Bug 1221673 (CVE-2015-3644)

Summary:	CVE-2015-3644 stunnel: authentication bypass with the "redirect" option
Product:	[Other] Security Response	Reporter:	Martin Prpič <mprpic>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	avagarwa, carnil
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	stunnel 5.14	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-05-14 14:17:00 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1221674
Bug Blocks:

Description Martin Prpič 2015-05-14 14:15:50 UTC

The following flaw was found in stunnel:

Normally, clients are connected to the host(s) specified with the "connect" option on authentication success, and rejected on authentication failure (untrusted client certificate). When the "redirect" option is specified, such connections are supposed to be forwarded to the host(s) specified with "redirect" rather then rejected.

In Stunnel versions 5.00 to 5.13, only the initial connection is redirected to the host(s) specified with "redirect". The subsequent connections established with reused SSL/TLS sessions are always forwarded to the host(s) specified with "connect" as if they were successfully authenticated.

The vulnerability is exploitable under the following conditions:

- Stunnel versions 5.00 to 5.13 inclusive.
- Server mode mode is enabled with "client = no" (which is the default).
- Certificate-based authentication is enabled with "verify = 2" or higher.
- The "redirect" option is used.

Upstream advisory:

https://www.stunnel.org/CVE-2015-3644.html

Comment 1 Martin Prpič 2015-05-14 14:16:11 UTC

Created stunnel tracking bugs for this issue:

Affects: fedora-all [bug 1221674]

Comment 2 Martin Prpič 2015-05-14 14:17:00 UTC

Statement:

Not vulnerable. This issue did not affect the versions of stunnel as shipped with Red Hat Enterprise Linux 5, 6, and 7.