Maintainers of the OpenSSL cryptographic library have patched high-severity holes that could make it possible for attackers to decrypt login credentials or execute malicious code on Web servers.
The updates were released Tuesday morning for both versions 1.0.1 and 1.0.2 of OpenSSL, which a large portion of the Internet relies on to cryptographically protect sensitive Web and e-mail traffic using the transport layer security protocol. OpenSSL advisories labeled the severity of both vulnerabilities "high," meaning the updates fixing them should be installed as soon as possible. The fixes bring the latest supported versions to 1.0.1t and 1.0.2h.
The decryption vulnerability is the result of what cryptographers call a padding oracle weakness, which allows attackers to repeatedly probe an encrypted payload for clues about the plaintext content inside. According to TLS expert Filippo Valsorda, the bug allows for only 16 bytes of encrypted traffic to be recovered, and even then only when an end user sends it repeatedly. Still, the conditions might make it possible for an attacker with the ability to monitor the connection to obtain authentication cookies and other small chunks of encrypted text, Valsorda wrote. The vulnerability is indexed as CVE-2016-2107.
Ironically, the bug was introduced in the 2013 patch of another padding oracle bug called Lucky 13. The fix inadvertently caused OpenSSL to stop performing a check designed to stop other types of oracle attacks. The new vulnerability is present when connections use an AES CBC cipher and the server supports AES-NI. Valsorda said older TLS schemes remain widely used and could make as many as one in four connections vulnerable.The second high-severity bug causes memory corruptions, a weakness that may allow attackers to execute malicious code. The vulnerability was fixed last June, although the security impact of the update wasn't known at the time. The threat is the result of two separate flaws that individually were considered minor but can make code execution possible when combined. The weakness, which is indexed as CVE-2016-2108, resides in the OpenSSL ASN.1 encoder and can potentially be exploited using malformed digital certificates signed by trusted certificate authorities. There appear to be several other requirements that make exploitation difficult.
The newly disclosed flaws are at least in part caused by OpenSSL's support of older encryption schemes that are no longer considered state of the art. Security expert Kenneth White told Ars, "Both of these bugs are the result of complex legacy interoperability which will be solved by moving off of known dangerous protocol constructions like CBC (which is mandatory under TLS 1.3), and by developing and adopting much less complex certificate encoding and parsing software."
reader comments
50