Bug 1171965 (CVE-2014-8730) - CVE-2014-8730 TLS: incorrect check of padding bytes when using CBC cipher suites
Summary: CVE-2014-8730 TLS: incorrect check of padding bytes when using CBC cipher suites
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2014-8730
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1171966
TreeView+ depends on / blocked
 
Reported: 2014-12-09 06:09 UTC by Huzaifa S. Sidhpurwala
Modified: 2021-02-17 05:55 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-12-09 14:08:57 UTC
Embargoed:


Attachments (Terms of Use)

Description Huzaifa S. Sidhpurwala 2014-12-09 06:09:27 UTC
It was found that incorrect TLS padding could be accepted when terminating TLS 1.x CBC cipher connections. As per the TLS standard, TLS's padding is a subset of SSL3.0's padding, so implementations which used SSL 3.0 padding with TLS connections, could be vulnerable to CBC padding attacks similar to POODLE.

References:

https://www.imperialviolet.org/2014/12/08/poodleagain.html
https://devcentral.f5.com/articles/cve-2014-8730-padding-issue-8151

Comment 1 Huzaifa S. Sidhpurwala 2014-12-09 06:15:18 UTC
Note:

No CVE has been assigned to this flaw, since we are waiting for clarification from MITRE via:

http://www.openwall.com/lists/oss-security/2014/12/09/6

Comment 4 Huzaifa S. Sidhpurwala 2014-12-09 09:03:06 UTC
The versions of NSS library shipped in Red Hat Enterprise Linux verify all the padding bytes in TLS 1.0 record protocol packets.

Upstream bug:
https://bugzilla.mozilla.org/show_bug.cgi?id=571796

Relevant commit:
https://hg.mozilla.org/projects/nss/rev/4bfacb48184f

This issue was fixed in NSS 3.12.7

Comment 5 Huzaifa S. Sidhpurwala 2014-12-09 09:07:14 UTC
Similar to comment #4, the versions of openssl and gnutls shipped in all version of Red Hat Enterprise Linux does not suffer from this implementation bug and therefore are not vulnerable.

Comment 6 Tomas Hoger 2014-12-09 09:14:41 UTC
(In reply to Huzaifa S. Sidhpurwala from comment #4)
> This issue was fixed in NSS 3.12.7

Note that older NSS versions were shipped in Red Hat Enterprise Linux 5 and earlier.  All currently supported versions / streams of Red Hat Enterprise Linux 4 and 5 already provide NSS version 3.12.8 or newer, and hence contain the fix linked in comment #4.

Comment 8 Huzaifa S. Sidhpurwala 2014-12-09 14:08:57 UTC
As discussed in comments above, this is not a protocol flaw, rather a bug in implementation of certain crypto libraries. And the ones shipped with Red Hat Enterprise Linux are not affected.


Statement:

Not vulnerable. This issue does not affect the version of openssl, nss and gnutls as shipped in Red Hat Enterprise Linux 5, 6 and 7.

Comment 10 Tomas Hoger 2014-12-09 19:23:56 UTC
(In reply to Huzaifa S. Sidhpurwala from comment #4)
> This issue was fixed in NSS 3.12.7

It should be noted that prior to the NSS fix linked in comment #4, NSS only checked the first padding byte and did not check remaining bytes.  Due to this check, it may not be flagged as affected by this issue by scanners checking for this problem.  The check also increases the attack difficulty.


Note You need to log in before you can comment on or make changes to this bug.