-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                       AL-2006.0074 -- AUSCERT ALERT
                             [Win][UNIX/Linux]
     OpenSSL SecurityOpenSSL Security Advisory - RSA Signature Forgery
                             6 September 2006

===========================================================================

        AusCERT Alert Summary
        ---------------------

Product:              OpenSSL versions up to 0.9.7j and 0.9.8b
Publisher:            OpenSSL
Operating System:     UNIX variants (UNIX, Linux, OSX)
                      Windows
Impact:               Reduced Security
Access:               Remote/Unauthenticated
CVE Names:            CVE-2006-4339

Original Bulletin:    http://www.openssl.org/news/secadv_20060905.txt

Comment: According to this advisory RSA keys generated with a public
         exponent of 3 are vulnerable. By default, when generating RSA keys
         the "openssl genrsa" command sets the value of the public exponent
         to 65537.

- --------------------------BEGIN INCLUDED TEXT--------------------

OpenSSL SecurityOpenSSL Security Advisory [5th September 2006]

RSA Signature Forgery (CVE-2006-4339)
=====================================

Vulnerability
- -------------

Daniel Bleichenbacher recently described an attack on PKCS #1 v1.5
signatures. If an RSA key with exponent 3 is used it may be possible
to forge a PKCS #1 v1.5 signature signed by that key. Implementations
may incorrectly verify the certificate if they are not checking for
excess data in the RSA exponentiation result of the signature.

Since there are CAs using exponent 3 in wide use, and PKCS #1 v1.5 is
used in X.509 certificates, all software that uses OpenSSL to verify
X.509 certificates is potentially vulnerable, as well as any other use
of PKCS #1 v1.5. This includes software that uses OpenSSL for SSL or
TLS.

OpenSSL versions up to 0.9.7j and 0.9.8b are affected.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2006-4339 to this issue.

Recommendations
- ---------------

There are multiple ways to avoid this vulnerability.  Any one of the
following measures is sufficient.

1.  Upgrade the OpenSSL server software.

    The vulnerability is resolved in the following versions of OpenSSL:

     - in the 0.9.7 branch, version 0.9.7k (or later);
     - in the 0.9.8 branch, version 0.9.8c (or later).

    OpenSSL 0.9.8c and OpenSSL 0.9.7k are available for download via
    HTTP and FTP from the following master locations (you can find the
    various FTP mirrors under http://www.openssl.org/source/mirror.html):

        o http://www.openssl.org/source/
        o ftp://ftp.openssl.org/source/

    The distribution file names are:

        o openssl-0.9.8c.tar.gz
          MD5 checksum: 78454bec556bcb4c45129428a766c886
          SHA1 checksum: d0798e5c7c4509d96224136198fa44f7f90e001d

        o openssl-0.9.7k.tar.gz
          MD5 checksum: be6bba1d67b26eabb48cf1774925416f
          SHA1 checksum: 90056b8f5e518edc9f74f66784fbdcfd9b784dd2
    
    The checksums were calculated using the following commands:

        openssl md5 openssl-0.9*.tar.gz
        openssl sha1 openssl-0.9*.tar.gz

2.  If this version upgrade is not an option at the present time,
    alternatively the following patch may be applied to the OpenSSL
    source code to resolve the problem.  The patch is compatible with
    the 0.9.6, 0.9.7, 0.9.8, and 0.9.9 branches of OpenSSL.

        o http://www.openssl.org/news/patch-CVE-2006-4339.txt

Whether you choose to upgrade to a new version or to apply the patch,
make sure to recompile any applications statically linked to OpenSSL
libraries.

 
Acknowledgements
- ----------------

The OpenSSL team thank Philip Mackenzie, Marius Schilder, Jason Waddle
and Ben Laurie, of Google Security, who successfully forged various
certificates, showing OpenSSL was vulnerable, and provided the patch
to fix the problems.


References
- ----------

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4339
http://www.imc.org/ietf-openpgp/mail-archive/msg14307.html

URL for this Security Advisory:
http://www.openssl.org/news/secadv_20060905.txt Advisory [5th September 2006]

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRP4doih9+71yA2DNAQLpwQP/Z2vECZX3sPlI81jKD6PUS1zf1YKH/qAX
dpmTkgfZeFar8rmEhHbVEEDlRRdLimQRdsFP6Q4DwZKxrP1d+EJ9G9YosdFdgiaD
B2BSRKGg7p6Mc71JvHnXUPwh7fGYCB/UnFMPe23UB8RGNKLRT9CA78kcgV0gcF5V
qj/+o8b6jss=
=WGNA
-----END PGP SIGNATURE-----