← Back to branch summary

~ubuntu-branches/ubuntu/lucid/openssl/lucid-security

« back to all changes in this revision

Viewing changes to debian/patches/CVE-2014-3510.patch

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2014-08-07 08:48:43 UTC
  • Revision ID: package-import@ubuntu.com-20140807084843-tdiyho5w4ps784yx
Tags: 0.9.8k-7ubuntu8.20
* SECURITY UPDATE: double free when processing DTLS packets
  - debian/patches/CVE-2014-3505.patch: fix double free in ssl/d1_both.c.
  - CVE-2014-3505
* SECURITY UPDATE: DTLS memory exhaustion
  - debian/patches/CVE-2014-3506.patch: fix DTLS handshake message size
    checks in ssl/d1_both.c.
  - CVE-2014-3506
* SECURITY UPDATE: information leak in pretty printing functions
  - debian/patches/CVE-2014-3508.patch: fix OID handling in
    crypto/asn1/a_object.c, crypto/objects/obj_dat.c, crypto/asn1/asn1.h,
    crypto/asn1/asn1_err.c.
  - CVE-2014-3508
* SECURITY UPDATE: DTLS anonymous EC(DH) denial of service
  - debian/patches/CVE-2014-3510.patch: check for server certs in
    ssl/d1_clnt.c, ssl/s3_clnt.c.
  - CVE-2014-3510
* SECURITY UPDATE: TLS protocol downgrade attack
  - debian/patches/CVE-2014-3511.patch: properly handle fragments in
    ssl/s23_srvr.c.
  - CVE-2014-3511

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/CVE-2014-3510.patch
 
1
From bff5319d9038765f864ef06e2e3c766f5c01dbd7 Mon Sep 17 00:00:00 2001
 
2
From: =?utf8?q?Emilia=20K=C3=A4sper?= <emilia@openssl.org>
 
3
Date: Thu, 24 Jul 2014 22:15:29 +0200
 
4
Subject: [PATCH] Fix DTLS anonymous EC(DH) denial of service
 
5
 
 
6
CVE-2014-3510
 
7
 
 
8
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
 
9
---
 
10
 ssl/d1_clnt.c |   16 ++++++++++++++--
 
11
 ssl/s3_clnt.c |    7 +++++++
 
12
 2 files changed, 21 insertions(+), 2 deletions(-)
 
13
 
 
14
Index: openssl-0.9.8k/ssl/d1_clnt.c
 
15
===================================================================
 
16
--- openssl-0.9.8k.orig/ssl/d1_clnt.c   2014-08-07 08:48:09.402887240 -0400
 
17
+++ openssl-0.9.8k/ssl/d1_clnt.c        2014-08-07 08:48:09.398887240 -0400
 
18
@@ -789,6 +789,13 @@
 
19
                        RSA *rsa;
 
20
                        unsigned char tmp_buf[SSL_MAX_MASTER_KEY_LENGTH];
 
21
 
 
22
+                       if (s->session->sess_cert == NULL)
 
23
+                               {
 
24
+                               /* We should always have a server certificate with SSL_kRSA. */
 
25
+                               SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
 
26
+                               goto err;
 
27
+                               }
 
28
+
 
29
                        if (s->session->sess_cert->peer_rsa_tmp != NULL)
 
30
                                rsa=s->session->sess_cert->peer_rsa_tmp;
 
31
                        else
 
32
@@ -979,6 +986,13 @@
 
33
                        {
 
34
                        DH *dh_srvr,*dh_clnt;
 
35
 
 
36
+                       if (s->session->sess_cert == NULL)
 
37
+                               {
 
38
+                               ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
 
39
+                               SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE);
 
40
+                               goto err;
 
41
+                               }
 
42
+
 
43
                        if (s->session->sess_cert->peer_dh_tmp != NULL)
 
44
                                dh_srvr=s->session->sess_cert->peer_dh_tmp;
 
45
                        else
 
46
@@ -1219,5 +1233,3 @@
 
47
        /* SSL3_ST_CW_CERT_D */
 
48
        return(dtls1_do_write(s,SSL3_RT_HANDSHAKE));
 
49
        }
 
50
-
 
51
-
 
52
Index: openssl-0.9.8k/ssl/s3_clnt.c
 
53
===================================================================
 
54
--- openssl-0.9.8k.orig/ssl/s3_clnt.c   2014-08-07 08:48:09.402887240 -0400
 
55
+++ openssl-0.9.8k/ssl/s3_clnt.c        2014-08-07 08:48:09.398887240 -0400
 
56
@@ -1904,6 +1904,13 @@
 
57
                        RSA *rsa;
 
58
                        unsigned char tmp_buf[SSL_MAX_MASTER_KEY_LENGTH];
 
59
 
 
60
+                       if (s->session->sess_cert == NULL)
 
61
+                               {
 
62
+                               /* We should always have a server certificate with SSL_kRSA. */
 
63
+                               SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
 
64
+                               goto err;
 
65
+                               }
 
66
+
 
67
                        if (s->session->sess_cert->peer_rsa_tmp != NULL)
 
68
                                rsa=s->session->sess_cert->peer_rsa_tmp;
 
69
                        else