[openssl.org #1695] RSA_padding_check_SSLv23 broken

[Jacques Vidrine via RT]

We have addressed the following issue in Mac OS X:

RSA_padding_check_SSLv23 has a bug in the loop that verifies the  
presence of eight consecutive 0x03 padding bytes just before the null  
marker signifying the end of the padding.  The problem is that at the  
start of the for loop (for (k= -8; k0; k++)), p points at the byte  
*after* the NULL terminator. The eight 0x03 bytes are actually from  
p[-9] to p[-2] inclusive. The byte at p[-1] is the NULL.  As a result,  
if an SSLv2-only client is extraordinarily unlucky, an OpenSSL server  
with SSLv2 enabled may erroneously detect a rollback attack.  Well,  
this could have happened anyway with a probability of 1 in 2^64, but  
with this bug the probability was increased to 1 in 2^56.

diff -Naur /var/tmp/OpenSSL.roots/OpenSSL/openssl/crypto/rsa/ 
rsa_ssl.c ./crypto/rsa/rsa_ssl.c
--- /var/tmp/OpenSSL.roots/OpenSSL/openssl/crypto/rsa/rsa_ssl.c  
2000-11-06 14:34:16.0 -0800
+++ ./crypto/rsa/rsa_ssl.c  2006-10-11 16:40:48.0 -0700
@@ -130,11 +130,11 @@
 
RSAerr(RSA_F_RSA_PADDING_CHECK_SSLV23,RSA_R_NULL_BEFORE_BLOCK_MISSING);
return(-1);
}
-   for (k= -8; k0; k++)
+   for (k= -9; k-1; k++)
{
if (p[k] !=  0x03) break;
}
-   if (k == -1)
+   if (k != -1)
{

RSAerr(RSA_F_RSA_PADDING_CHECK_SSLV23,RSA_R_SSLV3_ROLLBACK_ATTACK);
return(-1);

Cheers,
-- 
Jacques

__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   [EMAIL PROTECTED]

[openssl.org #1602] X509_new, X509_free do not appear in any headers

[Jacques Vidrine via RT]

The functions X509_new and X509_free are documented in doc/crypto/ 
X509_new.pod, but they do not appear in any headers.

__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   [EMAIL PROTECTED]

[openssl.org #1599] PKCS12_parse(3) man page does not document return value

[Jacques Vidrine via RT]

It appears in the code that the return value is zero on failure, non- 
zero for success.  However, this is not documented in the man page.

—-
Jacques

__
OpenSSL Project http://www.openssl.org
Development Mailing List   openssl-dev@openssl.org
Automated List Manager   [EMAIL PROTECTED]