (try different functions for more results): https://github.com/search?q=d2i_X509_bio&type=Code https://github.com/search?q=d2i_X509_bio&type=Code http://www.koders.com/default.aspx?s=d2i_X509_bio http://www.koders.com/default.aspx?s=d2i_X509_bio Examples of impacted software include Android, Apache HTTPd (mod_ssl)[1] and Ruby. To reiterate what you've already stated elsewhere in this discussion, software shouldn't have a need to call these functions to validate certificates provided by remote clients. Users of email clients making heavy use of S/MIME and administrators managing PKI (signing, revoking, etc) may need to apply caution. [1] See line 99 at https://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_util_ssl.c?view=markup https://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/... where Apache tries to load a PEM formatted certificate. If this fails, Apache tries loading the file as a DER+Base64 formatted certificate or as a last resort, just DER (both which use the vulnerable d2i_X509_bio function). Given that the PEM format is the standard that most Apache administrators are using and injection of vulnerable certificates and keys usually requires root permissions, Apache/mod_ssl users can probably treat this vulnerability as a non-issue.
  • 0x0 14y ago
    What about HTTP SSL Client Certificates; i.e. what if a "browser" (attacker) simply includes a bad SSL Client Certificate in a request?