Date: Tue, 17 Sep 2002 12:03:16 +1000
From: NetBSD Security Officer <security-officer@netbsd.org.>
To: [email protected]Subject: NetBSD Security Advisory 2002-009:
-----BEGIN PGP SIGNED MESSAGE-----
NetBSD Security Advisory 2002-009
(updated 2002/9/16)
Topic: Multiple vulnerabilities in OpenSSL code
Version: NetBSD-current: source prior to August 10, 2002
NetBSD-1.6 beta: affected
NetBSD-1.5.3: affected
NetBSD-1.5.2: affected
NetBSD-1.5.1: affected
NetBSD-1.5: affected
NetBSD-1.4.*: not applicable
pkgsrc: prior to openssl-0.9.6f
Severity: Potential for remote root exploit
Fixed: NetBSD-current: August 10, 2002
NetBSD-1.6 branch: August 11, 2002 (1.6 includes the fix)
NetBSD-1.5 branch: August 31, 2002
pkgsrc: openssl-0.9.6f (or later)
NOTE: previous advisory had fixed dates prior to August 10.
There were errors found in the vendor-supplied fix, therefore
the fixed dates were modified. Sorry for the confusion and
thanks for the patience.
NOTE: previous revision of advisory suggested that 1.5 branch
was fixed on August 1, however the fix was found to be
insufficient. Therefore, users of 1.5 should apply the fix
presented in this revised advisory. Sorry for the confusion
and thanks for the patience.
Abstract
========
There are multiple vulnerabilities found in openssl 0.9.6e and prior
releases. There are four remotely-exploitable buffer overruns in SSL2/3
code. The ASN1 parser can be confused by invalid encodings (SSL/TLS
code affected).
None of these services are enabled by default in NetBSD, however, by
enabling services built with these libraries, a system would become
vulnerable.
- From the OpenSSL advisory:
"Everyone using OpenSSL 0.9.6d or earlier, or 0.9.7-beta2 or earlier or
current development snapshots of 0.9.7 to provide SSL or TLS is
vulnerable, whether client or server. 0.9.6d servers on 32-bit systems
with SSL 2.0 disabled are not vulnerable."
After the above advisory was published,
- 0.9.6e was found to be vulnerable, and 0.9.6f was released.
- 0.9.6f had some build framework errors, and 0.9.6g was released.
The NetBSD fix includes OpenSSL 0.9.6g.
Technical Details
=================
http://www.openssl.org/news/secadv_20020730.txt
http://CERT.Uni-Stuttgart.DE/advisories/c-integer-overflow.php
Solutions and Workarounds
The recent NetBSD 1.6 release is not vulnerable to this issue. A full
upgrade to NetBSD 1.6 is the recommended resolution for all users able
to do so. Many security-related improvements have been made, and
indeed this release has been delayed several times in order to include
fixes for a number of recent issues.
The following instructions describe how to upgrade your libcrypto/libssl
binaries by updating your source tree and rebuilding and
installing a new version of libcrypto/libssl.
Be sure to restart running instances of programs that use crypto libraries
(like sshd) after upgrading shared libraries.
If you have any statically-linked binaries that linked against a
vulnerable libcrypto and/or libssl, you need to recompile them.
* NetBSD-current:
Systems running NetBSD-current dated from before 2002-08-10
should be upgraded to NetBSD-current dated 2002-08-10 or later.
The following directories need to be updated from the
netbsd-current CVS branch (aka HEAD):
crypto/Makefile.openssl
crypto/dist/openssl
lib/libcrypto
lib/libssl
To update from CVS, re-build, and re-install libcrypto and libssl:
# cd src
# cvs update -d -P crypto/Makefile.openssl crypto/dist/openssl \
lib/libcrypto lib/libssl
# make includes
# cd lib/libcrypto
# make cleandir dependall
# make install
# cd ../../lib/libssl
# make cleandir dependall
# make install
* NetBSD 1.6 beta:
Systems running NetBSD 1.6 BETAs and Release Candidates should
be upgraded to the NetBSD 1.6 release.
If a source-based point upgrade is required, sources from the
NetBSD 1.6 branch dated 2002-08-11 or later should be used.
The following directories need to be updated from the
netbsd-1-6 CVS branch:
crypto/Makefile.openssl
crypto/dist/openssl
lib/libcrypto
lib/libssl
To update from CVS, re-build, and re-install libcrypto and libssl:
# cd src
# cvs update -d -P -r netbsd-1-6 crypto/Makefile.openssl \
crypto/dist/openssl lib/libcrypto lib/libssl
# make includes
# cd lib/libcrypto
# make cleandir dependall
# make install
# cd ../../lib/libssl
# make cleandir dependall
# make install
* NetBSD 1.5, 1.5.1, 1.5.2, 1.5.3:
Systems running NetBSD-1.5.x dated from before 2002-08-31
should be upgraded to NetBSD-1.5 branch dated 2002-08-31 or later.
The following directories need to be updated from the
netbsd-1-5 CVS branch. Due to the shlib major bump in libcrypto/libssl
large number of shared libraries has to be rebuilt:
crypto/Makefile.openssl
crypto/dist/openssl
lib/libasn1
lib/libcom_err
lib/libcrypto
lib/libgssapi
lib/libhdb
lib/libkadm
lib/libkadm5clnt
lib/libkadm5srv
lib/libkafs
lib/libkdb
lib/libkrb
lib/libkrb5
lib/libkstream
lib/libroken
lib/libsl
lib/libss
lib/libtelnet
usr.bin/openssl
To update from CVS, re-build, and re-install libcrypto and libssl:
# cd src
# cvs update -d -P -r netbsd-1-5 <directories listed above>
# make includes
# cd lib
# make cleandir dependall
# make install
# cd usr.bin/openssl
# make cleandir dependall
# make install
* NetBSD 1.4, 1.4.1, 1.4.2, 1.4.3:
OpenSSL was not included in the base system in NetBSD-1.4.*
Follow the directions for pkgsrc if you have installed it from
pkgsrc.
* pkgsrc:
openssl (pkgsrc/security/openssl) prior to 0.9.6f are
vulnerable. Upgrade to openssl-0.9.6f or later; pkgsrc
currently contains 0.9.6g at time of this writing.
Packages which require openssl can be found by running 'pkg_info
openssl'. Depending on the method you choose to update pkgsrc
packages, a rebuild of the packages on that list may be
performed for you by the package system. If you update using the
experimental 'make replace' target, you will need to manually
update any packages which build static binaries with libssl.a
and libcrypto.a
If you have statically linked binaries in pkgsrc, they have to be
rebuilt. Statically linked binaries can be identified by the
following command (note: be sure to include the directory you install
pkgsrc binaries to, if you've changed LOCALBASE from the default of
/usr/pkg)
file /usr/pkg/{bin,sbin,libexec} | grep static
Thanks To
=========
A.L. Digital Ltd and John McDonald of Neohapsis.
Adi Stav and James Yonan.
CERT and the OpenSSL team.
Jun-ichiro itojun Hagino for maintenance of OpenSSL in the NetBSD
source tree, and preparing the initial advisory text.
The NetBSD Release Engineering teams, for great patience and
assistance in dealing with repeated security issues discovered
recently.
Revision History
================
2002-08-01 Initial release based on 0.9.6e
2002-08-11 based on 0.9.6f
2002-08-31 1.5 pullup done, 0.9.6g
2002-09-16 Re-release with updated information
More Information
================
An up-to-date PGP signed copy of this release will be maintained at
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-009.txt.asc
Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/.
Copyright 2002, The NetBSD Foundation, Inc. All Rights Reserved.
$NetBSD: NetBSD-SA2002-009.txt,v 1.35 2002/09/16 05:17:55 dan Exp $
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv
iQCVAwUBPYVqAD5Ru2/4N2IFAQHqtwQAluG+9I3pVeALK+p+X3ZNG99M2zx6y/Ea
IX7kS8M22PoZD6kJniBRWqcDfaYqj5FKHT1TlCAiehNUpQfdADQD/0i/nqX01puI
aCCLXIetnRwSmQdW3IcbWqs5NQvHuWOB+ng1t5DBF1rF9GPTRMmrv5Sjr27hl07X
+ta7U3VZCms=
=SEqH
-----END PGP SIGNATURE-----
