Bug 1228600 (CVE-2015-1788) - CVE-2015-1788 OpenSSL: Malformed ECParameters causes infinite loop
Summary: CVE-2015-1788 OpenSSL: Malformed ECParameters causes infinite loop
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2015-1788
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20150611,repor...
Depends On: 1228620 1228621
Blocks: 1227577
TreeView+ depends on / blocked
 
Reported: 2015-06-05 10:08 UTC by Huzaifa S. Sidhpurwala
Modified: 2019-06-08 20:37 UTC (History)
22 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
It was reported that OpenSSL could enter an infinite loop when processing an ECParameters structure if the curve specified is over a specially malformed binary polynomial field. This can be used to perform denial of service attacks against any system which processes public keys, certificate requests or certificates, including TLS clients and TLS servers with client authentication enabled.
Clone Of:
Environment:
Last Closed: 2015-06-09 06:20:24 UTC


Attachments (Terms of Use)
Proposed patch for CVE-2015-1788 (1.23 KB, patch)
2015-06-05 10:27 UTC, Huzaifa S. Sidhpurwala
no flags Details | Diff

Description Huzaifa S. Sidhpurwala 2015-06-05 10:08:57 UTC
The following was reported by OpenSSL upstream:

When processing an ECParameters structure OpenSSL enters an infinite loop if
the curve specified is over a specially malformed binary polynomial field.

This can be used to perform denial of service against any
system which processes public keys, certificate requests or
certificates.  This includes TLS clients and TLS servers with
client authentication enabled.

This issue affects OpenSSL versions: 1.0.2 and 1.0.1. Recent
1.0.0 and 0.9.8 versions are not affected. 1.0.0d and 0.9.8r and below are
affected.

OpenSSL 1.0.2 users should upgrade to 1.0.2b
OpenSSL 1.0.1 users should upgrade to 1.0.1n
OpenSSL 1.0.0d (and below) users should upgrade to 1.0.0s
OpenSSL 0.9.8r (and below) users should upgrade to 0.9.8zg

This issue was reported to OpenSSL on 6th April 2015 by Joseph Birr-Pixton. The
fix was developed by Andy Polyakov of the OpenSSL development team.

Acknowledgements:

Red Hat would like to thank the OpenSSL project for reporting this issue.

Comment 1 Huzaifa S. Sidhpurwala 2015-06-05 10:27:47 UTC
Created attachment 1035150 [details]
Proposed patch for CVE-2015-1788

Comment 2 Tomas Mraz 2015-06-08 15:07:15 UTC
Note that this issue does not affect RHEL and Fedora as we remove the ECC support for the binary curves (GF(2m)).

Comment 4 Huzaifa S. Sidhpurwala 2015-06-09 06:16:14 UTC
Statement:

Not vulnerable. This issue does not affect the versions of openssl package as shipped with Red Hat Enterprise Linux 5, 6 and 7.

Comment 5 Huzaifa S. Sidhpurwala 2015-06-09 06:20:24 UTC
This issue does not affect the versions of openssl package as shipped with Fedora 21 and 22.

Comment 7 Huzaifa S. Sidhpurwala 2015-06-12 04:20:27 UTC
Public via:

https://www.openssl.org/news/secadv_20150611.txt

Upstream commits:

OpenSSL-1.0.1:
https://github.com/openssl/openssl/commit/f61bbf8da532038ed0eae16a9a11771f3da22d30

Comment 8 Tomas Hoger 2015-06-15 12:33:00 UTC
A blog post about this issue form the original reporter, which also provides a reproducer:

https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang/


Note You need to log in before you can comment on or make changes to this bug.