Just a note if you are running SSL on IMAIL. They are based on OpenSSL.
I will give them a call in the morning to see if their implamentation is at
risk. I did verify with them they are using OpenSSL for the SSL portion of
the IMail server.
Kevin Bilbee
-----BEGIN PGP SIGNED MESSAGE-----
CERT Advisory CA-2003-26 Multiple Vulnerabilities in SSL/TLS
Implementations
Original issue date: October 1, 2003
Last revised: --
Source: CERT/CC
A complete revision history is at the end of this file.
Systems Affected
* OpenSSL versions prior to 0.9.7c and 0.9.6k
* Multiple SSL/TLS implementations
* SSLeay library
Overview
There are multiple vulnerabilities in different implementations of the
Secure Sockets Layer (SSL) and Transport Layer Security (TLS)
protocols. These vulnerabilities occur primarily in Abstract Syntax
Notation One (ASN.1) parsing code. The most serious vulnerabilities
may allow a remote attacker to execute arbitrary code. The common
impact is denial of service.
I. Description
SSL and TLS are used to provide authentication, encryption, and
integrity services to higher-level network applications such as HTTP.
Cryptographic elements used by the protocols, such as X.509
certificates, are represented as ASN.1 objects. In order to encode and
decode these objects, many SSL and TLS implementations (and
cryptographic libraries) include ASN.1 parsers.
OpenSSL is a widely-deployed open source implementation of the SSL and
TLS protocols. OpenSSL also provides a general-purpose cryptographic
library that includes an ASN.1 parser.
The U.K. National Infrastructure Security Co-ordination Centre (NISCC)
has developed a test suite to analyze the way SSL and TLS
implementations handle exceptional ASN.1 objects contained in client
and server certificate messages. Although the test suite focuses on
certificate messages, any untrusted ASN.1 element may be used as an
attack vector. An advisory from OpenSSL describes as vulnerable "Any
application that makes use of OpenSSL's ASN1 library to parse
untrusted data. This includes all SSL or TLS applications, those using
S/MIME (PKCS#7) or certificate generation routines."
There are two certificate message attack vectors. An attacker can send
crafted client certificate messages to a server, or attempt to cause a
client to connect to a server under the attacker's control. When the
client connects, the attacker can deliver a crafted server certificate
message. Note that the standards for TLS (RFC 2246) and SSL 3.0 state
that a client certificate message "...is only sent if the server
requests a certificate." To reduce exposure to these types of attacks,
an SSL/TLS server should ignore unsolicited client certificate
messages (VU#732952).
NISCC has published two advisories describing vulnerabilities in
OpenSSL (006489/OpenSSL) and other SSL/TLS implementations
(006489/TLS). The second advisory covers multiple vulnerabilities in
many vendors' products. Further details, including vendor status
information, are available in the following vulnerability notes.
VU#935264 - OpenSSL ASN.1 parser insecure memory deallocation
A vulnerability in the way OpenSSL deallocates memory used to store
ASN.1 structures could allow a remote attacker to execute arbitrary
code with the privileges of the process using the OpenSSL library.
(Other resources: NISCC/006490/OpenSSL/3, OpenSSL #1, CAN-2003-0545)
VU#255484 - OpenSSL contains integer overflow handling ASN.1 tags (1)
An integer overflow vulnerability in the way OpenSSL handles ASN.1
tags could allow a remote attacker to cause a denial of service.
(Other resources: NISCC/006490/OpenSSL/1, OpenSSL #2, CAN-2003-0543)
VU#380864 - OpenSSL contains integer overflow handling ASN.1 tags (2)
A second integer overflow vulnerability in the way OpenSSL handles
ASN.1 tags could allow a remote attacker to cause a denial of service.
(Other resources: NISCC/006490/OpenSSL/1, OpenSSL #2, CAN-2003-0544)
VU#686224 - OpenSSL does not securely handle invalid public key when
configured to ignore errors
A vulnerability in the way OpenSSL handles invalid public keys in
client certificate messages could allow a remote attacker to cause a
denial of service. This vulnerability requires as a precondition that
an application is configured to ignore public key decoding errors,
which is not typically the case on production systems.
(Other resources: NISCC/006490/OpenSSL/2, OpenSSL #3)
VU#732952 - OpenSSL accepts unsolicited client certificate messages
OpenSSL accepts unsolicited client certificate messages. This could
allow an attacker to exploit underlying flaws in client certificate
handling, such as the vulnerabilities listed above.
(Other resources: OpenSSL #4)
VU#104280 - Multiple vulnerabilities in SSL/TLS implementations
Multiple vulnerabilities exist in different vendors' SSL/TLS
implementations. The impacts of these vulnerabilities include remote
execution of arbitrary code, denial of service, and disclosure of
sensitive information. VU#104280 covers an undefined set of
vulnerabilities that affect SSL/TLS implementations from many
different vendors.
(Other resources: NISCC/006490/TLS)
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
