Bug 1238322 (CVE-2015-3276) - CVE-2015-3276 openldap: incorrect multi-keyword mode cipherstring parsing
Summary: CVE-2015-3276 openldap: incorrect multi-keyword mode cipherstring parsing
Status: CLOSED ERRATA
Alias: CVE-2015-3276
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20150715,repor...
Keywords: Reopened, Security
Depends On: 1231522 1243517
Blocks: 1210268 1238327
TreeView+ depends on / blocked
 
Reported: 2015-07-01 15:20 UTC by Vasyl Kaigorodov
Modified: 2016-12-13 18:28 UTC (History)
12 users (show)

(edit)
A flaw was found in the way OpenLDAP parsed OpenSSL-style cipher strings. As a result, OpenLDAP could potentially use ciphers that were not intended to be enabled.
Clone Of:
(edit)
Last Closed: 2015-11-20 05:21:31 UTC


Attachments (Terms of Use)
patch against current upstream to provide correct AND logic for multiple-mask keywords (1.32 KB, text/plain)
2015-07-24 07:33 UTC, Martin Prpič
no flags Details


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:2131 normal SHIPPED_LIVE Moderate: openldap security, bug fix, and enhancement update 2015-11-19 09:10:21 UTC

Description Vasyl Kaigorodov 2015-07-01 15:20:52 UTC
The openldap (for NSS) emulation of the openssl cipherstring parsing code
incorrectly implements the multi-keyword mode.
As a consequence anyone using a combination like:

  ECDH+SHA

will not get the expected set of ciphers

  ECDH-RSA-RC4-SHA
  ECDH-RSA-DES-CBC3-SHA
  ECDH-RSA-AES128-SHA
  ECDH-RSA-AES256-SHA
  ECDH-ECDSA-RC4-SHA
  ECDH-ECDSA-DES-CBC3-SHA
  ECDH-ECDSA-AES128-SHA
  ECDH-ECDSA-AES256-SHA
  ECDHE-RSA-RC4-SHA
  ECDHE-RSA-DES-CBC3-SHA
  ECDHE-RSA-AES128-SHA
  ECDHE-RSA-AES256-SHA
  ECDHE-ECDSA-RC4-SHA
  ECDHE-ECDSA-DES-CBC3-SHA
  ECDHE-ECDSA-AES128-SHA
  ECDHE-ECDSA-AES256-SHA

but instead will match

  DES-CBC-SHA
  DES-CBC3-SHA
  RC4-SHA
  EDH-RSA-DES-CBC-SHA
  EDH-RSA-DES-CBC3-SHA
  EDH-DSS-DES-CBC-SHA
  EDH-DSS-DES-CBC3-SHA
  EXP1024-DES-CBC-SHA
  EXP1024-RC4-SHA
  SEED-SHA
  AES128-SHA
  AES256-SHA
  CAMELLIA256-SHA
  CAMELLIA128-SHA
  DHE-RSA-AES128-SHA
  DHE-RSA-AES256-SHA
  DHE-RSA-CAMELLIA128-SHA
  DHE-RSA-CAMELLIA256-SHA
  DHE-DSS-RC4-SHA
  DHE-DSS-AES128-SHA
  DHE-DSS-AES256-SHA
  DHE-DSS-CAMELLIA128-SHA
  DHE-DSS-CAMELLIA256-SHA
  ECDH-RSA-RC4-SHA
  ECDH-RSA-DES-CBC3-SHA
  ECDH-RSA-AES128-SHA
  ECDH-RSA-AES256-SHA
  ECDH-ECDSA-RC4-SHA
  ECDH-ECDSA-DES-CBC3-SHA
  ECDH-ECDSA-AES128-SHA
  ECDH-ECDSA-AES256-SHA
  ECDHE-RSA-RC4-SHA
  ECDHE-RSA-DES-CBC3-SHA
  ECDHE-RSA-AES128-SHA
  ECDHE-RSA-AES256-SHA
  ECDHE-ECDSA-RC4-SHA
  ECDHE-ECDSA-DES-CBC3-SHA
  ECDHE-ECDSA-AES128-SHA
  ECDHE-ECDSA-AES256-SHA

Acknowledgements:

This issue was discovered by Martin Poole of the Red Hat Software Maintenance Engineering group.

Comment 1 Vasyl Kaigorodov 2015-07-01 15:33:00 UTC
A suggested patch is attached in comment 4.

Comment 2 Kurt Seifried 2015-07-15 16:30:03 UTC
Created openldap tracking bugs for this issue:

Affects: fedora-all [bug 1243517]

Comment 4 Martin Prpič 2015-07-24 07:33:11 UTC
Created attachment 1055640 [details]
patch against current upstream to provide correct AND logic for multiple-mask keywords

Comment 6 Huzaifa S. Sidhpurwala 2015-08-14 08:55:51 UTC
Statement:

This issue does not affect the version of openldap package as shipped with Red Hat Enterprise Linux 5.

Comment 8 errata-xmlrpc 2015-11-19 08:53:39 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2131 https://rhn.redhat.com/errata/RHSA-2015-2131.html

Comment 9 Ankur Sao 2016-03-03 07:28:50 UTC
Which version of openLdap is affected by this vulnerability and in which version it is fixed ?

Comment 10 Havard Eidnes 2016-12-13 18:28:12 UTC
(In reply to Ankur Sao from comment #9)
> Which version of openLdap is affected by this vulnerability and in which
> version it is fixed ?

By the looks of it, all versions of openLdap are affected; I know the
latest at 2.4.44 is.

I tried submitting this bug upstream, but got turned away because of
IPR concerns over the rights to the fix, ref.

  http://www.openldap.org/its/index.cgi?findid=8543

Can someone from RedHat please submit this bugfix to LDAP, because
that doesn't appear to have happened...

Best regards,

- Håvard


Note You need to log in before you can comment on or make changes to this bug.