Red Hat Bugzilla – Bug 1171965
CVE-2014-8730 TLS: incorrect check of padding bytes when using CBC cipher suites
Last modified: 2014-12-09 14:23:56 EST
It was found that incorrect TLS padding could be accepted when terminating TLS 1.x CBC cipher connections. As per the TLS standard, TLS's padding is a subset of SSL3.0's padding, so implementations which used SSL 3.0 padding with TLS connections, could be vulnerable to CBC padding attacks similar to POODLE. References: https://www.imperialviolet.org/2014/12/08/poodleagain.html https://devcentral.f5.com/articles/cve-2014-8730-padding-issue-8151
Note: No CVE has been assigned to this flaw, since we are waiting for clarification from MITRE via: http://www.openwall.com/lists/oss-security/2014/12/09/6
The versions of NSS library shipped in Red Hat Enterprise Linux verify all the padding bytes in TLS 1.0 record protocol packets. Upstream bug: https://bugzilla.mozilla.org/show_bug.cgi?id=571796 Relevant commit: https://hg.mozilla.org/projects/nss/rev/4bfacb48184f This issue was fixed in NSS 3.12.7
Similar to comment #4, the versions of openssl and gnutls shipped in all version of Red Hat Enterprise Linux does not suffer from this implementation bug and therefore are not vulnerable.
(In reply to Huzaifa S. Sidhpurwala from comment #4) > This issue was fixed in NSS 3.12.7 Note that older NSS versions were shipped in Red Hat Enterprise Linux 5 and earlier. All currently supported versions / streams of Red Hat Enterprise Linux 4 and 5 already provide NSS version 3.12.8 or newer, and hence contain the fix linked in comment #4.
As discussed in comments above, this is not a protocol flaw, rather a bug in implementation of certain crypto libraries. And the ones shipped with Red Hat Enterprise Linux are not affected. Statement: Not vulnerable. This issue does not affect the version of openssl, nss and gnutls as shipped in Red Hat Enterprise Linux 5, 6 and 7.
(In reply to Huzaifa S. Sidhpurwala from comment #4) > This issue was fixed in NSS 3.12.7 It should be noted that prior to the NSS fix linked in comment #4, NSS only checked the first padding byte and did not check remaining bytes. Due to this check, it may not be flagged as affected by this issue by scanners checking for this problem. The check also increases the attack difficulty.