Bug 1060955 (CVE-2014-1491) - CVE-2014-1491 nss: Do not allow p-1 as a public DH value (MFSA 2014-12)
Summary: CVE-2014-1491 nss: Do not allow p-1 as a public DH value (MFSA 2014-12)
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-1491
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1101846 1113849 1113853
Blocks: 1054104 1063682
TreeView+ depends on / blocked
 
Reported: 2014-02-04 02:26 UTC by Huzaifa S. Sidhpurwala
Modified: 2021-02-17 06:54 UTC (History)
5 users (show)

Fixed In Version: nss 3.15.4
Doc Type: Bug Fix
Doc Text:
It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server.
Clone Of:
Environment:
Last Closed: 2014-09-18 03:05:48 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:0917 0 normal SHIPPED_LIVE Critical: nss and nspr security, bug fix, and enhancement update 2014-07-22 21:59:48 UTC
Red Hat Product Errata RHSA-2014:0979 0 normal SHIPPED_LIVE Moderate: rhev-hypervisor6 security and bug fix update 2014-07-29 18:39:50 UTC
Red Hat Product Errata RHSA-2014:1246 0 normal SHIPPED_LIVE Moderate: nss and nspr security, bug fix, and enhancement update 2014-09-16 09:39:01 UTC

Description Huzaifa S. Sidhpurwala 2014-02-04 02:26:12 UTC
1. Create a TLS server supporting only the DHE key exchange.
2. During any handshake, send the parameters <p, g, g^q> where p=2q+1 is a prime such that q is also prime and g is not a quadratic residue mod p
3. NSS accepts this value and proceeds with the handshake. The PMS computed by NSS is g^(q*Kc)


Actual results:

NSS accepts to proceed with the exchange. If g is not a quadratic residue mod p, then g^q = p-1 which is not rejected by NSS as it accepts any public value in [2, p-1] (this is allowed by rfc2631). Then, the computed PMS g^(q*Kc) is 1 if Kc is even (because g^(2q)=g^(p-1)=1 [mod p]) and p-1 if Kc is odd (because g^q=p-1 [mod p]). If the server chose a Ks with the same parity, the PMS will be the same on the client and server but the communication is not safe because an attacker can derive it from the parameters sent over the network.


Acknowledgements:

Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Antoine Delignat-Lavaud and Karthikeyan Bhargavan as the original reporters.

Comment 1 Vincent Danen 2014-02-04 18:15:06 UTC
External References:

http://www.mozilla.org/security/announce/2014/mfsa2014-12.html

Comment 3 Tomas Hoger 2014-02-05 09:14:29 UTC
Upstream advisory MFSA 2014-12 (see comment 1) links the following upstream bug as related to this CVE:

https://bugzilla.mozilla.org/show_bug.cgi?id=934545

Upstream bug is currently private, however, the following nss upstream commit references the above upstream bug:

http://hg.mozilla.org/projects/nss/rev/12c42006aed8

Comment 4 Huzaifa S. Sidhpurwala 2014-03-10 09:21:18 UTC
This issue has been resolved in nss-3.15.4.

Fedora 19 and Fedora 20 currently ship nss-3.15.5 and therefore is not vulnerable to this issue.

Comment 5 Huzaifa S. Sidhpurwala 2014-03-10 09:23:59 UTC
Statement:

(none)

Comment 10 errata-xmlrpc 2014-07-22 18:00:28 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2014:0917 https://rhn.redhat.com/errata/RHSA-2014-0917.html

Comment 11 Martin Prpič 2014-07-28 11:37:08 UTC
IssueDescription:

It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server.

Comment 12 errata-xmlrpc 2014-07-29 14:40:32 UTC
This issue has been addressed in following products:

  RHEV-H and Agents for RHEL-6

Via RHSA-2014:0979 https://rhn.redhat.com/errata/RHSA-2014-0979.html

Comment 13 errata-xmlrpc 2014-09-16 05:39:34 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5

Via RHSA-2014:1246 https://rhn.redhat.com/errata/RHSA-2014-1246.html


Note You need to log in before you can comment on or make changes to this bug.