Fix reachable assert in SSLv2 servers.
authorEmilia Kasper <emilia@openssl.org>
Wed, 4 Mar 2015 17:05:02 +0000 (09:05 -0800)
committerMatt Caswell <matt@openssl.org>
Thu, 19 Mar 2015 12:58:35 +0000 (12:58 +0000)
commit86f8fb0e344d62454f8daf3e15236b2b59210756
tree60dfd04aea8199ad46fe8121794a334fef21d9aa
parentc0334c2c92dd1bc3ad8138ba6e74006c3631b0f9
Fix reachable assert in SSLv2 servers.

This assert is reachable for servers that support SSLv2 and export ciphers.
Therefore, such servers can be DoSed by sending a specially crafted
SSLv2 CLIENT-MASTER-KEY.

Also fix s2_srvr.c to error out early if the key lengths are malformed.
These lengths are sent unencrypted, so this does not introduce an oracle.

CVE-2015-0293

This issue was discovered by Sean Burford (Google) and Emilia K√§sper of
the OpenSSL development team.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
ssl/s2_lib.c
ssl/s2_srvr.c