OpenSSL安全公告高危漏洞 可以对默认配置的服务器发动DDoS攻击

OpenSSL项目组在今天发布高威胁安全通告CVE-2016-6304,更新内容包括:修复了自2016年5月以来的安全漏洞,其中包括一个高危漏洞,一个为“中危”,其余均评级为“低危”。OpenSSL安全公告 [22 Sep 2016]公告如下:

OCSP状态请求扩展跨内存边界增长(CVE-2016-6304)

安全等级: 高危

恶意的客户端可以发送过大的OCSP状态请求延期。如果该客户端不断请求重新谈判,发送一个大的 OCSP 状态请求每延长一次,那么就会有无限的内存增长在服务器上。这最终将导致通过内存耗尽的拒绝服务攻击。这种攻击在使用默认配置的服务器上很容易执行,即使他们不支持 OCSP。建立使用"无 ocsp"生成时间选项不会受到影响。

Servers using OpenSSL versions prior to 1.0.1g are not vulnerable in a default configuration, instead only if an application explicitly enables OCSP stapling support.

OpenSSL 1.1.0 应该升级到 1.1.0a 
OpenSSL 1.0.2 应该升级到 1.0.2i 
OpenSSL 1.0.1 应该升级到 1.0.1u

SSL_peek() hang on empty record (CVE-2016-6305) 
===============================================

安全等级:中

攻击者可以通过发送一个空记录,从而在调用SSL_peek()函数时引起拒绝服务。

OpenSSL 1.1.0 SSL/TLS will hang during a call to SSL_peek() if the peer sends an 
empty record. This could be exploited by a malicious peer in a Denial Of Service 
attack.

OpenSSL 1.1.0 users should upgrade to 1.1.0a

This issue was reported to OpenSSL on 10th September 2016 by Alex Gaynor. The 
fix was developed by Matt Caswell of the OpenSSL development team.

SWEET32 Mitigation (CVE-2016-2183) 
==================================

安全等级:低

该漏洞涉及SWEET32攻击,一种针对64位分组密码算法的生日攻击。

SWEET32 (https://sweet32.info) is an attack on older block cipher algorithms 
that use a block size of 64 bits. In mitigation for the SWEET32 attack DES based 
ciphersuites have been moved from the HIGH cipherstring group to MEDIUM in 
OpenSSL 1.0.1 and OpenSSL 1.0.2.  OpenSSL 1.1.0 since release has had these 
ciphersuites disabled by default.

OpenSSL 1.0.2 users should upgrade to 1.0.2i 
OpenSSL 1.0.1 users should upgrade to 1.0.1u

This issue was reported to OpenSSL on 16th August 2016 by Karthikeyan 
Bhargavan and Gaetan Leurent (INRIA). The fix was developed by Rich Salz of the 
OpenSSL development team.

OOB write in MDC2_Update() (CVE-2016-6303) 
==========================================

安全等级:低

该漏洞是存在于函数MDC2_Update()中的一个整数溢出,导致内存破坏,进而允许拒绝服务攻击

An overflow can occur in MDC2_Update() either if called directly or 
through the EVP_DigestUpdate() function using MDC2. If an attacker 
is able to supply very large amounts of input data after a previous 
call to EVP_EncryptUpdate() with a partial block then a length check 
can overflow resulting in a heap corruption.

The amount of data needed is comparable to SIZE_MAX which is impractical 
on most platforms.

OpenSSL 1.0.2 users should upgrade to 1.0.2i 
OpenSSL 1.0.1 users should upgrade to 1.0.1u

Malformed SHA512 ticket DoS (CVE-2016-6302) 
===========================================

安全等级:低

该漏洞是存在于函数MDC2_Update()中的一个整数溢出,导致内存破坏,进而允许拒绝服务攻击

If a server uses SHA512 for TLS session ticket HMAC it is vulnerable to a 
DoS attack where a malformed ticket will result in an OOB read which will 
ultimately crash.

The use of SHA512 in TLS session tickets is comparatively rare as it requires 
a custom server callback and ticket lookup mechanism.

OpenSSL 1.0.2 users should upgrade to 1.0.2i 
OpenSSL 1.0.1 users should upgrade to 1.0.1u

OOB write in BN_bn2dec() (CVE-2016-2182) 
========================================

安全等级:低

位于crypto/bn/bn_print.c的函数BN_bn2dec()没有检验BN_div_word()函数的返回值,允许内存越界写入,从而引起拒绝服务

The function BN_bn2dec() does not check the return value of BN_div_word(). 
This can cause an OOB write if an application uses this function with an 
overly large BIGNUM. This could be a problem if an overly large certificate 
or CRL is printed out from an untrusted source. TLS is not affected because 
record limits will reject an oversized certificate before it is parsed.

OpenSSL 1.0.2 users should upgrade to 1.0.2i 
OpenSSL 1.0.1 users should upgrade to 1.0.1u

OOB read in TS_OBJ_print_bio() (CVE-2016-2180) 
==============================================

安全等级:低

位于crypto/ts/ts_lib.c中的函数TS_OBJ_print_bio()存在越界写入问题,允许拒绝服务

The function TS_OBJ_print_bio() misuses OBJ_obj2txt(): the return value is 
the total length the OID text representation would use and not the amount 
of data written. This will result in OOB reads when large OIDs are presented.

OpenSSL 1.0.2 users should upgrade to 1.0.2i 
OpenSSL 1.0.1 users should upgrade to 1.0.1u

Pointer arithmetic undefined behaviour (CVE-2016-2177) 
======================================================

安全等级:低

在计算堆缓冲区的边界时出错,允许攻击者发起拒绝服务攻击

Avoid some undefined pointer arithmetic

A common idiom in the codebase is to check limits in the following manner: 
"p + len > limit"

Where "p" points to some malloc'd data of SIZE bytes and 
limit == p + SIZE

"len" here could be from some externally supplied data (e.g. from a TLS 
message).

The rules of C pointer arithmetic are such that "p + len" is only well 
defined where len <= SIZE. Therefore the above idiom is actually 
undefined behaviour.

For example this could cause problems if some malloc implementation 
provides an address for "p" such that "p + len" actually overflows for 
values of len that are too big and therefore p + len < limit.

OpenSSL 1.0.2 users should upgrade to 1.0.2i 
OpenSSL 1.0.1 users should upgrade to 1.0.1u

This issue was reported to OpenSSL on 4th May 2016 by Guido Vranken. The 
fix was developed by Matt Caswell of the OpenSSL development team.

Constant time flag not preserved in DSA signing (CVE-2016-2178) 
===============================================================

安全等级:低

位于crypto/dsa/dsa_ossl.c中的函数dsa_sign_setup(),没有正确处理constant-time,允许攻击者通过边信道攻击获得DSA的私钥

Operations in the DSA signing algorithm should run in constant time in order to 
avoid side channel attacks. A flaw in the OpenSSL DSA implementation means that 
a non-constant time codepath is followed for certain operations. This has been 
demonstrated through a cache-timing attack to be sufficient for an attacker to 
recover the private DSA key.

OpenSSL 1.0.2 users should upgrade to 1.0.2i 
OpenSSL 1.0.1 users should upgrade to 1.0.1u

This issue was reported to OpenSSL on 23rd May 2016 by César Pereida (Aalto 
University), Billy Brumley (Tampere University of Technology), and Yuval Yarom 
(The University of Adelaide and NICTA). The fix was developed by César Pereida.

DTLS buffered message DoS (CVE-2016-2179) 
=========================================

安全等级:低

在DTLS的实现中,没有正确处理未按序到达的握手消息缓存,允许攻击者同时维护多个精心构造的DTLS会话,导致拒绝服务

In a DTLS connection where handshake messages are delivered out-of-order those 
messages that OpenSSL is not yet ready to process will be buffered for later 
use. Under certain circumstances, a flaw in the logic means that those messages 
do not get removed from the buffer even though the handshake has been completed. 
An attacker could force up to approx. 15 messages to remain in the buffer when 
they are no longer required. These messages will be cleared when the DTLS 
connection is closed. The default maximum size for a message is 100k. Therefore 
the attacker could force an additional 1500k to be consumed per connection. By 
opening many simulataneous connections an attacker could cause a DoS attack 
through memory exhaustion.

OpenSSL 1.0.2 DTLS users should upgrade to 1.0.2i 
OpenSSL 1.0.1 DTLS users should upgrade to 1.0.1u

This issue was reported to OpenSSL on 22nd June 2016 by Quan Luo. The fix was 
developed by Matt Caswell of the OpenSSL development team.

DTLS replay protection DoS (CVE-2016-2181) 
==========================================

安全等级:低

在DTLS的实现中,没有正确处理未按序到达的握手消息缓存,允许攻击者同时维护多个精心构造的DTLS会话,导致拒绝服务

A flaw in the DTLS replay attack protection mechanism means that records that 
arrive for future epochs update the replay protection "window" before the MAC 
for the record has been validated. This could be exploited by an attacker by 
sending a record for the next epoch (which does not have to decrypt or have a 
valid MAC), with a very large sequence number. This means that all subsequent 
legitimate packets are dropped causing a denial of service for a specific 
DTLS connection.

OpenSSL 1.0.2 DTLS users should upgrade to 1.0.2i 
OpenSSL 1.0.1 DTLS users should upgrade to 1.0.1u

This issue was reported to OpenSSL on 21st November 2015 by the OCAP audit team. 
The fix was developed by Matt Caswell of the OpenSSL development team.

Certificate message OOB reads (CVE-2016-6306) 
=============================================

安全等级:低

在OpenSSL的1.0.2及更早版本中,缺少对一些消息长度的校验,导致内存越界读取,在理论上允许拒绝服务攻击

In OpenSSL 1.0.2 and earlier some missing message length checks can result in 
OOB reads of up to 2 bytes beyond an allocated buffer. There is a theoretical 
DoS risk but this has not been observed in practice on common platforms.

The messages affected are client certificate, client certificate request and 
server certificate. As a result the attack can only be performed against 
a client or a server which enables client authentication.

OpenSSL 1.1.0 is not affected.

OpenSSL 1.0.2 users should upgrade to 1.0.2i 
OpenSSL 1.0.1 users should upgrade to 1.0.1u

Excessive allocation of memory in tls_get_message_header() (CVE-2016-6307) 
==========================================================================

安全等级:低

tls_get_message_header()函数存在检查缺陷,导致攻击者可以通过精心构造的数据包,使内存过度分配,进而借此大量消耗服务器的内存导致拒绝服务

A TLS message includes 3 bytes for its length in the header for the message. 
This would allow for messages up to 16Mb in length. Messages of this length are 
excessive and OpenSSL includes a check to ensure that a peer is sending 
reasonably sized messages in order to avoid too much memory being consumed to 
service a connection. A flaw in the logic of version 1.1.0 means that memory for 
the message is allocated too early, prior to the excessive message length 
check. Due to way memory is allocated in OpenSSL this could mean an attacker 
could force up to 21Mb to be allocated to service a connection. This could lead 
to a Denial of Service through memory exhaustion. However, the excessive message 
length check still takes place, and this would cause the connection to 
immediately fail. Assuming that the application calls SSL_free() on the failed 
conneciton in a timely manner then the 21Mb of allocated memory will then be 
immediately freed again. Therefore the excessive memory allocation will be 
transitory in nature. This then means that there is only a security impact if:

1) The application does not call SSL_free() in a timely manner in the 
event that the connection fails 
or 
2) The application is working in a constrained environment where there 
is very little free memory 
or 
3) The attacker initiates multiple connection attempts such that there 
are multiple connections in a state where memory has been allocated for 
the connection; SSL_free() has not yet been called; and there is 
insufficient memory to service the multiple requests.

Except in the instance of (1) above any Denial Of Service is likely to 
be transitory because as soon as the connection fails the memory is 
subsequently freed again in the SSL_free() call. However there is an 
increased risk during this period of application crashes due to the lack 
of memory - which would then mean a more serious Denial of Service.

This issue does not affect DTLS users.

OpenSSL 1.1.0 TLS users should upgrade to 1.1.0a

Excessive allocation of memory in dtls1_preprocess_fragment() (CVE-2016-6308) 
=============================================================================

安全等级:低

dtls1_preprocess_fragment()存在检查缺陷,导致服务器的内存可以过度分配,进而以前拒绝服务攻击

This issue is very similar to CVE-2016-6307. The underlying defect is different 
but the security analysis and impacts are the same except that it impacts DTLS.

A DTLS message includes 3 bytes for its length in the header for the message. 
This would allow for messages up to 16Mb in length. Messages of this length are 
excessive and OpenSSL includes a check to ensure that a peer is sending 
reasonably sized messages in order to avoid too much memory being consumed to 
service a connection. A flaw in the logic of version 1.1.0 means that memory for 
the message is allocated too early, prior to the excessive message length 
check. Due to way memory is allocated in OpenSSL this could mean an attacker 
could force up to 21Mb to be allocated to service a connection. This could lead 
to a Denial of Service through memory exhaustion. However, the excessive message 
length check still takes place, and this would cause the connection to 
immediately fail. Assuming that the application calls SSL_free() on the failed 
conneciton in a timely manner then the 21Mb of allocated memory will then be 
immediately freed again. Therefore the excessive memory allocation will be 
transitory in nature. This then means that there is only a security impact if:

1) The application does not call SSL_free() in a timely manner in the event that the connection fails 
2) The application is working in a constrained environment where there is very little free memory 
3) The attacker initiates multiple connection attempts such that there are multiple connections in a state where memory has been allocated for the connection; SSL_free() has not yet been called; and there is insufficient memory to service the multiple requests.

Except in the instance of (1) above any Denial Of Service is likely to 
be transitory because as soon as the connection fails the memory is 
subsequently freed again in the SSL_free() call. However there is an 
increased risk during this period of application crashes due to the lack 
of memory - which would then mean a more serious Denial of Service.

This issue does not affect TLS users.

OpenSSL 1.1.0 DTLS users should upgrade to 1.1.0a

声明

As per our previous announcements and our Release Strategy (https://www.openssl.org/policies/releasestrat.html), support for OpenSSL version 1.0.1 will cease on 31st December 2016. No security updates for that version will be provided after that date. Users of 1.0.1 are advised to upgrade.

Support for versions 0.9.8 and 1.0.0 ended on 31st December 2015. Those versions are no longer receiving security updates.

参考信息

URL for this Security Advisory: 
https://www.openssl.org/news/secadv/20160922.txt

Note: the online version of the advisory may be updated with additional details 
over time.

For details of OpenSSL severity classifications please see: 
https://www.openssl.org/policies/secpolicy.html



原文发布时间:2017年3月24日

本文由:安全加 发布,版权归属于原作者

原文链接:http://toutiao.secjia.com/openssl-security-advisory-cve-2016-6304

本文来自云栖社区合作伙伴安全加,了解相关信息可以关注安全加网站

上一篇:安全系列之二:如何利用IPSec(证书)保证远程桌面的安全性!(下)


下一篇:详解如何在云端搭建代码管理环境