Red Hat Bugzilla – Bug 1039801
CVE-2013-6418 pywbem: TOCTOU vulnerability in certificate validation
Last modified: 2015-01-21 04:27:32 EST
Florian Weimer discovered a TOCTOU (time of check to time of use) vulnerability in the way PyWBEM, a Python library for making CIM (Common Information Model) operations over HTTP using the WBEM CIM-XML protocol, performed certificate validation. An attacker could use this flaw to perform man-in-the-middle attacks against applications that are using PyWBEM. Acknowledgements: This issue was discovered by Florian Weimer of the Red Hat Product Security Team.
In depth information from Florian: I noticed this code in cim_http.py: 124 try: 125 from OpenSSL import SSL 126 ctx = SSL.Context(SSL.SSLv3_METHOD) 127 ctx.set_verify(SSL.VERIFY_PEER, verify_callback) 128 # Add the key and certificate to the session 129 if cert_file is not None and key_file is not None: 130 ctx.use_certificate_file(cert_file) 131 ctx.use_privatekey_file(key_file) 132 s = SSL.Connection(ctx, socket.socket(socket.AF_INET, 133 socket.SOCK_STREAM)) 134 s.connect((host, port)) 135 s.do_handshake() 136 s.shutdown() 137 s.close() 138 except socket.error, arg: 139 raise Error("Socket error: %s" % (arg,)) 140 except socket.sslerror, arg: 141 raise Error("SSL error: %s" % (arg,)) 151 h = HTTPSConnection(host, port = port, key_file = key_file, 152 cert_file = cert_file) verify_callback is only used for the probing connection, it is not used for the actual server interaction. This means pywbem has a time-of-check-time-of-use vulnerability and man-in-the-middle attacks on the second HTTPS connection are possible.
Public now via a Fedora build. Note that the fix there may not be the correct one. Refer to http://seclists.org/oss-sec/2013/q4/524 for further details.
Created attachment 851357 [details] final fix Final fix. This patch corrects CVE-2013-6418 (bug 1039801) and CVE-2013-6444 (bug 1044246)
(In reply to Murray McAllister from comment #4) > Created attachment 851357 [details] > final fix > > Final fix. This patch corrects CVE-2013-6418 (bug 1039801) and CVE-2013-6444 > (bug 1044246) Upstream commit: http://sourceforge.net/p/pywbem/code/627/
> Upstream commit: > > http://sourceforge.net/p/pywbem/code/627/ This one is also needed: http://sourceforge.net/p/pywbem/code/622/
Created pywbem tracking bugs for this issue: Affects: epel-5 [bug 1065357]
Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.