Found this bug in OpenSSL 0.9.8d source. A logical AND is being used
where a bitwise AND is clearly intended. If I understand correctly, the
bug would allow "any" matching even if the certificate was not self
issued, at least in circumstances where x->ex_flags != 0. I don't know
this system well enough to comment accurately on any further security
implications, I'll leave that to you guys.
--- crypto/x509v3/pcy_tree.c.orig Thu Oct 5 12:20:10 2006
+++ crypto/x509v3/pcy_tree.c Thu Oct 5 12:20:22 2006
@@ -197,7 +197,7 @@
/* Any matching allowed if certificate is self
* issued and not the last in the chain.
*/
- if (!(x->ex_flags && EXFLAG_SS) || (i == 0))
+ if (!(x->ex_flags & EXFLAG_SS) || (i == 0))
level->flags |= X509_V_FLAG_INHIBIT_ANY;
}
else
---
Aaron Campbell <[EMAIL PROTECTED]>
Software Engineer, Arbor Networks, Inc.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [email protected]
Automated List Manager [EMAIL PROTECTED]
