Re: New OpenSSL releases fix denial of service attacks [17

[Marc Bejarano]

At 09:12 3/17/2004, Mark J Cox wrote:
>OpenSSL Security Advisory [17 March 2004]
>
>Updated versions of OpenSSL are now available which correct two
>security issues:

>1. Null-pointer assignment during SSL handshake

>The Common Vulnerabilities and Exposures project (cve.mitre.org) has
>assigned the name CAN-2004-0079 to this issue.

>2. Out-of-bounds read affects Kerberos ciphersuites

>The Common Vulnerabilities and Exposures project (cve.mitre.org) has
>assigned the name CAN-2004-0112 to this issue.

according to NISCC Vulnerability Advisory 224012 (
http://www.uniras.gov.uk/vuls/2004/224012/index.htm ), there is also a
third potential DoS that was found with this testing sweep: CVE
CAN-2004-0081. quoting from the NISCC advisory:
==
NISCC/224012/3 [OpenSSL 0.9.6]
CAN-2004-0081 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0081
Testing performed by the OpenSSL group using the Codenomicon TLS Test Tool
uncovered a bug in older versions of OpenSSL 0.9.6 that can lead to a
Denial of Service attack (infinite loop). This issue was traced to a fix
that was added to OpenSSL 0.9.6d some time ago. This issue will affect
vendors that ship older versions of OpenSSL with backported security patches.
==

marc

[Marc Bejarano]

At 11:30 3/17/2004, Mark J Cox wrote:
>> according to NISCC Vulnerability Advisory 224012 (
>> http://www.uniras.gov.uk/vuls/2004/224012/index.htm ), there is also a
>> third potential DoS that was found with this testing sweep: CVE
>> CAN-2004-0081. quoting from the NISCC advisory:
>
>Absolutely, but that was fixed back in 0.9.6d a long time ago.

there appears to be a new CVE number corresponding to this issue. that
either means that 1) the issue is really new to CVE and most people weren't
aware of it and should be made so, regardless of whether a fix was slipped
in long ago or 2) the CVE number is a dupe and should be marked as such.

do you know which case we have?

if the former, the OpenSSL folks have a duty to advise their users of the
newly discovered vulnerability. as the NISCC advisory states the issue
would "affect vendors that ship older versions of OpenSSL with backported
security patches". if the latter, then the NISCC folks need to clear
things up in their advisory.

cheers,
marc