Date: 05 March 2003
References: ESB-2003.0111
Click here for printable version
Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2003.0146 -- NetBSD Security Advisory 2003-001
Encryption weakness in OpenSSL code
05 March 2003
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: openssl
Vendor: NetBSD
Operating System: NetBSD-current prior to 21/02/2003
NetBSD-1.6
NetBSD-1.5.3
NetBSD-1.5.2
NetBSD-1.5.1
NetBSD-1.5
Impact: Reduced Security
Access Required: Remote
Ref: ESB-2003.0111
Comment: CVE Id: CAN-2003-0078
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
NetBSD Security Advisory 2003-001
=================================
Topic: Encryption weakness in OpenSSL code
Version: NetBSD-current: source prior to February 21, 2003
NetBSD-1.6.1: not affected
NetBSD-1.6: affected
NetBSD-1.5.3: affected
NetBSD-1.5.2: affected
NetBSD-1.5.1: affected
NetBSD-1.5: affected
NetBSD-1.4*: not affected
pkgsrc: prior to openssl-0.9.6gnb1
Severity: Cryptographic keys can be compromised.
Fixed: NetBSD-current: February 21, 2003
NetBSD-1.6 branch: February 21, 2003 (1.6.1 includes the fix)
NetBSD-1.5 branch: February 27, 2003
pkgsrc: openssl-0.9.6gnb1 (or later)
Abstract
========
Block cipher padding errors and MAC verification errors were handled
differently in the SSL/TLS parts of the OpenSSL library. This
leaks information in the case of incorrect SSL streams and allows
for an adaptive timing attack.
No services using SSL/TLS are enabled by default in NetBSD, however, by
enabling services built with these libraries, a system could become
vulnerable to the compromise of cryptographic keys.
Technical Details
=================
http://www.openssl.org/news/secadv_20030219.txt
Solutions and Workarounds
=========================
The following instructions describe how to upgrade your libssl
binaries by updating your source tree and rebuilding and installing
a new version of libssl.
Be sure to restart running instances of programs that use the libssl
library after upgrading.
If you have any statically-linked binaries that linked against a
vulnerable libssl, you need to recompile them.
* NetBSD-current:
Systems running NetBSD-current dated from before 2003-02-21
should be upgraded to NetBSD-current dated 2003-02-21 or later.
The following file needs to be updated from the
netbsd-current CVS branch (aka HEAD):
crypto/dist/openssl/ssl/s3_pkt.c
To update from CVS, re-build, and re-install libssl:
# cd src
# cvs update -d -P crypto/dist/openssl/ssl/s3_pkt.3
# cd lib/libssl
# make cleandir dependall
# make install
* NetBSD 1.6:
Upgrading to the soon-to-be-released 1.6.1 is recommended.
If a source-based point upgrade is required, sources from the
NetBSD 1.6 branch dated 2003-02-21 or later should be used.
The following file needs to be updated from the
netbsd-1-6 CVS branch:
crypto/dist/openssl/ssl/s3_pkt.c
To update from CVS, re-build, and re-install libssl:
# cd src
# cvs update -d -P -r netbsd-1-6 \
crypto/dist/openssl/ssl/s3_pkt.3
# cd lib/libssl
# make cleandir dependall
# make install
* NetBSD 1.5, 1.5.1, 1.5.2, 1.5.3:
Systems running NetBSD-1.5.x dated from before 2003-02-27
should be upgraded to NetBSD-1.5 branch dated 2003-02-27 or later.
The following file needs to be updated from the
netbsd-1-5 CVS branch:
crypto/dist/openssl/ssl/s3_pkt.c
To update from CVS, re-build, and re-install libssl:
# cd src
# cvs update -d -P -r netbsd-1-6 \
crypto/dist/openssl/ssl/s3_pkt.3
# cd lib/libssl
# make cleandir dependall
# make install
* NetBSD 1.4, 1.4.1, 1.4.2, 1.4.3:
OpenSSL was not included in the base system in NetBSD-1.4.*
Follow the directions for pkgsrc if you have installed it from
pkgsrc.
* pkgsrc:
openssl (pkgsrc/security/openssl) prior to 0.9.6gnb1 are
vulnerable. Upgrade to openssl-0.9.6gnb1 or later; pkgsrc
currently contains 0.9.6gnb1 at time of this writing.
Packages which require openssl can be found by running 'pkg_info
openssl'. Depending on the method you choose to update pkgsrc
packages, a rebuild of the packages on that list may be
performed for you by the package system. If you update using the
experimental 'make replace' target, you will need to manually
update any packages which build static binaries with libssl.a.
If you have statically linked binaries in pkgsrc, they have to be
rebuilt. Statically linked binaries can be identified by the
following command (note: be sure to include the directory you install
pkgsrc binaries to, if you've changed LOCALBASE from the default of
/usr/pkg)
file /usr/pkg/{bin,sbin,libexec}/* | grep static
Thanks To
=========
Brice Canvel, Alain Hiltgen, Serge Vaudenay, and Martin Vuagnoux.
Revision History
================
2003-02-27 Initial release
More Information
================
An up-to-date PGP signed copy of this release will be maintained at
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-001.txt.asc
Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/.
Copyright 2003, The NetBSD Foundation, Inc. All Rights Reserved.
$NetBSD: NetBSD-SA2003-001.txt,v 1.4 2003/02/26 21:53:03 wiz Exp $
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (NetBSD)
Comment: For info see http://www.gnupg.org
iQCVAwUBPmQ55D5Ru2/4N2IFAQG5RAP/YYRAuzTUaWcKVbh3DivKL2cAI+ytNCma
AKNTCluixFh8aEDCJbnHOoOEUPu55l/6XKH6sfH5fxtwPUyB4gHiWSbAI8PnATWD
m7Kq8Mek7SuuZFwdEj4Z4iWRI8BthLE+KQMW36Mwy1utM89tA51ioNl205u8Sk4N
tF98hE/KzZA=
=172D
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business
hours which are GMT+10:00 (AEST). On call after hours
for member emergencies only.
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBPmYmgSh9+71yA2DNAQHSAAP/btVVZzc6ac8mO/YeRbvCn+QH78gM4A3C
291xTNhLTf4bK0lV4evtQp3Fjav7sR/6IEQclDtNFAu31ex2e8bp0GHOClidwveT
Zo+BvFJU2gVu++ox0739ZieiHP9AA6v2W2x0BPYwb0+AL2mP5SDdxldC5O30XD7h
McZwCgldzWE=
=/Jw8
-----END PGP SIGNATURE-----
|