Bug 1060955 (CVE-2014-1491)
|Summary:||CVE-2014-1491 nss: Do not allow p-1 as a public DH value (MFSA 2014-12)|
|Product:||[Other] Security Response||Reporter:||Huzaifa S. Sidhpurwala <huzaifas>|
|Component:||vulnerability||Assignee:||Red Hat Product Security <security-response-team>|
|Status:||CLOSED ERRATA||QA Contact:|
|Version:||unspecified||CC:||emaldona, jkurik, jrusnack, pfrields, security-response-team|
|Fixed In Version:||nss 3.15.4||Doc Type:||Bug Fix|
It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server.
|Last Closed:||2014-09-18 03:05:48 UTC||Type:||---|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Cloudforms Team:||---||Target Upstream Version:|
|Bug Depends On:||1101846, 1113849, 1113853|
|Bug Blocks:||1054104, 1063682|
Description Huzaifa S. Sidhpurwala 2014-02-04 02:26:12 UTC
1. Create a TLS server supporting only the DHE key exchange. 2. During any handshake, send the parameters <p, g, g^q> where p=2q+1 is a prime such that q is also prime and g is not a quadratic residue mod p 3. NSS accepts this value and proceeds with the handshake. The PMS computed by NSS is g^(q*Kc) Actual results: NSS accepts to proceed with the exchange. If g is not a quadratic residue mod p, then g^q = p-1 which is not rejected by NSS as it accepts any public value in [2, p-1] (this is allowed by rfc2631). Then, the computed PMS g^(q*Kc) is 1 if Kc is even (because g^(2q)=g^(p-1)=1 [mod p]) and p-1 if Kc is odd (because g^q=p-1 [mod p]). If the server chose a Ks with the same parity, the PMS will be the same on the client and server but the communication is not safe because an attacker can derive it from the parameters sent over the network. Acknowledgements: Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Antoine Delignat-Lavaud and Karthikeyan Bhargavan as the original reporters.
Comment 1 Vincent Danen 2014-02-04 18:15:06 UTC
External References: http://www.mozilla.org/security/announce/2014/mfsa2014-12.html
Comment 3 Tomas Hoger 2014-02-05 09:14:29 UTC
Upstream advisory MFSA 2014-12 (see comment 1) links the following upstream bug as related to this CVE: https://bugzilla.mozilla.org/show_bug.cgi?id=934545 Upstream bug is currently private, however, the following nss upstream commit references the above upstream bug: http://hg.mozilla.org/projects/nss/rev/12c42006aed8
Comment 4 Huzaifa S. Sidhpurwala 2014-03-10 09:21:18 UTC
This issue has been resolved in nss-3.15.4. Fedora 19 and Fedora 20 currently ship nss-3.15.5 and therefore is not vulnerable to this issue.
Comment 5 Huzaifa S. Sidhpurwala 2014-03-10 09:23:59 UTC
Comment 10 errata-xmlrpc 2014-07-22 18:00:28 UTC
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2014:0917 https://rhn.redhat.com/errata/RHSA-2014-0917.html
Comment 11 Martin Prpič 2014-07-28 11:37:08 UTC
IssueDescription: It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server.
Comment 12 errata-xmlrpc 2014-07-29 14:40:32 UTC
This issue has been addressed in following products: RHEV-H and Agents for RHEL-6 Via RHSA-2014:0979 https://rhn.redhat.com/errata/RHSA-2014-0979.html