Bug 1060955 (CVE-2014-1491)

Summary:	CVE-2014-1491 nss: Do not allow p-1 as a public DH value (MFSA 2014-12)
Product:	[Other] Security Response	Reporter:	Huzaifa S. Sidhpurwala <huzaifas>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	emaldona, jkurik, jrusnack, pfrields, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	nss 3.15.4	Doc Type:	Bug Fix
Doc Text:	It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-09-18 03:05:48 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1101846, 1113849, 1113853
Bug Blocks:	1054104, 1063682

Description Huzaifa S. Sidhpurwala 2014-02-04 02:26:12 UTC

1. Create a TLS server supporting only the DHE key exchange.
2. During any handshake, send the parameters <p, g, g^q> where p=2q+1 is a prime such that q is also prime and g is not a quadratic residue mod p
3. NSS accepts this value and proceeds with the handshake. The PMS computed by NSS is g^(q*Kc)


Actual results:

NSS accepts to proceed with the exchange. If g is not a quadratic residue mod p, then g^q = p-1 which is not rejected by NSS as it accepts any public value in [2, p-1] (this is allowed by rfc2631). Then, the computed PMS g^(q*Kc) is 1 if Kc is even (because g^(2q)=g^(p-1)=1 [mod p]) and p-1 if Kc is odd (because g^q=p-1 [mod p]). If the server chose a Ks with the same parity, the PMS will be the same on the client and server but the communication is not safe because an attacker can derive it from the parameters sent over the network.


Acknowledgements:

Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Antoine Delignat-Lavaud and Karthikeyan Bhargavan as the original reporters.

Comment 1 Vincent Danen 2014-02-04 18:15:06 UTC

External References:

http://www.mozilla.org/security/announce/2014/mfsa2014-12.html

Comment 3 Tomas Hoger 2014-02-05 09:14:29 UTC

Upstream advisory MFSA 2014-12 (see comment 1) links the following upstream bug as related to this CVE:

https://bugzilla.mozilla.org/show_bug.cgi?id=934545

Upstream bug is currently private, however, the following nss upstream commit references the above upstream bug:

http://hg.mozilla.org/projects/nss/rev/12c42006aed8

Comment 4 Huzaifa S. Sidhpurwala 2014-03-10 09:21:18 UTC

This issue has been resolved in nss-3.15.4.

Fedora 19 and Fedora 20 currently ship nss-3.15.5 and therefore is not vulnerable to this issue.

Comment 5 Huzaifa S. Sidhpurwala 2014-03-10 09:23:59 UTC

Statement:

(none)

Comment 10 errata-xmlrpc 2014-07-22 18:00:28 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2014:0917 https://rhn.redhat.com/errata/RHSA-2014-0917.html

Comment 11 Martin Prpič 2014-07-28 11:37:08 UTC

IssueDescription:

It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server.

Comment 12 errata-xmlrpc 2014-07-29 14:40:32 UTC

This issue has been addressed in following products:

  RHEV-H and Agents for RHEL-6

Via RHSA-2014:0979 https://rhn.redhat.com/errata/RHSA-2014-0979.html

Comment 13 errata-xmlrpc 2014-09-16 05:39:34 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5

Via RHSA-2014:1246 https://rhn.redhat.com/errata/RHSA-2014-1246.html