6 ms·

OpenSSL Security Advisory

129 points by eyeareque 11y ago

therealmarv 11y ago
Good luck in updating it in OS X (try running `ssh -V` there). Good that OS X will update to a more recent version in El Capitan and also switch to LibreSSL (great step forward).
- nifoc 11y ago
  SSH under OS X uses OSSLShim, which is wrapper around Secure Transport. I'm not exactly sure when they started using it for this, but it has been a while. If you're seeing OpenSSL in the output, you have probably installed SSH via Homebrew.
  - 9700094 11y ago
    These are the versions on 10.10.3: OpenSSL 0.9.8zd 8 Jan 2015 OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
  - therealmarv 11y ago
    ah ok thanks. Actually I do not see OpenSSL there. I've looked too fast and thought OpenSSL is still used in OS X.
  - sslalready 11y ago
    Usage of openssl has been deprecated since OS X 10.7 in favor of Secure Transport and Common Crypto. Furthermore, OpenSSL is not even supported on iOS. See: https://developer.apple.com/library/ios/documentation/Security/Conceptual/cryptoservices/GeneralPurposeCrypto/GeneralPurposeCrypto.html https://developer.apple.com/library/ios/documentation/Securi...
- nerdy 11y ago
  > Good that OS X will update to a more recent version in El Capitan and also switch to LibreSSL (great step forward). Not sure if you're being sarcastic? "LibreSSL has the affected code and is thought to be vulnerable (untested)." - https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang/ https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang...
  - smhenderson 11y ago
    They released updates today that fix cve-2015-1788. https://github.com/libressl-portable/portable/blob/master/ChangeLog https://github.com/libressl-portable/portable/blob/master/Ch...
  - therealmarv 11y ago
    Can you explain why LibreSSL is a bad choice for the next OS X version? Maybe OpenSSL & LibreSSL are not fixed on exactly the same day (but around the same time region) but this is not bad IMHO.
    - nerdy 11y ago
      Simply saying with regards to this issue it didn't provide advance protection (that was my impression after reading the comment anyhow)
    - zymhan 11y ago
      You claimed that LibreSSL is a great step forward, but there's no reason to think that it's a "great step".
      - glass- 11y ago
        > there's no reason The last time a bunch of OpenSSL CVEs dropped, there were 14 of them; two of which were rated sev: High. LibreSSL was affected by 5 out of the 14, none of which were high-severity. This time around there are seven vulnerabilities and LibreSSL is affected by four of them[1]. So there's at least 12 reasons. [0] https://marc.info/?l=openbsd-cvs&m=142677372515025&w=2 [1] https://marc.info/?l=openbsd-announce&m=143406498020131&w=2
  - glass- 11y ago
    There were 7 CVEs of which 4 were applicable to LibreSSL, including the one in that link.
ctz 11y ago
Here's a writeup of CVE-2015-1788: https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang/ https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang... It's embarrassing rather than terribly dangerous. edit: Please note: there are other issues in this advisory. You should read the advisory, first and foremost.
- koenigdavidmj 11y ago
  Your comment is probably correct regarding that one issue, but multiple issues were announced today. These include CVE-2015-4000, which is another nasty downgrade issue. (I'm mostly posting this because I don't want anyone to read your post and think they can ignore this whole notice.)
  - tptacek 11y ago
    I think Logjam is the only operationally significant bug in this announcement.
  - ctz 11y ago
    You're right, of course. But CVE-2015-4000 was announced and extensively discussed a number of weeks ago: https://weakdh.org/ https://weakdh.org/
- smhenderson 11y ago
  Well, with updates to LibreSSL (2.1.7, 2.2.0) getting released today it looks like this has already been addressed. I can't find a decent link at the moment but according to an email I received a bit ago from owner-announce at openbsd.org 1788 is fixed in the above mentioned releases. Fixes for the following issues are integrated into LibreSSL 2.1.7 and LibreSSL 2.2.0: - CVE-2015-1788 - Malformed ECParameters causes infinite loop - CVE-2015-1789 - Exploitable out-of-bounds read in X509_cmp_time - CVE-2015-1792 - CMS verify infinite loop with unknown hash function (this code is not enabled by default) Edit - The updates included are mentioned here: https://github.com/libressl-portable/portable/blob/master/ChangeLog https://github.com/libressl-portable/portable/blob/master/Ch...
epmatsw 11y ago
I wonder how many of these are found by hand versus with automated tools like Asan and AFL. Seems like some of these would be really hard to spot...
- tptacek 11y ago
  Logjam was found with model-checking software, right?
- hannob 11y ago
  I can answer that I found CVE-2015-1789 twice with afl (through different input vectors) and a couple of other issues that were not security-relevant. I'd assume that the null ptr pkcs#7 issue found by Michal Zalewski was also afl and the ecc issue as well (as documented by its founder). The CMS loop issue sounds also like it could've been found by fuzzing. It's important to keep in mind what fuzzing can and can't do. It is a great method to find some bugs, but it has its limitations and can only find a certain class of bugs.
  - f- 11y ago
    Yep, the two PKCS bugs were from afl-fuzz.
ikeboy 11y ago
In the meantime, latest stable releases of Chrome and Firefox are still vulnerable to Logjam. Is it that hard to fix?
- gellerb 11y ago
  Use Chrome Canary
- kardos 11y ago
  Are you sure? I'm running Firefox 38.0.5 and Chromium 40.0.2214.91 through normal channels (ie, not nightly builds...) and they are both NOT vulnerable.
  - ikeboy 11y ago
    40.0.2214.91 was released months ago http://googlechromereleases.blogspot.com/2015/01/stable-update.html http://googlechromereleases.blogspot.com/2015/01/stable-upda.... (Irony of no https). https://bugzilla.mozilla.org/show_bug.cgi?id=1166031 https://bugzilla.mozilla.org/show_bug.cgi?id=1166031 and https://bugzilla.mozilla.org/show_bug.cgi?id=1138554 https://bugzilla.mozilla.org/show_bug.cgi?id=1138554 say explicitly wontfix for 38.0.5 Maybe you manually fixed it some time ago and don't remember? Check both https://weakdh.org/ https://weakdh.org/ and https://www.ssllabs.com:10445/ https://www.ssllabs.com:10445/
    - takeda 11y ago
      38.0.5 is safe. I learned it myself when trying to use internal service. Secure Connection Failed An error occurred during a connection to 10.xx.yy.xx. SSL received a weak ephemeral Diffie-Hellman key in Server Key Exchange handshake message. (Error code: ssl_error_weak_server_ephemeral_dh_key) - The page you are trying to view cannot be shown because the authenticity of the received data could not be verified. - Please contact the website owners to inform them of this problem. I wish they gave option to bypass it.
      - MBlume 11y ago
Animats 11y ago
"X509_cmp_time does not properly check the length of the ASN1_TIME string and can read a few bytes out of bounds." OpenSSL in C has had range errors discovered for over a decade now. Short of going to a safe language or full machine proofs of correctness, it's never going to be fixed. "Many eyes" don't help. (Of course, one wonders how many OpenSSL security holes are deliberate backdoors.)
- viraptor 11y ago
  There's another option: Openssl code is terrible. Even interacting with it is terrible. I had to deal with x509 code lately, and it's probably the worst and least documented code I've seen in a long time. For the "many eyes" situation to work, you have to have code which "many eyes" can understand. Asn1-related functions in openssl are not in that situation. Edit: If you've never looked at openssl code, check this out: https://github.com/openssl/openssl/blob/063dccd027033401912d8c5e3f0f25b1f13de64b/crypto/objects/obj_dat.c#L465 https://github.com/openssl/openssl/blob/063dccd027033401912d... - yup - that's part of public interface. It's got a mention on the man page, but no idea what encoding it actually outputs. Maybe ascii, maybe something else. Good luck finding out from source. Edit2: Just a few lines above you can spot: "/* memory leak, buit should not normally matter */"
  - jschwartzi 11y ago
    Yes, the sources are difficult to read at best. The documentation for the public APIs is not much better either. For example, the suggestion at this page: https://www.openssl.org/docs/crypto/sha.html https://www.openssl.org/docs/crypto/sha.html to use the higher-level EVP_ functions was difficult to actually adhere to, given that the EVP_ functions themselves don't actually explain how to generate a message digest given some input data. I wasted half a day once trying to understand how those functions worked once before giving up and just using the digest functions directly. It's still not clear to me why the EVP functions provide a significant advantage, or even how I would use them to accomplish the use cases outlined in the digest functions. I suspect that not understanding the OpenSSL APIs is a common problem, and possibly an underlying cause of a lot of crypto implementation errors.
colinbartlett 11y ago
Layman's explanation? I should apt-get update && apt-get upgrade?
- breadtk 11y ago
  This is OpenSSL's response to the "Logjam" attack (https://weakdh.org/ https://weakdh.org/)

129 points by eyeareque 11y ago

Good luck in updating it in OS X (try running `ssh -V` there). Good that OS X will update to a more recent version in El Capitan and also switch to LibreSSL (great step forward).

nifoc 11y ago
SSH under OS X uses OSSLShim, which is wrapper around Secure Transport. I'm not exactly sure when they started using it for this, but it has been a while. If you're seeing OpenSSL in the output, you have probably installed SSH via Homebrew.
- 9700094 11y ago
  These are the versions on 10.10.3: OpenSSL 0.9.8zd 8 Jan 2015 OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
- therealmarv 11y ago
  ah ok thanks. Actually I do not see OpenSSL there. I've looked too fast and thought OpenSSL is still used in OS X.
- sslalready 11y ago
  Usage of openssl has been deprecated since OS X 10.7 in favor of Secure Transport and Common Crypto. Furthermore, OpenSSL is not even supported on iOS. See: https://developer.apple.com/library/ios/documentation/Security/Conceptual/cryptoservices/GeneralPurposeCrypto/GeneralPurposeCrypto.html https://developer.apple.com/library/ios/documentation/Securi...
nerdy 11y ago
> Good that OS X will update to a more recent version in El Capitan and also switch to LibreSSL (great step forward). Not sure if you're being sarcastic? "LibreSSL has the affected code and is thought to be vulnerable (untested)." - https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang/ https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang...
- smhenderson 11y ago
  They released updates today that fix cve-2015-1788. https://github.com/libressl-portable/portable/blob/master/ChangeLog https://github.com/libressl-portable/portable/blob/master/Ch...
- therealmarv 11y ago
  Can you explain why LibreSSL is a bad choice for the next OS X version? Maybe OpenSSL & LibreSSL are not fixed on exactly the same day (but around the same time region) but this is not bad IMHO.
  - nerdy 11y ago
    Simply saying with regards to this issue it didn't provide advance protection (that was my impression after reading the comment anyhow)
  - zymhan 11y ago
    You claimed that LibreSSL is a great step forward, but there's no reason to think that it's a "great step".
    - glass- 11y ago
      > there's no reason The last time a bunch of OpenSSL CVEs dropped, there were 14 of them; two of which were rated sev: High. LibreSSL was affected by 5 out of the 14, none of which were high-severity. This time around there are seven vulnerabilities and LibreSSL is affected by four of them[1]. So there's at least 12 reasons. [0] https://marc.info/?l=openbsd-cvs&m=142677372515025&w=2 [1] https://marc.info/?l=openbsd-announce&m=143406498020131&w=2
- glass- 11y ago
  There were 7 CVEs of which 4 were applicable to LibreSSL, including the one in that link.

ctz 11y ago

Here's a writeup of CVE-2015-1788: https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang/ https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang... It's embarrassing rather than terribly dangerous. edit: Please note: there are other issues in this advisory. You should read the advisory, first and foremost.

koenigdavidmj 11y ago
Your comment is probably correct regarding that one issue, but multiple issues were announced today. These include CVE-2015-4000, which is another nasty downgrade issue. (I'm mostly posting this because I don't want anyone to read your post and think they can ignore this whole notice.)
- tptacek 11y ago
  I think Logjam is the only operationally significant bug in this announcement.
- ctz 11y ago
  You're right, of course. But CVE-2015-4000 was announced and extensively discussed a number of weeks ago: https://weakdh.org/ https://weakdh.org/
smhenderson 11y ago
Well, with updates to LibreSSL (2.1.7, 2.2.0) getting released today it looks like this has already been addressed. I can't find a decent link at the moment but according to an email I received a bit ago from owner-announce at openbsd.org 1788 is fixed in the above mentioned releases. Fixes for the following issues are integrated into LibreSSL 2.1.7 and LibreSSL 2.2.0: - CVE-2015-1788 - Malformed ECParameters causes infinite loop - CVE-2015-1789 - Exploitable out-of-bounds read in X509_cmp_time - CVE-2015-1792 - CMS verify infinite loop with unknown hash function (this code is not enabled by default) Edit - The updates included are mentioned here: https://github.com/libressl-portable/portable/blob/master/ChangeLog https://github.com/libressl-portable/portable/blob/master/Ch...

epmatsw 11y ago

I wonder how many of these are found by hand versus with automated tools like Asan and AFL. Seems like some of these would be really hard to spot...

tptacek 11y ago
Logjam was found with model-checking software, right?
hannob 11y ago
I can answer that I found CVE-2015-1789 twice with afl (through different input vectors) and a couple of other issues that were not security-relevant. I'd assume that the null ptr pkcs#7 issue found by Michal Zalewski was also afl and the ecc issue as well (as documented by its founder). The CMS loop issue sounds also like it could've been found by fuzzing. It's important to keep in mind what fuzzing can and can't do. It is a great method to find some bugs, but it has its limitations and can only find a certain class of bugs.
- f- 11y ago
  Yep, the two PKCS bugs were from afl-fuzz.

ikeboy 11y ago

In the meantime, latest stable releases of Chrome and Firefox are still vulnerable to Logjam. Is it that hard to fix?

gellerb 11y ago
Use Chrome Canary
kardos 11y ago
Are you sure? I'm running Firefox 38.0.5 and Chromium 40.0.2214.91 through normal channels (ie, not nightly builds...) and they are both NOT vulnerable.
- ikeboy 11y ago
  40.0.2214.91 was released months ago http://googlechromereleases.blogspot.com/2015/01/stable-update.html http://googlechromereleases.blogspot.com/2015/01/stable-upda.... (Irony of no https). https://bugzilla.mozilla.org/show_bug.cgi?id=1166031 https://bugzilla.mozilla.org/show_bug.cgi?id=1166031 and https://bugzilla.mozilla.org/show_bug.cgi?id=1138554 https://bugzilla.mozilla.org/show_bug.cgi?id=1138554 say explicitly wontfix for 38.0.5 Maybe you manually fixed it some time ago and don't remember? Check both https://weakdh.org/ https://weakdh.org/ and https://www.ssllabs.com:10445/ https://www.ssllabs.com:10445/
  - takeda 11y ago
    38.0.5 is safe. I learned it myself when trying to use internal service. Secure Connection Failed An error occurred during a connection to 10.xx.yy.xx. SSL received a weak ephemeral Diffie-Hellman key in Server Key Exchange handshake message. (Error code: ssl_error_weak_server_ephemeral_dh_key) - The page you are trying to view cannot be shown because the authenticity of the received data could not be verified. - Please contact the website owners to inform them of this problem. I wish they gave option to bypass it.
    - MBlume 11y ago

Animats 11y ago

"X509_cmp_time does not properly check the length of the ASN1_TIME string and can read a few bytes out of bounds." OpenSSL in C has had range errors discovered for over a decade now. Short of going to a safe language or full machine proofs of correctness, it's never going to be fixed. "Many eyes" don't help. (Of course, one wonders how many OpenSSL security holes are deliberate backdoors.)

viraptor 11y ago
There's another option: Openssl code is terrible. Even interacting with it is terrible. I had to deal with x509 code lately, and it's probably the worst and least documented code I've seen in a long time. For the "many eyes" situation to work, you have to have code which "many eyes" can understand. Asn1-related functions in openssl are not in that situation. Edit: If you've never looked at openssl code, check this out: https://github.com/openssl/openssl/blob/063dccd027033401912d8c5e3f0f25b1f13de64b/crypto/objects/obj_dat.c#L465 https://github.com/openssl/openssl/blob/063dccd027033401912d... - yup - that's part of public interface. It's got a mention on the man page, but no idea what encoding it actually outputs. Maybe ascii, maybe something else. Good luck finding out from source. Edit2: Just a few lines above you can spot: "/* memory leak, buit should not normally matter */"
- jschwartzi 11y ago
  Yes, the sources are difficult to read at best. The documentation for the public APIs is not much better either. For example, the suggestion at this page: https://www.openssl.org/docs/crypto/sha.html https://www.openssl.org/docs/crypto/sha.html to use the higher-level EVP_ functions was difficult to actually adhere to, given that the EVP_ functions themselves don't actually explain how to generate a message digest given some input data. I wasted half a day once trying to understand how those functions worked once before giving up and just using the digest functions directly. It's still not clear to me why the EVP functions provide a significant advantage, or even how I would use them to accomplish the use cases outlined in the digest functions. I suspect that not understanding the OpenSSL APIs is a common problem, and possibly an underlying cause of a lot of crypto implementation errors.

colinbartlett 11y ago

Layman's explanation? I should apt-get update && apt-get upgrade?

breadtk 11y ago
This is OpenSSL's response to the "Logjam" attack (https://weakdh.org/ https://weakdh.org/)