CVE-2010-4180 fix (from OpenSSL_1_0_0-stable)

diff --git a/CHANGES b/CHANGES
index c5a488e9ceb1051c5e7dc957e5d2a55c32601887..caa829646a2396b9b5240eb48a20404e59632bc5 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -50,6 +50,11 @@
 
  Changes between 1.0.0b and 1.0.0c  [2 Dec 2010]
 
 
  Changes between 1.0.0b and 1.0.0c  [2 Dec 2010]
 

+  *) Disable code workaround for ancient and obsolete Netscape browsers
+     and servers: an attacker can use it in a ciphersuite downgrade attack.
+     Thanks to Martin Rex for discovering this bug. CVE-2010-4180
+     [Steve Henson]
+

   *) Fixed J-PAKE implementation error, originally discovered by
      Sebastien Martini, further info and confirmation from Stefan
      Arentz and Feng Hao. Note that this fix is a security fix. CVE-2010-4252
   *) Fixed J-PAKE implementation error, originally discovered by
      Sebastien Martini, further info and confirmation from Stefan
      Arentz and Feng Hao. Note that this fix is a security fix. CVE-2010-4252


@@ -60,6 +65,7 @@
   *) Fix extension code to avoid race conditions which can result in a buffer
      overrun vulnerability: resumed sessions must not be modified as they can
      be shared by multiple threads. CVE-2010-3864
   *) Fix extension code to avoid race conditions which can result in a buffer
      overrun vulnerability: resumed sessions must not be modified as they can
      be shared by multiple threads. CVE-2010-3864

+     [Steve Henson]

 
   *) Fix WIN32 build system to correctly link an ENGINE directory into
      a DLL. 
 
   *) Fix WIN32 build system to correctly link an ENGINE directory into
      a DLL. 

diff --git a/NEWS b/NEWS
index 3a787ea06cef7296aeaaaf2d5a77e74b2d160f53..139c1e02b4509589005c9b5b8c9a404d57f78c04 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,20 @@
   This file gives a brief overview of the major changes between each OpenSSL
   release. For more details please read the CHANGES file.
 
   This file gives a brief overview of the major changes between each OpenSSL
   release. For more details please read the CHANGES file.
 

+  Major changes between OpenSSL 1.0.0b and OpenSSL 1.0.0c:
+
+      o Fix for security issue CVE-2010-4180
+      o Fix for CVE-2010-4252
+      o Fix mishandling of absent EC point format extension.
+      o Fix various platform compilation issues.
+      o Corrected fix for security issue CVE-2010-3864.
+
+  Major changes between OpenSSL 1.0.0a and OpenSSL 1.0.0b:
+
+      o Fix for security issue CVE-2010-3864.
+      o Fix for CVE-2010-2939
+      o Fix WIN32 build system for GOST ENGINE.
+

   Major changes between OpenSSL 1.0.0 and OpenSSL 1.0.0a:
 
       o Fix for security issue CVE-2010-1633.
   Major changes between OpenSSL 1.0.0 and OpenSSL 1.0.0a:
 
       o Fix for security issue CVE-2010-1633.

diff --git a/doc/ssl/SSL_CTX_set_options.pod b/doc/ssl/SSL_CTX_set_options.pod
index 310db84b31429dd036468f5f268de8ae653d787f..cc588f3a78f3a302a4b422bc2fdc9dc55728e5d9 100644 (file)
--- a/doc/ssl/SSL_CTX_set_options.pod
+++ b/doc/ssl/SSL_CTX_set_options.pod
@@ -78,18 +78,7 @@ this breaks this server so 16 bytes is the way to go.
 
 =item SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
 
 
 =item SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
 

-ssl3.netscape.com:443, first a connection is established with RC4-MD5.
-If it is then resumed, we end up using DES-CBC3-SHA.  It should be
-RC4-MD5 according to 7.6.1.3, 'cipher_suite'.
-
-Netscape-Enterprise/2.01 (https://merchant.netscape.com) has this bug.
-It only really shows up when connecting via SSLv2/v3 then reconnecting
-via SSLv3. The cipher list changes....
-
-NEW INFORMATION.  Try connecting with a cipher list of just
-DES-CBC-SHA:RC4-MD5.  For some weird reason, each new connection uses
-RC4-MD5, but a re-connect tries to use DES-CBC-SHA.  So netscape, when
-doing a re-connect, always takes the first cipher in the cipher list.
+As of OpenSSL 0.9.8q and 1.0.0c, this option has no effect.

 
 =item SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
 
 
 =item SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
 

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 8b74e9f53e9afd76eadbb745f6f56d724ebba41b..bf59d798f877f78a66ca6e253aba9610046d7623 100644 (file)
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -867,8 +867,11 @@ int ssl3_get_server_hello(SSL *s)
                s->session->cipher_id = s->session->cipher->id;
        if (s->hit && (s->session->cipher_id != c->id))
                {
                s->session->cipher_id = s->session->cipher->id;
        if (s->hit && (s->session->cipher_id != c->id))
                {

+/* Workaround is now obsolete */
+#if 0

                if (!(s->options &
                        SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG))
                if (!(s->options &
                        SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG))

+#endif

                        {
                        al=SSL_AD_ILLEGAL_PARAMETER;
                        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED);
                        {
                        al=SSL_AD_ILLEGAL_PARAMETER;
                        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED);

diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index b1071da262c07bedb502f20a8b94c94974de24ec..1b99a946a70a99c13c4f7df8ed9305a305db5d99 100644 (file)
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -986,6 +986,10 @@ int ssl3_get_client_hello(SSL *s)
                                break;
                                }
                        }
                                break;
                                }
                        }

+/* Disabled because it can be used in a ciphersuite downgrade
+ * attack: CVE-2010-4180.
+ */
+#if 0

                if (j == 0 && (s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1))
                        {
                        /* Special case as client bug workaround: the previously used cipher may
                if (j == 0 && (s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1))
                        {
                        /* Special case as client bug workaround: the previously used cipher may


@@ -1000,6 +1004,7 @@ int ssl3_get_client_hello(SSL *s)
                                j = 1;
                                }
                        }
                                j = 1;
                                }
                        }

+#endif

                if (j == 0)
                        {
                        /* we need to have the cipher in the cipher
                if (j == 0)
                        {
                        /* we need to have the cipher in the cipher