Bug 479650 (CVE-2009-0124) - CVE-2009-0124 tqsllib: OpenSSL incorrect checks for malformed signatures
Summary: CVE-2009-0124 tqsllib: OpenSSL incorrect checks for malformed signatures
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2009-0124
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://bugs.debian.org/cgi-bin/bugrep...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-01-12 11:15 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:28 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-05-02 16:57:00 UTC


Attachments (Terms of Use)

Description Jan Lieskovsky 2009-01-12 11:15:54 UTC
The TrustedQSL library incorrectly checked the result after
calling the EVP_VerifyFinal function, allowing a malformed signature
to be treated as a good signature rather than as an error.

Proposed patch:
- if (!EVP_VerifyFinal(&ctx, sig, slen, TQSL_API_TO_CERT(cert)->key)) {
+ if (EVP_VerifyFinal(&ctx, sig, slen, TQSL_API_TO_CERT(cert)->key) <= 0) {

References:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511509

Comment 1 Jan Lieskovsky 2009-01-12 11:17:21 UTC
This issue is related with recent OpenSSL's CVE-2008-5077 flaw.

This issue affects all versions of the tqsllib package, as shipped
with Fedora releases of 9, 10 and devel.

Please fix.

Comment 2 Fedora Update System 2009-01-12 17:07:42 UTC
tqsllib-2.0-5.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/tqsllib-2.0-5.fc10

Comment 3 Fedora Update System 2009-01-12 17:08:30 UTC
tqsllib-2.0-5.fc9 has been submitted as an update for Fedora 9.
http://admin.fedoraproject.org/updates/tqsllib-2.0-5.fc9

Comment 4 Lucian Langa 2009-01-12 17:10:11 UTC
Thanks for the report.

Comment 5 Fedora Update System 2009-01-15 02:55:44 UTC
tqsllib-2.0-5.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2009-01-15 03:07:24 UTC
tqsllib-2.0-5.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Jan Lieskovsky 2009-01-16 14:01:02 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-0124 to
the following vulnerability:

The tqsl_verifyDataBlock function in openssl_cert.cpp in American
Radio Relay League (ARRL) tqsllib 2.0 does not properly check the
return value from the OpenSSL EVP_VerifyFinal function, which allows
remote attackers to bypass validation of the certificate chain via a
malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0124
http://openwall.com/lists/oss-security/2009/01/12/4


Note You need to log in before you can comment on or make changes to this bug.