generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

ECDH downgrade bug fix.

Browse Source 
Fix bug where an OpenSSL client would accept a handshake using an
ephemeral ECDH ciphersuites with the server key exchange message omitted.

Thanks to Karthikeyan Bhargavan for reporting this issue.

CVE-2014-3572
Reviewed-by: Matt Caswell <matt@openssl.org>

(cherry picked from commit b15f8769644b00ef7283521593360b7b2135cb63)
This commit is contained in:
Dr. Stephen Henson 2014-10-24 12:30:33 +01:00
parent d96c24926d
commit 4aaf1e493c
2 changed files with 22 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
CHANGES
View File

@ -365,6 +365,13 @@
Changes between 1.0.1j and 1.0.1k [xx XXX xxxx] Changes between 1.0.1j and 1.0.1k [xx XXX xxxx]
*) Abort handshake if server key exchange message is omitted for ephemeral
ECDH ciphersuites.
Thanks to Karthikeyan Bhargavan for reporting this issue.
(CVE-2014-3572)
[Steve Henson]
*) Ensure that the session ID context of an SSL is updated when its *) Ensure that the session ID context of an SSL is updated when its
SSL_CTX is updated via SSL_set_SSL_CTX. SSL_CTX is updated via SSL_set_SSL_CTX.

18
ssl/s3_clnt.c
View File

@ -1363,6 +1363,8 @@ int ssl3_get_key_exchange(SSL *s)
int encoded_pt_len = 0; int encoded_pt_len = 0;
#endif #endif
EVP_MD_CTX_init(&md_ctx);
/* use same message size as in ssl3_get_certificate_request() /* use same message size as in ssl3_get_certificate_request()
* as ServerKeyExchange message may be skipped */ * as ServerKeyExchange message may be skipped */
n=s->method->ssl_get_message(s, n=s->method->ssl_get_message(s,
@ -1373,14 +1375,26 @@ int ssl3_get_key_exchange(SSL *s)
&ok); &ok);
if (!ok) return((int)n); if (!ok) return((int)n);
alg_k=s->s3->tmp.new_cipher->algorithm_mkey;
if (s->s3->tmp.message_type != SSL3_MT_SERVER_KEY_EXCHANGE) if (s->s3->tmp.message_type != SSL3_MT_SERVER_KEY_EXCHANGE)
{ {
/*
* Can't skip server key exchange if this is an ephemeral
* ciphersuite.
*/
if (alg_k & (SSL_kDHE|SSL_kECDHE))
{
SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_UNEXPECTED_MESSAGE);
al = SSL_AD_UNEXPECTED_MESSAGE;
goto f_err;
}
#ifndef OPENSSL_NO_PSK #ifndef OPENSSL_NO_PSK
/* In plain PSK ciphersuite, ServerKeyExchange can be /* In plain PSK ciphersuite, ServerKeyExchange can be
omitted if no identity hint is sent. Set omitted if no identity hint is sent. Set
session->sess_cert anyway to avoid problems session->sess_cert anyway to avoid problems
later.*/ later.*/
if (s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK) if (alg_k & SSL_kPSK)
{ {
s->session->sess_cert=ssl_sess_cert_new(); s->session->sess_cert=ssl_sess_cert_new();
if (s->ctx->psk_identity_hint) if (s->ctx->psk_identity_hint)
@ -1425,9 +1439,7 @@ int ssl3_get_key_exchange(SSL *s)
/* Total length of the parameters including the length prefix */ /* Total length of the parameters including the length prefix */
param_len=0; param_len=0;
alg_k=s->s3->tmp.new_cipher->algorithm_mkey;
alg_a=s->s3->tmp.new_cipher->algorithm_auth; alg_a=s->s3->tmp.new_cipher->algorithm_auth;
EVP_MD_CTX_init(&md_ctx);
al=SSL_AD_DECODE_ERROR; al=SSL_AD_DECODE_ERROR;