Bug 1171965 (CVE-2014-8730)

Summary:	CVE-2014-8730 TLS: incorrect check of padding bytes when using CBC cipher suites
Product:	[Other] Security Response	Reporter:	Huzaifa S. Sidhpurwala <huzaifas>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	emaldona, kdudka, kengert, nmavrogi, tmraz
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-12-09 14:08:57 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1171966

Description Huzaifa S. Sidhpurwala 2014-12-09 06:09:27 UTC

It was found that incorrect TLS padding could be accepted when terminating TLS 1.x CBC cipher connections. As per the TLS standard, TLS's padding is a subset of SSL3.0's padding, so implementations which used SSL 3.0 padding with TLS connections, could be vulnerable to CBC padding attacks similar to POODLE.

References:

https://www.imperialviolet.org/2014/12/08/poodleagain.html
https://devcentral.f5.com/articles/cve-2014-8730-padding-issue-8151

Comment 1 Huzaifa S. Sidhpurwala 2014-12-09 06:15:18 UTC

Note:

No CVE has been assigned to this flaw, since we are waiting for clarification from MITRE via:

http://www.openwall.com/lists/oss-security/2014/12/09/6

Comment 4 Huzaifa S. Sidhpurwala 2014-12-09 09:03:06 UTC

The versions of NSS library shipped in Red Hat Enterprise Linux verify all the padding bytes in TLS 1.0 record protocol packets.

Upstream bug:
https://bugzilla.mozilla.org/show_bug.cgi?id=571796

Relevant commit:
https://hg.mozilla.org/projects/nss/rev/4bfacb48184f

This issue was fixed in NSS 3.12.7

Comment 5 Huzaifa S. Sidhpurwala 2014-12-09 09:07:14 UTC

Similar to comment #4, the versions of openssl and gnutls shipped in all version of Red Hat Enterprise Linux does not suffer from this implementation bug and therefore are not vulnerable.

Comment 6 Tomas Hoger 2014-12-09 09:14:41 UTC

(In reply to Huzaifa S. Sidhpurwala from comment #4)
> This issue was fixed in NSS 3.12.7

Note that older NSS versions were shipped in Red Hat Enterprise Linux 5 and earlier.  All currently supported versions / streams of Red Hat Enterprise Linux 4 and 5 already provide NSS version 3.12.8 or newer, and hence contain the fix linked in comment #4.

Comment 8 Huzaifa S. Sidhpurwala 2014-12-09 14:08:57 UTC

As discussed in comments above, this is not a protocol flaw, rather a bug in implementation of certain crypto libraries. And the ones shipped with Red Hat Enterprise Linux are not affected.


Statement:

Not vulnerable. This issue does not affect the version of openssl, nss and gnutls as shipped in Red Hat Enterprise Linux 5, 6 and 7.

Comment 10 Tomas Hoger 2014-12-09 19:23:56 UTC

(In reply to Huzaifa S. Sidhpurwala from comment #4)
> This issue was fixed in NSS 3.12.7

It should be noted that prior to the NSS fix linked in comment #4, NSS only checked the first padding byte and did not check remaining bytes.  Due to this check, it may not be flagged as affected by this issue by scanners checking for this problem.  The check also increases the attack difficulty.